xmrig | 7d497bbc4f3339529f78e7edb7a46e26d73de511156b851c2c2f444c82f482ca

Analysis

max time kernel
111s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

484408becf3985b65e1260eb0a619e80N.exe
Size

1.2MB
MD5

484408becf3985b65e1260eb0a619e80
SHA1

148e6fb49a4b42d814e1baa804a9832f94d5ec27
SHA256

7d497bbc4f3339529f78e7edb7a46e26d73de511156b851c2c2f444c82f482ca
SHA512

798fedf76040a0fee8aee3bb9a7afb4960a4eff885d269aeb53755142ba4d0374eb70cb57b6255bcec8e855a560388046d2c4ca0db4a289bdc858cc11636e5f1
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYVfp1cnAfSlWhdU0nV:Lz071uv4BPMkibTIA5VDSlGnV

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3364-296-0x00007FF7FAC20000-0x00007FF7FB012000-memory.dmp	xmrig
behavioral2/memory/4800-295-0x00007FF7A5750000-0x00007FF7A5B42000-memory.dmp	xmrig
behavioral2/memory/1684-816-0x00007FF7385B0000-0x00007FF7389A2000-memory.dmp	xmrig
behavioral2/memory/3280-821-0x00007FF7F3140000-0x00007FF7F3532000-memory.dmp	xmrig
behavioral2/memory/2648-607-0x00007FF752910000-0x00007FF752D02000-memory.dmp	xmrig
behavioral2/memory/4528-454-0x00007FF62C340000-0x00007FF62C732000-memory.dmp	xmrig
behavioral2/memory/2484-452-0x00007FF7785A0000-0x00007FF778992000-memory.dmp	xmrig
behavioral2/memory/2392-919-0x00007FF67B600000-0x00007FF67B9F2000-memory.dmp	xmrig
behavioral2/memory/1280-921-0x00007FF706AB0000-0x00007FF706EA2000-memory.dmp	xmrig
behavioral2/memory/3132-870-0x00007FF6427E0000-0x00007FF642BD2000-memory.dmp	xmrig
behavioral2/memory/4508-867-0x00007FF64F840000-0x00007FF64FC32000-memory.dmp	xmrig
behavioral2/memory/3972-386-0x00007FF6B4CB0000-0x00007FF6B50A2000-memory.dmp	xmrig
behavioral2/memory/2664-985-0x00007FF604E20000-0x00007FF605212000-memory.dmp	xmrig
behavioral2/memory/2028-1007-0x00007FF7E75D0000-0x00007FF7E79C2000-memory.dmp	xmrig
behavioral2/memory/372-1056-0x00007FF6CA3E0000-0x00007FF6CA7D2000-memory.dmp	xmrig
behavioral2/memory/3188-1046-0x00007FF686780000-0x00007FF686B72000-memory.dmp	xmrig
behavioral2/memory/2332-1045-0x00007FF7F2CA0000-0x00007FF7F3092000-memory.dmp	xmrig
behavioral2/memory/2136-1006-0x00007FF659500000-0x00007FF6598F2000-memory.dmp	xmrig
behavioral2/memory/3720-1005-0x00007FF61B9D0000-0x00007FF61BDC2000-memory.dmp	xmrig
behavioral2/memory/1120-103-0x00007FF69E2E0000-0x00007FF69E6D2000-memory.dmp	xmrig
behavioral2/memory/3028-2808-0x00007FF63DF60000-0x00007FF63E352000-memory.dmp	xmrig
behavioral2/memory/3436-2809-0x00007FF723E30000-0x00007FF724222000-memory.dmp	xmrig
behavioral2/memory/4420-2810-0x00007FF77E640000-0x00007FF77EA32000-memory.dmp	xmrig
behavioral2/memory/5032-2811-0x00007FF66C2C0000-0x00007FF66C6B2000-memory.dmp	xmrig
behavioral2/memory/3028-2813-0x00007FF63DF60000-0x00007FF63E352000-memory.dmp	xmrig
behavioral2/memory/1120-2815-0x00007FF69E2E0000-0x00007FF69E6D2000-memory.dmp	xmrig
behavioral2/memory/5032-2828-0x00007FF66C2C0000-0x00007FF66C6B2000-memory.dmp	xmrig
behavioral2/memory/3436-2839-0x00007FF723E30000-0x00007FF724222000-memory.dmp	xmrig
behavioral2/memory/3364-2861-0x00007FF7FAC20000-0x00007FF7FB012000-memory.dmp	xmrig
behavioral2/memory/3280-2890-0x00007FF7F3140000-0x00007FF7F3532000-memory.dmp	xmrig
behavioral2/memory/4508-2894-0x00007FF64F840000-0x00007FF64FC32000-memory.dmp	xmrig
behavioral2/memory/4528-2900-0x00007FF62C340000-0x00007FF62C732000-memory.dmp	xmrig
behavioral2/memory/2392-2905-0x00007FF67B600000-0x00007FF67B9F2000-memory.dmp	xmrig
behavioral2/memory/2028-2915-0x00007FF7E75D0000-0x00007FF7E79C2000-memory.dmp	xmrig
behavioral2/memory/2136-2913-0x00007FF659500000-0x00007FF6598F2000-memory.dmp	xmrig
behavioral2/memory/3720-2911-0x00007FF61B9D0000-0x00007FF61BDC2000-memory.dmp	xmrig
behavioral2/memory/2664-2909-0x00007FF604E20000-0x00007FF605212000-memory.dmp	xmrig
behavioral2/memory/3132-2902-0x00007FF6427E0000-0x00007FF642BD2000-memory.dmp	xmrig
behavioral2/memory/3972-2899-0x00007FF6B4CB0000-0x00007FF6B50A2000-memory.dmp	xmrig
behavioral2/memory/372-2892-0x00007FF6CA3E0000-0x00007FF6CA7D2000-memory.dmp	xmrig
behavioral2/memory/2484-2897-0x00007FF7785A0000-0x00007FF778992000-memory.dmp	xmrig
behavioral2/memory/1684-2884-0x00007FF7385B0000-0x00007FF7389A2000-memory.dmp	xmrig
behavioral2/memory/2648-2873-0x00007FF752910000-0x00007FF752D02000-memory.dmp	xmrig
behavioral2/memory/3188-2889-0x00007FF686780000-0x00007FF686B72000-memory.dmp	xmrig
behavioral2/memory/2332-2859-0x00007FF7F2CA0000-0x00007FF7F3092000-memory.dmp	xmrig
behavioral2/memory/4800-2855-0x00007FF7A5750000-0x00007FF7A5B42000-memory.dmp	xmrig
behavioral2/memory/4420-2837-0x00007FF77E640000-0x00007FF77EA32000-memory.dmp	xmrig
behavioral2/memory/1280-2934-0x00007FF706AB0000-0x00007FF706EA2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2044	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3028	TSvHAFO.exe
3436	uyOGoLW.exe
5032	HNrmPQh.exe
4420	VGXJdeN.exe
1120	xwvkOhr.exe
2332	mFBIFzt.exe
4800	RzayQHi.exe
3364	JTkAPbb.exe
3188	BCOoHzN.exe
3972	rafkWmb.exe
2484	lMXgwza.exe
4528	uhrnTHv.exe
2648	CMzVFPQ.exe
1684	gUXjXut.exe
3280	swANndu.exe
4508	NptlsLw.exe
3132	cYPgzWA.exe
2392	ynImgdX.exe
372	ryhjifx.exe
1280	DpmlmQs.exe
2664	bqSJPHR.exe
3720	eFeNmYN.exe
2136	krhMVue.exe
2028	ATBmGgL.exe
512	yJKkCbD.exe
2196	GuDnrYy.exe
3448	VUlqbnL.exe
728	TAbuCTm.exe
4720	VCximlx.exe
4152	itwwUKp.exe
3980	PcJsVzn.exe
1408	uHYOheI.exe
1744	JXRRfxM.exe
4752	yZuniZS.exe
3088	RERCkPh.exe
5052	Qleohah.exe
3168	PEiCEMP.exe
4208	JhgwdfM.exe
1108	hiwFLGh.exe
4584	emAcQtB.exe
1016	iHiCJgL.exe
516	eGqqIjn.exe
3148	OnkuApM.exe
4576	ruEIgsI.exe
4748	jRvshDs.exe
2920	jZitezr.exe
4088	sGbXEZb.exe
4064	ZGxvVAu.exe
4816	UPTZOsa.exe
3412	XuykrVD.exe
1868	fWLJKae.exe
4616	EDWmYbR.exe
4388	cAfYUab.exe
4384	oKeQkcn.exe
2120	DztSQRe.exe
1116	NrzkJLa.exe
1400	sOZmcXs.exe
540	MfLBvWp.exe
2024	SYsOeZL.exe
3480	ZJPXmDx.exe
1724	spoFsle.exe
3152	PapEwEf.exe
1968	hNvPDvE.exe
1984	DJkFnQR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3676-0-0x00007FF616780000-0x00007FF616B72000-memory.dmp	upx
behavioral2/files/0x00090000000233f1-5.dat	upx
behavioral2/files/0x0008000000023454-7.dat	upx
behavioral2/files/0x0007000000023466-96.dat	upx
behavioral2/files/0x000700000002346c-172.dat	upx
behavioral2/files/0x0007000000023479-187.dat	upx
behavioral2/files/0x0007000000023478-186.dat	upx
behavioral2/files/0x0007000000023477-185.dat	upx
behavioral2/files/0x000700000002346d-181.dat	upx
behavioral2/files/0x000700000002346b-166.dat	upx
behavioral2/files/0x0007000000023463-162.dat	upx
behavioral2/memory/3364-296-0x00007FF7FAC20000-0x00007FF7FB012000-memory.dmp	upx
behavioral2/memory/4800-295-0x00007FF7A5750000-0x00007FF7A5B42000-memory.dmp	upx
behavioral2/memory/1684-816-0x00007FF7385B0000-0x00007FF7389A2000-memory.dmp	upx
behavioral2/memory/3280-821-0x00007FF7F3140000-0x00007FF7F3532000-memory.dmp	upx
behavioral2/memory/2648-607-0x00007FF752910000-0x00007FF752D02000-memory.dmp	upx
behavioral2/memory/4528-454-0x00007FF62C340000-0x00007FF62C732000-memory.dmp	upx
behavioral2/memory/2484-452-0x00007FF7785A0000-0x00007FF778992000-memory.dmp	upx
behavioral2/memory/2392-919-0x00007FF67B600000-0x00007FF67B9F2000-memory.dmp	upx
behavioral2/memory/1280-921-0x00007FF706AB0000-0x00007FF706EA2000-memory.dmp	upx
behavioral2/memory/3132-870-0x00007FF6427E0000-0x00007FF642BD2000-memory.dmp	upx
behavioral2/memory/4508-867-0x00007FF64F840000-0x00007FF64FC32000-memory.dmp	upx
behavioral2/memory/3972-386-0x00007FF6B4CB0000-0x00007FF6B50A2000-memory.dmp	upx
behavioral2/files/0x000700000002346a-163.dat	upx
behavioral2/files/0x0007000000023465-158.dat	upx
behavioral2/files/0x0007000000023474-153.dat	upx
behavioral2/files/0x0007000000023473-152.dat	upx
behavioral2/files/0x0007000000023475-189.dat	upx
behavioral2/files/0x0007000000023472-149.dat	upx
behavioral2/files/0x0007000000023471-148.dat	upx
behavioral2/files/0x000700000002346f-145.dat	upx
behavioral2/files/0x000700000002346e-143.dat	upx
behavioral2/files/0x0007000000023470-184.dat	upx
behavioral2/files/0x0007000000023476-183.dat	upx
behavioral2/files/0x0007000000023464-137.dat	upx
behavioral2/memory/2664-985-0x00007FF604E20000-0x00007FF605212000-memory.dmp	upx
behavioral2/memory/2028-1007-0x00007FF7E75D0000-0x00007FF7E79C2000-memory.dmp	upx
behavioral2/memory/372-1056-0x00007FF6CA3E0000-0x00007FF6CA7D2000-memory.dmp	upx
behavioral2/memory/3188-1046-0x00007FF686780000-0x00007FF686B72000-memory.dmp	upx
behavioral2/memory/2332-1045-0x00007FF7F2CA0000-0x00007FF7F3092000-memory.dmp	upx
behavioral2/memory/2136-1006-0x00007FF659500000-0x00007FF6598F2000-memory.dmp	upx
behavioral2/memory/3720-1005-0x00007FF61B9D0000-0x00007FF61BDC2000-memory.dmp	upx
behavioral2/files/0x0007000000023461-128.dat	upx
behavioral2/files/0x0007000000023460-122.dat	upx
behavioral2/files/0x000700000002345f-111.dat	upx
behavioral2/files/0x000700000002345a-110.dat	upx
behavioral2/files/0x000700000002345e-109.dat	upx
behavioral2/files/0x000700000002345d-107.dat	upx
behavioral2/files/0x000700000002345c-105.dat	upx
behavioral2/memory/1120-103-0x00007FF69E2E0000-0x00007FF69E6D2000-memory.dmp	upx
behavioral2/files/0x0007000000023469-99.dat	upx
behavioral2/files/0x0007000000023468-98.dat	upx
behavioral2/files/0x0007000000023467-97.dat	upx
behavioral2/files/0x0007000000023462-132.dat	upx
behavioral2/files/0x000700000002345b-116.dat	upx
behavioral2/memory/4420-90-0x00007FF77E640000-0x00007FF77EA32000-memory.dmp	upx
behavioral2/files/0x0007000000023459-82.dat	upx
behavioral2/files/0x0007000000023457-72.dat	upx
behavioral2/files/0x0007000000023458-71.dat	upx
behavioral2/memory/5032-52-0x00007FF66C2C0000-0x00007FF66C6B2000-memory.dmp	upx
behavioral2/files/0x0007000000023455-51.dat	upx
behavioral2/memory/3436-43-0x00007FF723E30000-0x00007FF724222000-memory.dmp	upx
behavioral2/files/0x0007000000023456-35.dat	upx
behavioral2/files/0x0009000000023451-31.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yTTCYIm.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\DFcFLwg.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\LLzKMdc.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\lMXgwza.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\WsXDjoK.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\roGSBBp.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\PtxykGO.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\hZPBTZX.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\JJbfBxD.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\vILsXZm.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\DSQWmeL.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\npXYgss.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\CAaeyMJ.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\LcpTleP.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\IlSziTS.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\qHqlpUr.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\krhkkBn.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\GXNoWyK.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\nwqupQO.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\swRwDcM.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\WIfLfdw.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\OTUfAgO.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\OUWzXtm.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\IpPTbfA.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\SGpcJjT.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\ZLPaMKk.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\oLMFMgQ.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\EmcGjJw.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\xWPNxac.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\wHnmYYJ.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\IXlAnAe.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\rFNBvHI.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\jRyRBle.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\FZlckCa.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\VwAsbqi.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\cOUsotT.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\yXONgSM.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\QYKYgSe.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\vSfEbNT.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\FcXGYNy.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\lFtWZsX.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\pTaVdxy.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\UxOBJNb.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\kwJksFW.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\YMCzdAl.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\rBVOWVZ.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\LfHcslp.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\JtbCZHK.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\VUTuonA.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\ryhjifx.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\IkzTcii.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\btYEcEH.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\fOJfCQe.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\iIMfOTy.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\VeZtJUu.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\kojvhAY.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\UdUbPvn.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\geqPjQp.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\gUXjXut.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\KFVPfOu.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\SfoRFgD.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\Bahnteg.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\XPovzZH.exe	484408becf3985b65e1260eb0a619e80N.exe
File created	C:\Windows\System\ntZtdXc.exe	484408becf3985b65e1260eb0a619e80N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3676	484408becf3985b65e1260eb0a619e80N.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeLockMemoryPrivilege	3676	484408becf3985b65e1260eb0a619e80N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 2044	3676	484408becf3985b65e1260eb0a619e80N.exe	82
PID 3676 wrote to memory of 2044	3676	484408becf3985b65e1260eb0a619e80N.exe	82
PID 3676 wrote to memory of 3028	3676	484408becf3985b65e1260eb0a619e80N.exe	83
PID 3676 wrote to memory of 3028	3676	484408becf3985b65e1260eb0a619e80N.exe	83
PID 3676 wrote to memory of 5032	3676	484408becf3985b65e1260eb0a619e80N.exe	85
PID 3676 wrote to memory of 5032	3676	484408becf3985b65e1260eb0a619e80N.exe	85
PID 3676 wrote to memory of 3436	3676	484408becf3985b65e1260eb0a619e80N.exe	86
PID 3676 wrote to memory of 3436	3676	484408becf3985b65e1260eb0a619e80N.exe	86
PID 3676 wrote to memory of 4420	3676	484408becf3985b65e1260eb0a619e80N.exe	87
PID 3676 wrote to memory of 4420	3676	484408becf3985b65e1260eb0a619e80N.exe	87
PID 3676 wrote to memory of 1120	3676	484408becf3985b65e1260eb0a619e80N.exe	88
PID 3676 wrote to memory of 1120	3676	484408becf3985b65e1260eb0a619e80N.exe	88
PID 3676 wrote to memory of 2332	3676	484408becf3985b65e1260eb0a619e80N.exe	89
PID 3676 wrote to memory of 2332	3676	484408becf3985b65e1260eb0a619e80N.exe	89
PID 3676 wrote to memory of 4800	3676	484408becf3985b65e1260eb0a619e80N.exe	90
PID 3676 wrote to memory of 4800	3676	484408becf3985b65e1260eb0a619e80N.exe	90
PID 3676 wrote to memory of 3364	3676	484408becf3985b65e1260eb0a619e80N.exe	91
PID 3676 wrote to memory of 3364	3676	484408becf3985b65e1260eb0a619e80N.exe	91
PID 3676 wrote to memory of 4528	3676	484408becf3985b65e1260eb0a619e80N.exe	92
PID 3676 wrote to memory of 4528	3676	484408becf3985b65e1260eb0a619e80N.exe	92
PID 3676 wrote to memory of 1684	3676	484408becf3985b65e1260eb0a619e80N.exe	93
PID 3676 wrote to memory of 1684	3676	484408becf3985b65e1260eb0a619e80N.exe	93
PID 3676 wrote to memory of 3188	3676	484408becf3985b65e1260eb0a619e80N.exe	94
PID 3676 wrote to memory of 3188	3676	484408becf3985b65e1260eb0a619e80N.exe	94
PID 3676 wrote to memory of 3972	3676	484408becf3985b65e1260eb0a619e80N.exe	95
PID 3676 wrote to memory of 3972	3676	484408becf3985b65e1260eb0a619e80N.exe	95
PID 3676 wrote to memory of 2484	3676	484408becf3985b65e1260eb0a619e80N.exe	96
PID 3676 wrote to memory of 2484	3676	484408becf3985b65e1260eb0a619e80N.exe	96
PID 3676 wrote to memory of 2648	3676	484408becf3985b65e1260eb0a619e80N.exe	97
PID 3676 wrote to memory of 2648	3676	484408becf3985b65e1260eb0a619e80N.exe	97
PID 3676 wrote to memory of 3280	3676	484408becf3985b65e1260eb0a619e80N.exe	98
PID 3676 wrote to memory of 3280	3676	484408becf3985b65e1260eb0a619e80N.exe	98
PID 3676 wrote to memory of 4508	3676	484408becf3985b65e1260eb0a619e80N.exe	99
PID 3676 wrote to memory of 4508	3676	484408becf3985b65e1260eb0a619e80N.exe	99
PID 3676 wrote to memory of 3132	3676	484408becf3985b65e1260eb0a619e80N.exe	100
PID 3676 wrote to memory of 3132	3676	484408becf3985b65e1260eb0a619e80N.exe	100
PID 3676 wrote to memory of 2392	3676	484408becf3985b65e1260eb0a619e80N.exe	101
PID 3676 wrote to memory of 2392	3676	484408becf3985b65e1260eb0a619e80N.exe	101
PID 3676 wrote to memory of 372	3676	484408becf3985b65e1260eb0a619e80N.exe	102
PID 3676 wrote to memory of 372	3676	484408becf3985b65e1260eb0a619e80N.exe	102
PID 3676 wrote to memory of 1280	3676	484408becf3985b65e1260eb0a619e80N.exe	103
PID 3676 wrote to memory of 1280	3676	484408becf3985b65e1260eb0a619e80N.exe	103
PID 3676 wrote to memory of 2664	3676	484408becf3985b65e1260eb0a619e80N.exe	104
PID 3676 wrote to memory of 2664	3676	484408becf3985b65e1260eb0a619e80N.exe	104
PID 3676 wrote to memory of 3720	3676	484408becf3985b65e1260eb0a619e80N.exe	105
PID 3676 wrote to memory of 3720	3676	484408becf3985b65e1260eb0a619e80N.exe	105
PID 3676 wrote to memory of 2136	3676	484408becf3985b65e1260eb0a619e80N.exe	106
PID 3676 wrote to memory of 2136	3676	484408becf3985b65e1260eb0a619e80N.exe	106
PID 3676 wrote to memory of 2028	3676	484408becf3985b65e1260eb0a619e80N.exe	107
PID 3676 wrote to memory of 2028	3676	484408becf3985b65e1260eb0a619e80N.exe	107
PID 3676 wrote to memory of 512	3676	484408becf3985b65e1260eb0a619e80N.exe	108
PID 3676 wrote to memory of 512	3676	484408becf3985b65e1260eb0a619e80N.exe	108
PID 3676 wrote to memory of 2196	3676	484408becf3985b65e1260eb0a619e80N.exe	109
PID 3676 wrote to memory of 2196	3676	484408becf3985b65e1260eb0a619e80N.exe	109
PID 3676 wrote to memory of 3448	3676	484408becf3985b65e1260eb0a619e80N.exe	110
PID 3676 wrote to memory of 3448	3676	484408becf3985b65e1260eb0a619e80N.exe	110
PID 3676 wrote to memory of 728	3676	484408becf3985b65e1260eb0a619e80N.exe	111
PID 3676 wrote to memory of 728	3676	484408becf3985b65e1260eb0a619e80N.exe	111
PID 3676 wrote to memory of 4720	3676	484408becf3985b65e1260eb0a619e80N.exe	112
PID 3676 wrote to memory of 4720	3676	484408becf3985b65e1260eb0a619e80N.exe	112
PID 3676 wrote to memory of 4152	3676	484408becf3985b65e1260eb0a619e80N.exe	113
PID 3676 wrote to memory of 4152	3676	484408becf3985b65e1260eb0a619e80N.exe	113
PID 3676 wrote to memory of 5052	3676	484408becf3985b65e1260eb0a619e80N.exe	114
PID 3676 wrote to memory of 5052	3676	484408becf3985b65e1260eb0a619e80N.exe	114

C:\Users\Admin\AppData\Local\Temp\484408becf3985b65e1260eb0a619e80N.exe
"C:\Users\Admin\AppData\Local\Temp\484408becf3985b65e1260eb0a619e80N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\System\TSvHAFO.exe
  C:\Windows\System\TSvHAFO.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\HNrmPQh.exe
  C:\Windows\System\HNrmPQh.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\uyOGoLW.exe
  C:\Windows\System\uyOGoLW.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\VGXJdeN.exe
  C:\Windows\System\VGXJdeN.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\xwvkOhr.exe
  C:\Windows\System\xwvkOhr.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\mFBIFzt.exe
  C:\Windows\System\mFBIFzt.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\RzayQHi.exe
  C:\Windows\System\RzayQHi.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\JTkAPbb.exe
  C:\Windows\System\JTkAPbb.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\uhrnTHv.exe
  C:\Windows\System\uhrnTHv.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\gUXjXut.exe
  C:\Windows\System\gUXjXut.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\BCOoHzN.exe
  C:\Windows\System\BCOoHzN.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\rafkWmb.exe
  C:\Windows\System\rafkWmb.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\lMXgwza.exe
  C:\Windows\System\lMXgwza.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\CMzVFPQ.exe
  C:\Windows\System\CMzVFPQ.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\swANndu.exe
  C:\Windows\System\swANndu.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\NptlsLw.exe
  C:\Windows\System\NptlsLw.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\cYPgzWA.exe
  C:\Windows\System\cYPgzWA.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\ynImgdX.exe
  C:\Windows\System\ynImgdX.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\ryhjifx.exe
  C:\Windows\System\ryhjifx.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\DpmlmQs.exe
  C:\Windows\System\DpmlmQs.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\bqSJPHR.exe
  C:\Windows\System\bqSJPHR.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\eFeNmYN.exe
  C:\Windows\System\eFeNmYN.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\krhMVue.exe
  C:\Windows\System\krhMVue.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ATBmGgL.exe
  C:\Windows\System\ATBmGgL.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\yJKkCbD.exe
  C:\Windows\System\yJKkCbD.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\GuDnrYy.exe
  C:\Windows\System\GuDnrYy.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\VUlqbnL.exe
  C:\Windows\System\VUlqbnL.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\TAbuCTm.exe
  C:\Windows\System\TAbuCTm.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\VCximlx.exe
  C:\Windows\System\VCximlx.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\itwwUKp.exe
  C:\Windows\System\itwwUKp.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\Qleohah.exe
  C:\Windows\System\Qleohah.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\PcJsVzn.exe
  C:\Windows\System\PcJsVzn.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\uHYOheI.exe
  C:\Windows\System\uHYOheI.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\JXRRfxM.exe
  C:\Windows\System\JXRRfxM.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\yZuniZS.exe
  C:\Windows\System\yZuniZS.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\emAcQtB.exe
  C:\Windows\System\emAcQtB.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\RERCkPh.exe
  C:\Windows\System\RERCkPh.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\PEiCEMP.exe
  C:\Windows\System\PEiCEMP.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\JhgwdfM.exe
  C:\Windows\System\JhgwdfM.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\hiwFLGh.exe
  C:\Windows\System\hiwFLGh.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\iHiCJgL.exe
  C:\Windows\System\iHiCJgL.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\eGqqIjn.exe
  C:\Windows\System\eGqqIjn.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\OnkuApM.exe
  C:\Windows\System\OnkuApM.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\ruEIgsI.exe
  C:\Windows\System\ruEIgsI.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\jRvshDs.exe
  C:\Windows\System\jRvshDs.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\NrzkJLa.exe
  C:\Windows\System\NrzkJLa.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\jZitezr.exe
  C:\Windows\System\jZitezr.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\sGbXEZb.exe
  C:\Windows\System\sGbXEZb.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\ZGxvVAu.exe
  C:\Windows\System\ZGxvVAu.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\UPTZOsa.exe
  C:\Windows\System\UPTZOsa.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\XuykrVD.exe
  C:\Windows\System\XuykrVD.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\fWLJKae.exe
  C:\Windows\System\fWLJKae.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\EDWmYbR.exe
  C:\Windows\System\EDWmYbR.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\cAfYUab.exe
  C:\Windows\System\cAfYUab.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\oKeQkcn.exe
  C:\Windows\System\oKeQkcn.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\DztSQRe.exe
  C:\Windows\System\DztSQRe.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\sOZmcXs.exe
  C:\Windows\System\sOZmcXs.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\MfLBvWp.exe
  C:\Windows\System\MfLBvWp.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\SYsOeZL.exe
  C:\Windows\System\SYsOeZL.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\RfJhAZw.exe
  C:\Windows\System\RfJhAZw.exe
  2⤵
  PID:3124
- C:\Windows\System\mwpmEIk.exe
  C:\Windows\System\mwpmEIk.exe
  2⤵
  PID:1828
- C:\Windows\System\ZJPXmDx.exe
  C:\Windows\System\ZJPXmDx.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\spoFsle.exe
  C:\Windows\System\spoFsle.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\PapEwEf.exe
  C:\Windows\System\PapEwEf.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\hNvPDvE.exe
  C:\Windows\System\hNvPDvE.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\DJkFnQR.exe
  C:\Windows\System\DJkFnQR.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\RqYAQxk.exe
  C:\Windows\System\RqYAQxk.exe
  2⤵
  PID:2172
- C:\Windows\System\gYdpMwj.exe
  C:\Windows\System\gYdpMwj.exe
  2⤵
  PID:4960
- C:\Windows\System\cCLDICh.exe
  C:\Windows\System\cCLDICh.exe
  2⤵
  PID:3860
- C:\Windows\System\vjAraob.exe
  C:\Windows\System\vjAraob.exe
  2⤵
  PID:4044
- C:\Windows\System\Lffvqyy.exe
  C:\Windows\System\Lffvqyy.exe
  2⤵
  PID:3324
- C:\Windows\System\LJHnFpL.exe
  C:\Windows\System\LJHnFpL.exe
  2⤵
  PID:5064
- C:\Windows\System\LfHcslp.exe
  C:\Windows\System\LfHcslp.exe
  2⤵
  PID:1964
- C:\Windows\System\hEoKCnM.exe
  C:\Windows\System\hEoKCnM.exe
  2⤵
  PID:5132
- C:\Windows\System\TWqSYzx.exe
  C:\Windows\System\TWqSYzx.exe
  2⤵
  PID:5180
- C:\Windows\System\ebaUkhK.exe
  C:\Windows\System\ebaUkhK.exe
  2⤵
  PID:5208
- C:\Windows\System\xhwVTNU.exe
  C:\Windows\System\xhwVTNU.exe
  2⤵
  PID:5228
- C:\Windows\System\dYNEWnd.exe
  C:\Windows\System\dYNEWnd.exe
  2⤵
  PID:5244
- C:\Windows\System\PAfVseI.exe
  C:\Windows\System\PAfVseI.exe
  2⤵
  PID:5260
- C:\Windows\System\AJnZNLs.exe
  C:\Windows\System\AJnZNLs.exe
  2⤵
  PID:5280
- C:\Windows\System\riZaQgA.exe
  C:\Windows\System\riZaQgA.exe
  2⤵
  PID:5316
- C:\Windows\System\fQYKuDZ.exe
  C:\Windows\System\fQYKuDZ.exe
  2⤵
  PID:5344
- C:\Windows\System\loXsDXZ.exe
  C:\Windows\System\loXsDXZ.exe
  2⤵
  PID:5364
- C:\Windows\System\JnjAwpS.exe
  C:\Windows\System\JnjAwpS.exe
  2⤵
  PID:5408
- C:\Windows\System\BoAcCPQ.exe
  C:\Windows\System\BoAcCPQ.exe
  2⤵
  PID:5464
- C:\Windows\System\kJDWIGx.exe
  C:\Windows\System\kJDWIGx.exe
  2⤵
  PID:5480
- C:\Windows\System\EWZNRnC.exe
  C:\Windows\System\EWZNRnC.exe
  2⤵
  PID:5496
- C:\Windows\System\HmqBWlC.exe
  C:\Windows\System\HmqBWlC.exe
  2⤵
  PID:5516
- C:\Windows\System\xbhEtCt.exe
  C:\Windows\System\xbhEtCt.exe
  2⤵
  PID:5532
- C:\Windows\System\GcIYmtm.exe
  C:\Windows\System\GcIYmtm.exe
  2⤵
  PID:5556
- C:\Windows\System\FZsOLOv.exe
  C:\Windows\System\FZsOLOv.exe
  2⤵
  PID:5572
- C:\Windows\System\EEgmSjM.exe
  C:\Windows\System\EEgmSjM.exe
  2⤵
  PID:5592
- C:\Windows\System\GXNoWyK.exe
  C:\Windows\System\GXNoWyK.exe
  2⤵
  PID:5612
- C:\Windows\System\mkteocO.exe
  C:\Windows\System\mkteocO.exe
  2⤵
  PID:5632
- C:\Windows\System\QzmvXQx.exe
  C:\Windows\System\QzmvXQx.exe
  2⤵
  PID:5656
- C:\Windows\System\WnRsmKx.exe
  C:\Windows\System\WnRsmKx.exe
  2⤵
  PID:5676
- C:\Windows\System\XsTcpXZ.exe
  C:\Windows\System\XsTcpXZ.exe
  2⤵
  PID:5700
- C:\Windows\System\FahQQMn.exe
  C:\Windows\System\FahQQMn.exe
  2⤵
  PID:5716
- C:\Windows\System\xEvAAgI.exe
  C:\Windows\System\xEvAAgI.exe
  2⤵
  PID:5736
- C:\Windows\System\tfvbcvG.exe
  C:\Windows\System\tfvbcvG.exe
  2⤵
  PID:5752
- C:\Windows\System\xXaaFfd.exe
  C:\Windows\System\xXaaFfd.exe
  2⤵
  PID:5768
- C:\Windows\System\LAjAtQo.exe
  C:\Windows\System\LAjAtQo.exe
  2⤵
  PID:5792
- C:\Windows\System\wkNbhgR.exe
  C:\Windows\System\wkNbhgR.exe
  2⤵
  PID:5808
- C:\Windows\System\XParOkx.exe
  C:\Windows\System\XParOkx.exe
  2⤵
  PID:5824
- C:\Windows\System\YFKfgeB.exe
  C:\Windows\System\YFKfgeB.exe
  2⤵
  PID:5864
- C:\Windows\System\hzVfTGQ.exe
  C:\Windows\System\hzVfTGQ.exe
  2⤵
  PID:5880
- C:\Windows\System\GHMFAyK.exe
  C:\Windows\System\GHMFAyK.exe
  2⤵
  PID:5908
- C:\Windows\System\grjVojk.exe
  C:\Windows\System\grjVojk.exe
  2⤵
  PID:5924
- C:\Windows\System\shDVRxW.exe
  C:\Windows\System\shDVRxW.exe
  2⤵
  PID:5952
- C:\Windows\System\NfUTwcn.exe
  C:\Windows\System\NfUTwcn.exe
  2⤵
  PID:5968
- C:\Windows\System\NbiMAzA.exe
  C:\Windows\System\NbiMAzA.exe
  2⤵
  PID:5992
- C:\Windows\System\BbWYoQp.exe
  C:\Windows\System\BbWYoQp.exe
  2⤵
  PID:6012
- C:\Windows\System\CNpEGlx.exe
  C:\Windows\System\CNpEGlx.exe
  2⤵
  PID:6032
- C:\Windows\System\VLBYVjM.exe
  C:\Windows\System\VLBYVjM.exe
  2⤵
  PID:6052
- C:\Windows\System\FEIFBoK.exe
  C:\Windows\System\FEIFBoK.exe
  2⤵
  PID:6072
- C:\Windows\System\gTSzcCK.exe
  C:\Windows\System\gTSzcCK.exe
  2⤵
  PID:6088
- C:\Windows\System\UltuCde.exe
  C:\Windows\System\UltuCde.exe
  2⤵
  PID:6108
- C:\Windows\System\pueniHG.exe
  C:\Windows\System\pueniHG.exe
  2⤵
  PID:4832
- C:\Windows\System\wkmlvCD.exe
  C:\Windows\System\wkmlvCD.exe
  2⤵
  PID:2668
- C:\Windows\System\qBtJxKx.exe
  C:\Windows\System\qBtJxKx.exe
  2⤵
  PID:2268
- C:\Windows\System\ULMKJje.exe
  C:\Windows\System\ULMKJje.exe
  2⤵
  PID:4296
- C:\Windows\System\GChXwVr.exe
  C:\Windows\System\GChXwVr.exe
  2⤵
  PID:4652
- C:\Windows\System\ozTSCmp.exe
  C:\Windows\System\ozTSCmp.exe
  2⤵
  PID:4864
- C:\Windows\System\YvqRCmv.exe
  C:\Windows\System\YvqRCmv.exe
  2⤵
  PID:1940
- C:\Windows\System\kEXIagZ.exe
  C:\Windows\System\kEXIagZ.exe
  2⤵
  PID:3600
- C:\Windows\System\KQTBgea.exe
  C:\Windows\System\KQTBgea.exe
  2⤵
  PID:3488
- C:\Windows\System\vRKyiGW.exe
  C:\Windows\System\vRKyiGW.exe
  2⤵
  PID:1132
- C:\Windows\System\keOaNwv.exe
  C:\Windows\System\keOaNwv.exe
  2⤵
  PID:1112
- C:\Windows\System\ZhbHMfA.exe
  C:\Windows\System\ZhbHMfA.exe
  2⤵
  PID:2980
- C:\Windows\System\TXvryno.exe
  C:\Windows\System\TXvryno.exe
  2⤵
  PID:5352
- C:\Windows\System\AFwtkEq.exe
  C:\Windows\System\AFwtkEq.exe
  2⤵
  PID:5140
- C:\Windows\System\ljmSXhe.exe
  C:\Windows\System\ljmSXhe.exe
  2⤵
  PID:5780
- C:\Windows\System\yKZtZsO.exe
  C:\Windows\System\yKZtZsO.exe
  2⤵
  PID:5876
- C:\Windows\System\KSrfXki.exe
  C:\Windows\System\KSrfXki.exe
  2⤵
  PID:5916
- C:\Windows\System\QCDWkME.exe
  C:\Windows\System\QCDWkME.exe
  2⤵
  PID:2132
- C:\Windows\System\NScUZTD.exe
  C:\Windows\System\NScUZTD.exe
  2⤵
  PID:6044
- C:\Windows\System\GxqpSUg.exe
  C:\Windows\System\GxqpSUg.exe
  2⤵
  PID:5308
- C:\Windows\System\rWvJpsf.exe
  C:\Windows\System\rWvJpsf.exe
  2⤵
  PID:5356
- C:\Windows\System\ZLPaMKk.exe
  C:\Windows\System\ZLPaMKk.exe
  2⤵
  PID:2216
- C:\Windows\System\gIQlPxy.exe
  C:\Windows\System\gIQlPxy.exe
  2⤵
  PID:936
- C:\Windows\System\GQPCQaS.exe
  C:\Windows\System\GQPCQaS.exe
  2⤵
  PID:6152
- C:\Windows\System\ChOEURM.exe
  C:\Windows\System\ChOEURM.exe
  2⤵
  PID:6172
- C:\Windows\System\hYdTuCI.exe
  C:\Windows\System\hYdTuCI.exe
  2⤵
  PID:6188
- C:\Windows\System\TmolMsU.exe
  C:\Windows\System\TmolMsU.exe
  2⤵
  PID:6212
- C:\Windows\System\fTndWsK.exe
  C:\Windows\System\fTndWsK.exe
  2⤵
  PID:6232
- C:\Windows\System\pPGdeyX.exe
  C:\Windows\System\pPGdeyX.exe
  2⤵
  PID:6248
- C:\Windows\System\EZYIeKH.exe
  C:\Windows\System\EZYIeKH.exe
  2⤵
  PID:6268
- C:\Windows\System\NqsxXIm.exe
  C:\Windows\System\NqsxXIm.exe
  2⤵
  PID:6288
- C:\Windows\System\AXMBczv.exe
  C:\Windows\System\AXMBczv.exe
  2⤵
  PID:6316
- C:\Windows\System\LSDACxf.exe
  C:\Windows\System\LSDACxf.exe
  2⤵
  PID:6332
- C:\Windows\System\uohPlub.exe
  C:\Windows\System\uohPlub.exe
  2⤵
  PID:6348
- C:\Windows\System\GvxcUaZ.exe
  C:\Windows\System\GvxcUaZ.exe
  2⤵
  PID:6364
- C:\Windows\System\aojRNvg.exe
  C:\Windows\System\aojRNvg.exe
  2⤵
  PID:6384
- C:\Windows\System\KTeBPaZ.exe
  C:\Windows\System\KTeBPaZ.exe
  2⤵
  PID:6404
- C:\Windows\System\RRJQSaG.exe
  C:\Windows\System\RRJQSaG.exe
  2⤵
  PID:6420
- C:\Windows\System\AZBSzxU.exe
  C:\Windows\System\AZBSzxU.exe
  2⤵
  PID:6440
- C:\Windows\System\weWdgOL.exe
  C:\Windows\System\weWdgOL.exe
  2⤵
  PID:6460
- C:\Windows\System\hQlhnzP.exe
  C:\Windows\System\hQlhnzP.exe
  2⤵
  PID:6476
- C:\Windows\System\OdvvqAT.exe
  C:\Windows\System\OdvvqAT.exe
  2⤵
  PID:6500
- C:\Windows\System\WsXDjoK.exe
  C:\Windows\System\WsXDjoK.exe
  2⤵
  PID:6516
- C:\Windows\System\PSkcOOw.exe
  C:\Windows\System\PSkcOOw.exe
  2⤵
  PID:6540
- C:\Windows\System\yTTCYIm.exe
  C:\Windows\System\yTTCYIm.exe
  2⤵
  PID:6556
- C:\Windows\System\ctqVwnS.exe
  C:\Windows\System\ctqVwnS.exe
  2⤵
  PID:6576
- C:\Windows\System\ZklSHfw.exe
  C:\Windows\System\ZklSHfw.exe
  2⤵
  PID:6600
- C:\Windows\System\jkROZvQ.exe
  C:\Windows\System\jkROZvQ.exe
  2⤵
  PID:6620
- C:\Windows\System\JRTmCLS.exe
  C:\Windows\System\JRTmCLS.exe
  2⤵
  PID:6640
- C:\Windows\System\WEamiyj.exe
  C:\Windows\System\WEamiyj.exe
  2⤵
  PID:6656
- C:\Windows\System\putkkNN.exe
  C:\Windows\System\putkkNN.exe
  2⤵
  PID:6680
- C:\Windows\System\hvpagPq.exe
  C:\Windows\System\hvpagPq.exe
  2⤵
  PID:6696
- C:\Windows\System\pysjERZ.exe
  C:\Windows\System\pysjERZ.exe
  2⤵
  PID:6720
- C:\Windows\System\DuKXYgI.exe
  C:\Windows\System\DuKXYgI.exe
  2⤵
  PID:6736
- C:\Windows\System\LBhKFtR.exe
  C:\Windows\System\LBhKFtR.exe
  2⤵
  PID:6764
- C:\Windows\System\JGEFvio.exe
  C:\Windows\System\JGEFvio.exe
  2⤵
  PID:6780
- C:\Windows\System\EQNjgnK.exe
  C:\Windows\System\EQNjgnK.exe
  2⤵
  PID:6804
- C:\Windows\System\ONTUOCX.exe
  C:\Windows\System\ONTUOCX.exe
  2⤵
  PID:6820
- C:\Windows\System\XKTFPri.exe
  C:\Windows\System\XKTFPri.exe
  2⤵
  PID:6848
- C:\Windows\System\ChNdLce.exe
  C:\Windows\System\ChNdLce.exe
  2⤵
  PID:6868
- C:\Windows\System\PAunuBy.exe
  C:\Windows\System\PAunuBy.exe
  2⤵
  PID:6884
- C:\Windows\System\sMDENUl.exe
  C:\Windows\System\sMDENUl.exe
  2⤵
  PID:6908
- C:\Windows\System\AAEDPoJ.exe
  C:\Windows\System\AAEDPoJ.exe
  2⤵
  PID:6924
- C:\Windows\System\yaZtHDD.exe
  C:\Windows\System\yaZtHDD.exe
  2⤵
  PID:6940
- C:\Windows\System\UZcklij.exe
  C:\Windows\System\UZcklij.exe
  2⤵
  PID:6964
- C:\Windows\System\EOhYlyN.exe
  C:\Windows\System\EOhYlyN.exe
  2⤵
  PID:6980
- C:\Windows\System\KpjLorn.exe
  C:\Windows\System\KpjLorn.exe
  2⤵
  PID:7004
- C:\Windows\System\aVGYzhi.exe
  C:\Windows\System\aVGYzhi.exe
  2⤵
  PID:7020
- C:\Windows\System\oLMFMgQ.exe
  C:\Windows\System\oLMFMgQ.exe
  2⤵
  PID:7044
- C:\Windows\System\jDhHQkS.exe
  C:\Windows\System\jDhHQkS.exe
  2⤵
  PID:7060
- C:\Windows\System\VQvphFw.exe
  C:\Windows\System\VQvphFw.exe
  2⤵
  PID:7080
- C:\Windows\System\KiXBKVl.exe
  C:\Windows\System\KiXBKVl.exe
  2⤵
  PID:7108
- C:\Windows\System\enzVuLF.exe
  C:\Windows\System\enzVuLF.exe
  2⤵
  PID:7124
- C:\Windows\System\YikdVtf.exe
  C:\Windows\System\YikdVtf.exe
  2⤵
  PID:7152
- C:\Windows\System\yZUyoln.exe
  C:\Windows\System\yZUyoln.exe
  2⤵
  PID:2372
- C:\Windows\System\gUjNFIp.exe
  C:\Windows\System\gUjNFIp.exe
  2⤵
  PID:5160
- C:\Windows\System\QHYZjHm.exe
  C:\Windows\System\QHYZjHm.exe
  2⤵
  PID:848
- C:\Windows\System\VJNhFLo.exe
  C:\Windows\System\VJNhFLo.exe
  2⤵
  PID:5848
- C:\Windows\System\NyKbcIL.exe
  C:\Windows\System\NyKbcIL.exe
  2⤵
  PID:5240
- C:\Windows\System\usRmtGS.exe
  C:\Windows\System\usRmtGS.exe
  2⤵
  PID:5256
- C:\Windows\System\gMBsRln.exe
  C:\Windows\System\gMBsRln.exe
  2⤵
  PID:6020
- C:\Windows\System\bJYaHLj.exe
  C:\Windows\System\bJYaHLj.exe
  2⤵
  PID:5376
- C:\Windows\System\AQGFtsj.exe
  C:\Windows\System\AQGFtsj.exe
  2⤵
  PID:5428
- C:\Windows\System\QYKYgSe.exe
  C:\Windows\System\QYKYgSe.exe
  2⤵
  PID:5892
- C:\Windows\System\ZOIiOxK.exe
  C:\Windows\System\ZOIiOxK.exe
  2⤵
  PID:5292
- C:\Windows\System\wjmyLKA.exe
  C:\Windows\System\wjmyLKA.exe
  2⤵
  PID:1692
- C:\Windows\System\xdyHazx.exe
  C:\Windows\System\xdyHazx.exe
  2⤵
  PID:5372
- C:\Windows\System\bsPVTQY.exe
  C:\Windows\System\bsPVTQY.exe
  2⤵
  PID:668
- C:\Windows\System\qVfZeiA.exe
  C:\Windows\System\qVfZeiA.exe
  2⤵
  PID:3548
- C:\Windows\System\JwnRIzl.exe
  C:\Windows\System\JwnRIzl.exe
  2⤵
  PID:1776
- C:\Windows\System\zGBvbhv.exe
  C:\Windows\System\zGBvbhv.exe
  2⤵
  PID:6244
- C:\Windows\System\XdpBQKS.exe
  C:\Windows\System\XdpBQKS.exe
  2⤵
  PID:7176
- C:\Windows\System\vTVXJtp.exe
  C:\Windows\System\vTVXJtp.exe
  2⤵
  PID:7192
- C:\Windows\System\LQJbjOW.exe
  C:\Windows\System\LQJbjOW.exe
  2⤵
  PID:7212
- C:\Windows\System\oVYzaaf.exe
  C:\Windows\System\oVYzaaf.exe
  2⤵
  PID:7228
- C:\Windows\System\wpNWwOC.exe
  C:\Windows\System\wpNWwOC.exe
  2⤵
  PID:7248
- C:\Windows\System\OWvspDr.exe
  C:\Windows\System\OWvspDr.exe
  2⤵
  PID:7268
- C:\Windows\System\qKYeDPC.exe
  C:\Windows\System\qKYeDPC.exe
  2⤵
  PID:7284
- C:\Windows\System\aSqVRHr.exe
  C:\Windows\System\aSqVRHr.exe
  2⤵
  PID:7308
- C:\Windows\System\ChFftCI.exe
  C:\Windows\System\ChFftCI.exe
  2⤵
  PID:7332
- C:\Windows\System\GJyYyXn.exe
  C:\Windows\System\GJyYyXn.exe
  2⤵
  PID:7356
- C:\Windows\System\eSnqAmZ.exe
  C:\Windows\System\eSnqAmZ.exe
  2⤵
  PID:7372
- C:\Windows\System\qVGzwNW.exe
  C:\Windows\System\qVGzwNW.exe
  2⤵
  PID:7400
- C:\Windows\System\qDMiBvf.exe
  C:\Windows\System\qDMiBvf.exe
  2⤵
  PID:7420
- C:\Windows\System\CjFWgBn.exe
  C:\Windows\System\CjFWgBn.exe
  2⤵
  PID:7436
- C:\Windows\System\efDwRmf.exe
  C:\Windows\System\efDwRmf.exe
  2⤵
  PID:7460
- C:\Windows\System\WgOhGHw.exe
  C:\Windows\System\WgOhGHw.exe
  2⤵
  PID:7476
- C:\Windows\System\tQuYzOo.exe
  C:\Windows\System\tQuYzOo.exe
  2⤵
  PID:7500
- C:\Windows\System\jeTXfkM.exe
  C:\Windows\System\jeTXfkM.exe
  2⤵
  PID:7516
- C:\Windows\System\NsGVnWE.exe
  C:\Windows\System\NsGVnWE.exe
  2⤵
  PID:7540
- C:\Windows\System\FJoeENb.exe
  C:\Windows\System\FJoeENb.exe
  2⤵
  PID:7556
- C:\Windows\System\cPeAYnu.exe
  C:\Windows\System\cPeAYnu.exe
  2⤵
  PID:7576
- C:\Windows\System\SxHyVPe.exe
  C:\Windows\System\SxHyVPe.exe
  2⤵
  PID:7600
- C:\Windows\System\qXyyvfc.exe
  C:\Windows\System\qXyyvfc.exe
  2⤵
  PID:7620
- C:\Windows\System\FcSoAQZ.exe
  C:\Windows\System\FcSoAQZ.exe
  2⤵
  PID:7636
- C:\Windows\System\IeYlBCs.exe
  C:\Windows\System\IeYlBCs.exe
  2⤵
  PID:7660
- C:\Windows\System\yXyuYES.exe
  C:\Windows\System\yXyuYES.exe
  2⤵
  PID:7676
- C:\Windows\System\UPKUqmp.exe
  C:\Windows\System\UPKUqmp.exe
  2⤵
  PID:7700
- C:\Windows\System\iGuFOIg.exe
  C:\Windows\System\iGuFOIg.exe
  2⤵
  PID:7720
- C:\Windows\System\ySPZEgx.exe
  C:\Windows\System\ySPZEgx.exe
  2⤵
  PID:7744
- C:\Windows\System\FAmpBNT.exe
  C:\Windows\System\FAmpBNT.exe
  2⤵
  PID:7760
- C:\Windows\System\RDWmEWL.exe
  C:\Windows\System\RDWmEWL.exe
  2⤵
  PID:7792
- C:\Windows\System\ZLyxIin.exe
  C:\Windows\System\ZLyxIin.exe
  2⤵
  PID:7812
- C:\Windows\System\dggYCGl.exe
  C:\Windows\System\dggYCGl.exe
  2⤵
  PID:7828
- C:\Windows\System\WUoRPYP.exe
  C:\Windows\System\WUoRPYP.exe
  2⤵
  PID:7852
- C:\Windows\System\suXvoYb.exe
  C:\Windows\System\suXvoYb.exe
  2⤵
  PID:7868
- C:\Windows\System\exXjjtx.exe
  C:\Windows\System\exXjjtx.exe
  2⤵
  PID:7888
- C:\Windows\System\bRUUmto.exe
  C:\Windows\System\bRUUmto.exe
  2⤵
  PID:7908
- C:\Windows\System\Vbiugru.exe
  C:\Windows\System\Vbiugru.exe
  2⤵
  PID:7940
- C:\Windows\System\WxIrNNh.exe
  C:\Windows\System\WxIrNNh.exe
  2⤵
  PID:7964
- C:\Windows\System\PbfwOwy.exe
  C:\Windows\System\PbfwOwy.exe
  2⤵
  PID:7980
- C:\Windows\System\DSQWmeL.exe
  C:\Windows\System\DSQWmeL.exe
  2⤵
  PID:8000
- C:\Windows\System\DOVifnI.exe
  C:\Windows\System\DOVifnI.exe
  2⤵
  PID:8020
- C:\Windows\System\mWsKpOL.exe
  C:\Windows\System\mWsKpOL.exe
  2⤵
  PID:8044
- C:\Windows\System\IkzTcii.exe
  C:\Windows\System\IkzTcii.exe
  2⤵
  PID:8060
- C:\Windows\System\omNVIVJ.exe
  C:\Windows\System\omNVIVJ.exe
  2⤵
  PID:8084
- C:\Windows\System\dvSydSl.exe
  C:\Windows\System\dvSydSl.exe
  2⤵
  PID:8100
- C:\Windows\System\EyGAVGt.exe
  C:\Windows\System\EyGAVGt.exe
  2⤵
  PID:8116
- C:\Windows\System\sFUWrum.exe
  C:\Windows\System\sFUWrum.exe
  2⤵
  PID:8136
- C:\Windows\System\usSYewQ.exe
  C:\Windows\System\usSYewQ.exe
  2⤵
  PID:8152
- C:\Windows\System\KxeRLuh.exe
  C:\Windows\System\KxeRLuh.exe
  2⤵
  PID:8180
- C:\Windows\System\VrcgaWZ.exe
  C:\Windows\System\VrcgaWZ.exe
  2⤵
  PID:2252
- C:\Windows\System\wxmCUZh.exe
  C:\Windows\System\wxmCUZh.exe
  2⤵
  PID:5476
- C:\Windows\System\GZbevwH.exe
  C:\Windows\System\GZbevwH.exe
  2⤵
  PID:5524
- C:\Windows\System\oDzmQhe.exe
  C:\Windows\System\oDzmQhe.exe
  2⤵
  PID:5580
- C:\Windows\System\EVDXnRA.exe
  C:\Windows\System\EVDXnRA.exe
  2⤵
  PID:5604
- C:\Windows\System\sFWFiXe.exe
  C:\Windows\System\sFWFiXe.exe
  2⤵
  PID:5652
- C:\Windows\System\FSpwfSl.exe
  C:\Windows\System\FSpwfSl.exe
  2⤵
  PID:5692
- C:\Windows\System\IxePRWI.exe
  C:\Windows\System\IxePRWI.exe
  2⤵
  PID:2904
- C:\Windows\System\LZLptGK.exe
  C:\Windows\System\LZLptGK.exe
  2⤵
  PID:6468
- C:\Windows\System\lzLzVsc.exe
  C:\Windows\System\lzLzVsc.exe
  2⤵
  PID:4324
- C:\Windows\System\JPZkmKN.exe
  C:\Windows\System\JPZkmKN.exe
  2⤵
  PID:6524
- C:\Windows\System\gVvrNIN.exe
  C:\Windows\System\gVvrNIN.exe
  2⤵
  PID:6568
- C:\Windows\System\HtVlvHc.exe
  C:\Windows\System\HtVlvHc.exe
  2⤵
  PID:5816
- C:\Windows\System\kwJksFW.exe
  C:\Windows\System\kwJksFW.exe
  2⤵
  PID:1224
- C:\Windows\System\ZfKyCbD.exe
  C:\Windows\System\ZfKyCbD.exe
  2⤵
  PID:6664
- C:\Windows\System\SCmcrrW.exe
  C:\Windows\System\SCmcrrW.exe
  2⤵
  PID:6744
- C:\Windows\System\rFNBvHI.exe
  C:\Windows\System\rFNBvHI.exe
  2⤵
  PID:6832
- C:\Windows\System\hQIyKhW.exe
  C:\Windows\System\hQIyKhW.exe
  2⤵
  PID:6900
- C:\Windows\System\gdYGLXo.exe
  C:\Windows\System\gdYGLXo.exe
  2⤵
  PID:6932
- C:\Windows\System\vrzkBEM.exe
  C:\Windows\System\vrzkBEM.exe
  2⤵
  PID:7000
- C:\Windows\System\ydXbALO.exe
  C:\Windows\System\ydXbALO.exe
  2⤵
  PID:7052
- C:\Windows\System\fvwOQAm.exe
  C:\Windows\System\fvwOQAm.exe
  2⤵
  PID:3016
- C:\Windows\System\MvDmusf.exe
  C:\Windows\System\MvDmusf.exe
  2⤵
  PID:5192
- C:\Windows\System\zRYGcsC.exe
  C:\Windows\System\zRYGcsC.exe
  2⤵
  PID:6148
- C:\Windows\System\YSPbUBc.exe
  C:\Windows\System\YSPbUBc.exe
  2⤵
  PID:1772
- C:\Windows\System\LZyKuXR.exe
  C:\Windows\System\LZyKuXR.exe
  2⤵
  PID:2788
- C:\Windows\System\tvNlVwP.exe
  C:\Windows\System\tvNlVwP.exe
  2⤵
  PID:8204
- C:\Windows\System\qmIbRao.exe
  C:\Windows\System\qmIbRao.exe
  2⤵
  PID:8220
- C:\Windows\System\ydCqlmp.exe
  C:\Windows\System\ydCqlmp.exe
  2⤵
  PID:8244
- C:\Windows\System\GNvmLqM.exe
  C:\Windows\System\GNvmLqM.exe
  2⤵
  PID:8260
- C:\Windows\System\mCrSBhm.exe
  C:\Windows\System\mCrSBhm.exe
  2⤵
  PID:8280
- C:\Windows\System\tsEbobO.exe
  C:\Windows\System\tsEbobO.exe
  2⤵
  PID:8300
- C:\Windows\System\qagAJFt.exe
  C:\Windows\System\qagAJFt.exe
  2⤵
  PID:8320
- C:\Windows\System\fqOwNFd.exe
  C:\Windows\System\fqOwNFd.exe
  2⤵
  PID:8340
- C:\Windows\System\LUYiuXY.exe
  C:\Windows\System\LUYiuXY.exe
  2⤵
  PID:8356
- C:\Windows\System\GKTrgKs.exe
  C:\Windows\System\GKTrgKs.exe
  2⤵
  PID:8376
- C:\Windows\System\BvlghiV.exe
  C:\Windows\System\BvlghiV.exe
  2⤵
  PID:8392
- C:\Windows\System\VPlQfGA.exe
  C:\Windows\System\VPlQfGA.exe
  2⤵
  PID:8412
- C:\Windows\System\aJfFGLY.exe
  C:\Windows\System\aJfFGLY.exe
  2⤵
  PID:8428
- C:\Windows\System\DrFpjvO.exe
  C:\Windows\System\DrFpjvO.exe
  2⤵
  PID:8448
- C:\Windows\System\OWXxjgJ.exe
  C:\Windows\System\OWXxjgJ.exe
  2⤵
  PID:8464
- C:\Windows\System\SvnRgOp.exe
  C:\Windows\System\SvnRgOp.exe
  2⤵
  PID:8480
- C:\Windows\System\gUIzoaS.exe
  C:\Windows\System\gUIzoaS.exe
  2⤵
  PID:8504
- C:\Windows\System\EQmoiwi.exe
  C:\Windows\System\EQmoiwi.exe
  2⤵
  PID:8520
- C:\Windows\System\flWETBx.exe
  C:\Windows\System\flWETBx.exe
  2⤵
  PID:8540
- C:\Windows\System\YeiAtos.exe
  C:\Windows\System\YeiAtos.exe
  2⤵
  PID:8568
- C:\Windows\System\jMfAhpJ.exe
  C:\Windows\System\jMfAhpJ.exe
  2⤵
  PID:8592
- C:\Windows\System\lGfCiXw.exe
  C:\Windows\System\lGfCiXw.exe
  2⤵
  PID:8608
- C:\Windows\System\ESakBFp.exe
  C:\Windows\System\ESakBFp.exe
  2⤵
  PID:8628
- C:\Windows\System\TmhBDza.exe
  C:\Windows\System\TmhBDza.exe
  2⤵
  PID:8652
- C:\Windows\System\eGbRNzQ.exe
  C:\Windows\System\eGbRNzQ.exe
  2⤵
  PID:8784
- C:\Windows\System\mSfxMqG.exe
  C:\Windows\System\mSfxMqG.exe
  2⤵
  PID:8740
- C:\Windows\System\WDzYhte.exe
  C:\Windows\System\WDzYhte.exe
  2⤵
  PID:8772
- C:\Windows\System\MPkUnKP.exe
  C:\Windows\System\MPkUnKP.exe
  2⤵
  PID:6552
- C:\Windows\System\nwqupQO.exe
  C:\Windows\System\nwqupQO.exe
  2⤵
  PID:8092
- C:\Windows\System\rrHKxqU.exe
  C:\Windows\System\rrHKxqU.exe
  2⤵
  PID:6876
- C:\Windows\System\KCBwUMA.exe
  C:\Windows\System\KCBwUMA.exe
  2⤵
  PID:1028
- C:\Windows\System\fwTLBtu.exe
  C:\Windows\System\fwTLBtu.exe
  2⤵
  PID:8876
- C:\Windows\System\clQgNmF.exe
  C:\Windows\System\clQgNmF.exe
  2⤵
  PID:9072
- C:\Windows\System\qqCsoXL.exe
  C:\Windows\System\qqCsoXL.exe
  2⤵
  PID:9124
- C:\Windows\System\TCXpVit.exe
  C:\Windows\System\TCXpVit.exe
  2⤵
  PID:6228
- C:\Windows\System\rcatbfE.exe
  C:\Windows\System\rcatbfE.exe
  2⤵
  PID:8212
- C:\Windows\System\uYFAUmF.exe
  C:\Windows\System\uYFAUmF.exe
  2⤵
  PID:4012
- C:\Windows\System\EuWVmmm.exe
  C:\Windows\System\EuWVmmm.exe
  2⤵
  PID:4984
- C:\Windows\System\KMxbhGa.exe
  C:\Windows\System\KMxbhGa.exe
  2⤵
  PID:8028
- C:\Windows\System\CAaeyMJ.exe
  C:\Windows\System\CAaeyMJ.exe
  2⤵
  PID:7772
- C:\Windows\System\DTedQCH.exe
  C:\Windows\System\DTedQCH.exe
  2⤵
  PID:6812
- C:\Windows\System\TWwdnSe.exe
  C:\Windows\System\TWwdnSe.exe
  2⤵
  PID:6732
- C:\Windows\System\hZPBTZX.exe
  C:\Windows\System\hZPBTZX.exe
  2⤵
  PID:3584
- C:\Windows\System\crfMDNB.exe
  C:\Windows\System\crfMDNB.exe
  2⤵
  PID:8216
- C:\Windows\System\wFjpiUh.exe
  C:\Windows\System\wFjpiUh.exe
  2⤵
  PID:7220
- C:\Windows\System\sBKLXzv.exe
  C:\Windows\System\sBKLXzv.exe
  2⤵
  PID:6328
- C:\Windows\System\nxVXpuZ.exe
  C:\Windows\System\nxVXpuZ.exe
  2⤵
  PID:7536
- C:\Windows\System\rMobWbi.exe
  C:\Windows\System\rMobWbi.exe
  2⤵
  PID:6612
- C:\Windows\System\QgdavcF.exe
  C:\Windows\System\QgdavcF.exe
  2⤵
  PID:2848
- C:\Windows\System\hGHPcVN.exe
  C:\Windows\System\hGHPcVN.exe
  2⤵
  PID:8924
- C:\Windows\System\thCqeJR.exe
  C:\Windows\System\thCqeJR.exe
  2⤵
  PID:2208
- C:\Windows\System\dRxBbSx.exe
  C:\Windows\System\dRxBbSx.exe
  2⤵
  PID:9236
- C:\Windows\System\SNfQelu.exe
  C:\Windows\System\SNfQelu.exe
  2⤵
  PID:9252
- C:\Windows\System\KncVzyb.exe
  C:\Windows\System\KncVzyb.exe
  2⤵
  PID:9276
- C:\Windows\System\LQmSOLZ.exe
  C:\Windows\System\LQmSOLZ.exe
  2⤵
  PID:9296
- C:\Windows\System\OAoTTTm.exe
  C:\Windows\System\OAoTTTm.exe
  2⤵
  PID:9312
- C:\Windows\System\tjlNQnq.exe
  C:\Windows\System\tjlNQnq.exe
  2⤵
  PID:9340
- C:\Windows\System\uYOaOaz.exe
  C:\Windows\System\uYOaOaz.exe
  2⤵
  PID:9368
- C:\Windows\System\swRwDcM.exe
  C:\Windows\System\swRwDcM.exe
  2⤵
  PID:9384
- C:\Windows\System\VmQGWpb.exe
  C:\Windows\System\VmQGWpb.exe
  2⤵
  PID:9400
- C:\Windows\System\VxhWoDT.exe
  C:\Windows\System\VxhWoDT.exe
  2⤵
  PID:9420
- C:\Windows\System\VjjAptc.exe
  C:\Windows\System\VjjAptc.exe
  2⤵
  PID:9460
- C:\Windows\System\GbFmPRu.exe
  C:\Windows\System\GbFmPRu.exe
  2⤵
  PID:9480
- C:\Windows\System\bqmuYXq.exe
  C:\Windows\System\bqmuYXq.exe
  2⤵
  PID:9500
- C:\Windows\System\lMXMMFb.exe
  C:\Windows\System\lMXMMFb.exe
  2⤵
  PID:9520
- C:\Windows\System\ZObKjEv.exe
  C:\Windows\System\ZObKjEv.exe
  2⤵
  PID:9540
- C:\Windows\System\YclRONA.exe
  C:\Windows\System\YclRONA.exe
  2⤵
  PID:9560
- C:\Windows\System\XVBLbtJ.exe
  C:\Windows\System\XVBLbtJ.exe
  2⤵
  PID:9576
- C:\Windows\System\WvTUMOd.exe
  C:\Windows\System\WvTUMOd.exe
  2⤵
  PID:9596
- C:\Windows\System\IPCGUPg.exe
  C:\Windows\System\IPCGUPg.exe
  2⤵
  PID:9616
- C:\Windows\System\LWjmJUl.exe
  C:\Windows\System\LWjmJUl.exe
  2⤵
  PID:9636
- C:\Windows\System\kQAKvHH.exe
  C:\Windows\System\kQAKvHH.exe
  2⤵
  PID:9656
- C:\Windows\System\iIMfOTy.exe
  C:\Windows\System\iIMfOTy.exe
  2⤵
  PID:9672
- C:\Windows\System\geGpXLr.exe
  C:\Windows\System\geGpXLr.exe
  2⤵
  PID:9688
- C:\Windows\System\vuNjAjV.exe
  C:\Windows\System\vuNjAjV.exe
  2⤵
  PID:9712
- C:\Windows\System\JNZCFka.exe
  C:\Windows\System\JNZCFka.exe
  2⤵
  PID:9732
- C:\Windows\System\PLprcGd.exe
  C:\Windows\System\PLprcGd.exe
  2⤵
  PID:9756
- C:\Windows\System\domitqu.exe
  C:\Windows\System\domitqu.exe
  2⤵
  PID:9784
- C:\Windows\System\QTGBTKu.exe
  C:\Windows\System\QTGBTKu.exe
  2⤵
  PID:9800
- C:\Windows\System\OpoyWiX.exe
  C:\Windows\System\OpoyWiX.exe
  2⤵
  PID:9868
- C:\Windows\System\LAfsycz.exe
  C:\Windows\System\LAfsycz.exe
  2⤵
  PID:9884
- C:\Windows\System\HxGcYyO.exe
  C:\Windows\System\HxGcYyO.exe
  2⤵
  PID:9904
- C:\Windows\System\McNYTCx.exe
  C:\Windows\System\McNYTCx.exe
  2⤵
  PID:9928
- C:\Windows\System\LnkDLbg.exe
  C:\Windows\System\LnkDLbg.exe
  2⤵
  PID:9948
- C:\Windows\System\LcFxNfT.exe
  C:\Windows\System\LcFxNfT.exe
  2⤵
  PID:9964
- C:\Windows\System\dqoqTGh.exe
  C:\Windows\System\dqoqTGh.exe
  2⤵
  PID:9980
- C:\Windows\System\NoqRNFW.exe
  C:\Windows\System\NoqRNFW.exe
  2⤵
  PID:9996
- C:\Windows\System\GAOEYIG.exe
  C:\Windows\System\GAOEYIG.exe
  2⤵
  PID:10012
- C:\Windows\System\FRpmNFH.exe
  C:\Windows\System\FRpmNFH.exe
  2⤵
  PID:10028
- C:\Windows\System\UJwqhzv.exe
  C:\Windows\System\UJwqhzv.exe
  2⤵
  PID:10044
- C:\Windows\System\CWxWRMF.exe
  C:\Windows\System\CWxWRMF.exe
  2⤵
  PID:10092
- C:\Windows\System\mlCvmPB.exe
  C:\Windows\System\mlCvmPB.exe
  2⤵
  PID:10116
- C:\Windows\System\JJbfBxD.exe
  C:\Windows\System\JJbfBxD.exe
  2⤵
  PID:10140
- C:\Windows\System\nqARdFo.exe
  C:\Windows\System\nqARdFo.exe
  2⤵
  PID:10156
- C:\Windows\System\PNLWDGA.exe
  C:\Windows\System\PNLWDGA.exe
  2⤵
  PID:10180
- C:\Windows\System\QhLXlGM.exe
  C:\Windows\System\QhLXlGM.exe
  2⤵
  PID:10200
- C:\Windows\System\wJlWVXl.exe
  C:\Windows\System\wJlWVXl.exe
  2⤵
  PID:10216
- C:\Windows\System\yiMvorH.exe
  C:\Windows\System\yiMvorH.exe
  2⤵
  PID:10236
- C:\Windows\System\UvUbWDL.exe
  C:\Windows\System\UvUbWDL.exe
  2⤵
  PID:8768
- C:\Windows\System\fdVbHAC.exe
  C:\Windows\System\fdVbHAC.exe
  2⤵
  PID:1656
- C:\Windows\System\VMreLuf.exe
  C:\Windows\System\VMreLuf.exe
  2⤵
  PID:6416
- C:\Windows\System\PUoEbuY.exe
  C:\Windows\System\PUoEbuY.exe
  2⤵
  PID:6956
- C:\Windows\System\MnLUfFm.exe
  C:\Windows\System\MnLUfFm.exe
  2⤵
  PID:9020
- C:\Windows\System\SIKbohT.exe
  C:\Windows\System\SIKbohT.exe
  2⤵
  PID:9212
- C:\Windows\System\IcvnHFK.exe
  C:\Windows\System\IcvnHFK.exe
  2⤵
  PID:5404
- C:\Windows\System\IwxibWE.exe
  C:\Windows\System\IwxibWE.exe
  2⤵
  PID:5544
- C:\Windows\System\TUyggrD.exe
  C:\Windows\System\TUyggrD.exe
  2⤵
  PID:9320
- C:\Windows\System\xUzWGPr.exe
  C:\Windows\System\xUzWGPr.exe
  2⤵
  PID:6672
- C:\Windows\System\mwZrrEb.exe
  C:\Windows\System\mwZrrEb.exe
  2⤵
  PID:5940
- C:\Windows\System\MoEaYYM.exe
  C:\Windows\System\MoEaYYM.exe
  2⤵
  PID:6340
- C:\Windows\System\gEMxIOv.exe
  C:\Windows\System\gEMxIOv.exe
  2⤵
  PID:6692
- C:\Windows\System\DWJxKLZ.exe
  C:\Windows\System\DWJxKLZ.exe
  2⤵
  PID:9284
- C:\Windows\System\rHajqmK.exe
  C:\Windows\System\rHajqmK.exe
  2⤵
  PID:1756
- C:\Windows\System\puzzVIK.exe
  C:\Windows\System\puzzVIK.exe
  2⤵
  PID:3348
- C:\Windows\System\FSmgGtn.exe
  C:\Windows\System\FSmgGtn.exe
  2⤵
  PID:2952
- C:\Windows\System\SfoRFgD.exe
  C:\Windows\System\SfoRFgD.exe
  2⤵
  PID:9496
- C:\Windows\System\qvjIWSv.exe
  C:\Windows\System\qvjIWSv.exe
  2⤵
  PID:9248
- C:\Windows\System\SXoQqFP.exe
  C:\Windows\System\SXoQqFP.exe
  2⤵
  PID:9896
- C:\Windows\System\wdxKfPH.exe
  C:\Windows\System\wdxKfPH.exe
  2⤵
  PID:3316
- C:\Windows\System\QvjAQbg.exe
  C:\Windows\System\QvjAQbg.exe
  2⤵
  PID:9992
- C:\Windows\System\WXPDcPQ.exe
  C:\Windows\System\WXPDcPQ.exe
  2⤵
  PID:10040
- C:\Windows\System\YRRJTCj.exe
  C:\Windows\System\YRRJTCj.exe
  2⤵
  PID:1604
- C:\Windows\System\wfvyOQQ.exe
  C:\Windows\System\wfvyOQQ.exe
  2⤵
  PID:9392
- C:\Windows\System\fcmdjLh.exe
  C:\Windows\System\fcmdjLh.exe
  2⤵
  PID:9428
- C:\Windows\System\AKmkWxY.exe
  C:\Windows\System\AKmkWxY.exe
  2⤵
  PID:10128
- C:\Windows\System\ATQBAGl.exe
  C:\Windows\System\ATQBAGl.exe
  2⤵
  PID:10252
- C:\Windows\System\dPsRYSw.exe
  C:\Windows\System\dPsRYSw.exe
  2⤵
  PID:10272
- C:\Windows\System\ZaGWXhE.exe
  C:\Windows\System\ZaGWXhE.exe
  2⤵
  PID:10300
- C:\Windows\System\hEiuJSy.exe
  C:\Windows\System\hEiuJSy.exe
  2⤵
  PID:10316
- C:\Windows\System\mFKpRUr.exe
  C:\Windows\System\mFKpRUr.exe
  2⤵
  PID:10332
- C:\Windows\System\oXwODxE.exe
  C:\Windows\System\oXwODxE.exe
  2⤵
  PID:10356
- C:\Windows\System\JzZKGUh.exe
  C:\Windows\System\JzZKGUh.exe
  2⤵
  PID:10376
- C:\Windows\System\oycAfCC.exe
  C:\Windows\System\oycAfCC.exe
  2⤵
  PID:10396
- C:\Windows\System\HdXJifp.exe
  C:\Windows\System\HdXJifp.exe
  2⤵
  PID:10420
- C:\Windows\System\GzELQMt.exe
  C:\Windows\System\GzELQMt.exe
  2⤵
  PID:10436
- C:\Windows\System\DVValPc.exe
  C:\Windows\System\DVValPc.exe
  2⤵
  PID:10460
- C:\Windows\System\FuuPUTY.exe
  C:\Windows\System\FuuPUTY.exe
  2⤵
  PID:10484
- C:\Windows\System\pLRgHBg.exe
  C:\Windows\System\pLRgHBg.exe
  2⤵
  PID:10504
- C:\Windows\System\LOHmDme.exe
  C:\Windows\System\LOHmDme.exe
  2⤵
  PID:10524
- C:\Windows\System\zBvEhCI.exe
  C:\Windows\System\zBvEhCI.exe
  2⤵
  PID:10540
- C:\Windows\System\maLGKjM.exe
  C:\Windows\System\maLGKjM.exe
  2⤵
  PID:10564
- C:\Windows\System\UoUqBpl.exe
  C:\Windows\System\UoUqBpl.exe
  2⤵
  PID:10580
- C:\Windows\System\brfTRUR.exe
  C:\Windows\System\brfTRUR.exe
  2⤵
  PID:10600
- C:\Windows\System\XvBMikX.exe
  C:\Windows\System\XvBMikX.exe
  2⤵
  PID:10620
- C:\Windows\System\LWrFTyz.exe
  C:\Windows\System\LWrFTyz.exe
  2⤵
  PID:10648
- C:\Windows\System\sOJhjKY.exe
  C:\Windows\System\sOJhjKY.exe
  2⤵
  PID:10664
- C:\Windows\System\vTXgAqG.exe
  C:\Windows\System\vTXgAqG.exe
  2⤵
  PID:10688
- C:\Windows\System\HvXgZLo.exe
  C:\Windows\System\HvXgZLo.exe
  2⤵
  PID:10716
- C:\Windows\System\KUfDVmC.exe
  C:\Windows\System\KUfDVmC.exe
  2⤵
  PID:10740
- C:\Windows\System\dcLpTVZ.exe
  C:\Windows\System\dcLpTVZ.exe
  2⤵
  PID:10756
- C:\Windows\System\KEDtgRP.exe
  C:\Windows\System\KEDtgRP.exe
  2⤵
  PID:10772
- C:\Windows\System\YxbsKfb.exe
  C:\Windows\System\YxbsKfb.exe
  2⤵
  PID:10788
- C:\Windows\System\tentxwr.exe
  C:\Windows\System\tentxwr.exe
  2⤵
  PID:10808
- C:\Windows\System\yoJHKXS.exe
  C:\Windows\System\yoJHKXS.exe
  2⤵
  PID:10824
- C:\Windows\System\LJXFbEd.exe
  C:\Windows\System\LJXFbEd.exe
  2⤵
  PID:10840
- C:\Windows\System\sCTmAgG.exe
  C:\Windows\System\sCTmAgG.exe
  2⤵
  PID:10856
- C:\Windows\System\yHoRGPu.exe
  C:\Windows\System\yHoRGPu.exe
  2⤵
  PID:10872
- C:\Windows\System\bXpnodj.exe
  C:\Windows\System\bXpnodj.exe
  2⤵
  PID:10888
- C:\Windows\System\EqPGTgk.exe
  C:\Windows\System\EqPGTgk.exe
  2⤵
  PID:10940
- C:\Windows\System\vSfEbNT.exe
  C:\Windows\System\vSfEbNT.exe
  2⤵
  PID:10964
- C:\Windows\System\YUrjMtI.exe
  C:\Windows\System\YUrjMtI.exe
  2⤵
  PID:10984
- C:\Windows\System\VFDEBAQ.exe
  C:\Windows\System\VFDEBAQ.exe
  2⤵
  PID:11004
- C:\Windows\System\QDYOETD.exe
  C:\Windows\System\QDYOETD.exe
  2⤵
  PID:11208
- C:\Windows\System\TYGwNVo.exe
  C:\Windows\System\TYGwNVo.exe
  2⤵
  PID:10444
- C:\Windows\System\SgtMaoz.exe
  C:\Windows\System\SgtMaoz.exe
  2⤵
  PID:10496
- C:\Windows\System\XxXhfSp.exe
  C:\Windows\System\XxXhfSp.exe
  2⤵
  PID:10588
- C:\Windows\System\rgbtjUe.exe
  C:\Windows\System\rgbtjUe.exe
  2⤵
  PID:10628
- C:\Windows\System\YPVWrBO.exe
  C:\Windows\System\YPVWrBO.exe
  2⤵
  PID:336
- C:\Windows\System\WqhBtri.exe
  C:\Windows\System\WqhBtri.exe
  2⤵
  PID:4608
- C:\Windows\System\dzGUcMM.exe
  C:\Windows\System\dzGUcMM.exe
  2⤵
  PID:10112
- C:\Windows\System\ZAZZlTp.exe
  C:\Windows\System\ZAZZlTp.exe
  2⤵
  PID:10296
- C:\Windows\System\eXHkgeZ.exe
  C:\Windows\System\eXHkgeZ.exe
  2⤵
  PID:10532
- C:\Windows\System\vrniDyf.exe
  C:\Windows\System\vrniDyf.exe
  2⤵
  PID:8840
- C:\Windows\System\lVnETRy.exe
  C:\Windows\System\lVnETRy.exe
  2⤵
  PID:10704
- C:\Windows\System\uEGZVaZ.exe
  C:\Windows\System\uEGZVaZ.exe
  2⤵
  PID:8232
- C:\Windows\System\yLBDgSi.exe
  C:\Windows\System\yLBDgSi.exe
  2⤵
  PID:10848
- C:\Windows\System\XdxjoIG.exe
  C:\Windows\System\XdxjoIG.exe
  2⤵
  PID:10868
- C:\Windows\System\XjKlqlI.exe
  C:\Windows\System\XjKlqlI.exe
  2⤵
  PID:2516
- C:\Windows\System\zGnwTbn.exe
  C:\Windows\System\zGnwTbn.exe
  2⤵
  PID:9304
- C:\Windows\System\xnQUipt.exe
  C:\Windows\System\xnQUipt.exe
  2⤵
  PID:1192
- C:\Windows\System\MtTFOsV.exe
  C:\Windows\System\MtTFOsV.exe
  2⤵
  PID:7240
- C:\Windows\System\uYWXzNP.exe
  C:\Windows\System\uYWXzNP.exe
  2⤵
  PID:4336
- C:\Windows\System\qZxSHoE.exe
  C:\Windows\System\qZxSHoE.exe
  2⤵
  PID:3908
- C:\Windows\System\yCqfSdU.exe
  C:\Windows\System\yCqfSdU.exe
  2⤵
  PID:4040
- C:\Windows\System\BZzkvcV.exe
  C:\Windows\System\BZzkvcV.exe
  2⤵
  PID:9272
- C:\Windows\System\ZGcdstZ.exe
  C:\Windows\System\ZGcdstZ.exe
  2⤵
  PID:412
- C:\Windows\System\feZWFJR.exe
  C:\Windows\System\feZWFJR.exe
  2⤵
  PID:9796
- C:\Windows\System\hzpregm.exe
  C:\Windows\System\hzpregm.exe
  2⤵
  PID:9380
- C:\Windows\System\rEauFgr.exe
  C:\Windows\System\rEauFgr.exe
  2⤵
  PID:10244
- C:\Windows\System\TurxiUS.exe
  C:\Windows\System\TurxiUS.exe
  2⤵
  PID:10388
- C:\Windows\System\FZlckCa.exe
  C:\Windows\System\FZlckCa.exe
  2⤵
  PID:10348
- C:\Windows\System\ujBgvig.exe
  C:\Windows\System\ujBgvig.exe
  2⤵
  PID:10324
- C:\Windows\System\myjrZXh.exe
  C:\Windows\System\myjrZXh.exe
  2⤵
  PID:11260
- C:\Windows\System\ihICwnN.exe
  C:\Windows\System\ihICwnN.exe
  2⤵
  PID:11112
- C:\Windows\System\cVCzdkP.exe
  C:\Windows\System\cVCzdkP.exe
  2⤵
  PID:9632
- C:\Windows\System\sPPpXfV.exe
  C:\Windows\System\sPPpXfV.exe
  2⤵
  PID:11224
- C:\Windows\System\xMvVerd.exe
  C:\Windows\System\xMvVerd.exe
  2⤵
  PID:10660
- C:\Windows\System\HlpqLkm.exe
  C:\Windows\System\HlpqLkm.exe
  2⤵
  PID:10728
- C:\Windows\System\YnfnOzJ.exe
  C:\Windows\System\YnfnOzJ.exe
  2⤵
  PID:9728
- C:\Windows\System\tbmTsGS.exe
  C:\Windows\System\tbmTsGS.exe
  2⤵
  PID:10936
- C:\Windows\System\SFlyWAR.exe
  C:\Windows\System\SFlyWAR.exe
  2⤵
  PID:11284
- C:\Windows\System\gMLkQXO.exe
  C:\Windows\System\gMLkQXO.exe
  2⤵
  PID:11300
- C:\Windows\System\iyuHjHB.exe
  C:\Windows\System\iyuHjHB.exe
  2⤵
  PID:11328
- C:\Windows\System\AbztYBO.exe
  C:\Windows\System\AbztYBO.exe
  2⤵
  PID:11348
- C:\Windows\System\MdVpRCJ.exe
  C:\Windows\System\MdVpRCJ.exe
  2⤵
  PID:11376
- C:\Windows\System\jOEajhF.exe
  C:\Windows\System\jOEajhF.exe
  2⤵
  PID:11392
- C:\Windows\System\votBduF.exe
  C:\Windows\System\votBduF.exe
  2⤵
  PID:11424
- C:\Windows\System\oopnibt.exe
  C:\Windows\System\oopnibt.exe
  2⤵
  PID:11444
- C:\Windows\System\HWkxCIG.exe
  C:\Windows\System\HWkxCIG.exe
  2⤵
  PID:11460
- C:\Windows\System\zCFvmcP.exe
  C:\Windows\System\zCFvmcP.exe
  2⤵
  PID:11480
- C:\Windows\System\xppCRPQ.exe
  C:\Windows\System\xppCRPQ.exe
  2⤵
  PID:11500
- C:\Windows\System\AAwAdaQ.exe
  C:\Windows\System\AAwAdaQ.exe
  2⤵
  PID:11536
- C:\Windows\System\DVxyOML.exe
  C:\Windows\System\DVxyOML.exe
  2⤵
  PID:11556
- C:\Windows\System\qBHjWkF.exe
  C:\Windows\System\qBHjWkF.exe
  2⤵
  PID:11608
- C:\Windows\System\gTmwBes.exe
  C:\Windows\System\gTmwBes.exe
  2⤵
  PID:11624
- C:\Windows\System\pngBsIl.exe
  C:\Windows\System\pngBsIl.exe
  2⤵
  PID:11648
- C:\Windows\System\pRMYzym.exe
  C:\Windows\System\pRMYzym.exe
  2⤵
  PID:11668
- C:\Windows\System\CXtZkgj.exe
  C:\Windows\System\CXtZkgj.exe
  2⤵
  PID:11696
- C:\Windows\System\gsARZvc.exe
  C:\Windows\System\gsARZvc.exe
  2⤵
  PID:11720
- C:\Windows\System\LcpTleP.exe
  C:\Windows\System\LcpTleP.exe
  2⤵
  PID:11736
- C:\Windows\System\CNkkrAu.exe
  C:\Windows\System\CNkkrAu.exe
  2⤵
  PID:11752
- C:\Windows\System\VeZtJUu.exe
  C:\Windows\System\VeZtJUu.exe
  2⤵
  PID:11772
- C:\Windows\System\ahtuHnv.exe
  C:\Windows\System\ahtuHnv.exe
  2⤵
  PID:11796
- C:\Windows\System\qjWHtTU.exe
  C:\Windows\System\qjWHtTU.exe
  2⤵
  PID:11820
- C:\Windows\System\OxLQVmW.exe
  C:\Windows\System\OxLQVmW.exe
  2⤵
  PID:11840
- C:\Windows\System\eFdFOgH.exe
  C:\Windows\System\eFdFOgH.exe
  2⤵
  PID:11864
- C:\Windows\System\bQNeuZI.exe
  C:\Windows\System\bQNeuZI.exe
  2⤵
  PID:11884
- C:\Windows\System\YJEkmSW.exe
  C:\Windows\System\YJEkmSW.exe
  2⤵
  PID:11904
- C:\Windows\System\WIfLfdw.exe
  C:\Windows\System\WIfLfdw.exe
  2⤵
  PID:11924
- C:\Windows\System\jwMehnq.exe
  C:\Windows\System\jwMehnq.exe
  2⤵
  PID:11944
- C:\Windows\System\qjQZSgS.exe
  C:\Windows\System\qjQZSgS.exe
  2⤵
  PID:11964
- C:\Windows\System\OfXRWmT.exe
  C:\Windows\System\OfXRWmT.exe
  2⤵
  PID:11988
- C:\Windows\System\MLVyaWF.exe
  C:\Windows\System\MLVyaWF.exe
  2⤵
  PID:12004
- C:\Windows\System\jqCqpcB.exe
  C:\Windows\System\jqCqpcB.exe
  2⤵
  PID:12032
- C:\Windows\System\twTWHut.exe
  C:\Windows\System\twTWHut.exe
  2⤵
  PID:12052
- C:\Windows\System\NcSYkwf.exe
  C:\Windows\System\NcSYkwf.exe
  2⤵
  PID:12068
- C:\Windows\System\GmkntTh.exe
  C:\Windows\System\GmkntTh.exe
  2⤵
  PID:12084
- C:\Windows\System\qoAplTu.exe
  C:\Windows\System\qoAplTu.exe
  2⤵
  PID:12100
- C:\Windows\System\YuhkVXO.exe
  C:\Windows\System\YuhkVXO.exe
  2⤵
  PID:12116
- C:\Windows\System\MNRnOzA.exe
  C:\Windows\System\MNRnOzA.exe
  2⤵
  PID:12132
- C:\Windows\System\rUZCReR.exe
  C:\Windows\System\rUZCReR.exe
  2⤵
  PID:12148
- C:\Windows\System\UEtbTwF.exe
  C:\Windows\System\UEtbTwF.exe
  2⤵
  PID:12168
- C:\Windows\System\RbzoEcB.exe
  C:\Windows\System\RbzoEcB.exe
  2⤵
  PID:12188
- C:\Windows\System\kGeKZqe.exe
  C:\Windows\System\kGeKZqe.exe
  2⤵
  PID:12204
- C:\Windows\System\tLOeXhV.exe
  C:\Windows\System\tLOeXhV.exe
  2⤵
  PID:12228
- C:\Windows\System\YbdJbsP.exe
  C:\Windows\System\YbdJbsP.exe
  2⤵
  PID:12244
- C:\Windows\System\UmnwmIU.exe
  C:\Windows\System\UmnwmIU.exe
  2⤵
  PID:12264
- C:\Windows\System\iCByMll.exe
  C:\Windows\System\iCByMll.exe
  2⤵
  PID:11200
- C:\Windows\System\zGkFYou.exe
  C:\Windows\System\zGkFYou.exe
  2⤵
  PID:11220
- C:\Windows\System\RXOifNN.exe
  C:\Windows\System\RXOifNN.exe
  2⤵
  PID:4200
- C:\Windows\System\BFaLRpM.exe
  C:\Windows\System\BFaLRpM.exe
  2⤵
  PID:10548
- C:\Windows\System\txucMGO.exe
  C:\Windows\System\txucMGO.exe
  2⤵
  PID:10068
- C:\Windows\System\TmTeRSU.exe
  C:\Windows\System\TmTeRSU.exe
  2⤵
  PID:2108
- C:\Windows\System\qyXnvRn.exe
  C:\Windows\System\qyXnvRn.exe
  2⤵
  PID:6728
- C:\Windows\System\ddvZneH.exe
  C:\Windows\System\ddvZneH.exe
  2⤵
  PID:10008
- C:\Windows\System\OAwLbAy.exe
  C:\Windows\System\OAwLbAy.exe
  2⤵
  PID:10328
- C:\Windows\System\DuWPXlz.exe
  C:\Windows\System\DuWPXlz.exe
  2⤵
  PID:11172
- C:\Windows\System\FRmEIbd.exe
  C:\Windows\System\FRmEIbd.exe
  2⤵
  PID:11320
- C:\Windows\System\OsoCjNr.exe
  C:\Windows\System\OsoCjNr.exe
  2⤵
  PID:5840
- C:\Windows\System\jFSXvPI.exe
  C:\Windows\System\jFSXvPI.exe
  2⤵
  PID:12292
- C:\Windows\System\AmzbzCh.exe
  C:\Windows\System\AmzbzCh.exe
  2⤵
  PID:12308
- C:\Windows\System\PjwvzEb.exe
  C:\Windows\System\PjwvzEb.exe
  2⤵
  PID:12332
- C:\Windows\System\YlreOLd.exe
  C:\Windows\System\YlreOLd.exe
  2⤵
  PID:12348
- C:\Windows\System\ewKBoam.exe
  C:\Windows\System\ewKBoam.exe
  2⤵
  PID:12368
- C:\Windows\System\SzRougV.exe
  C:\Windows\System\SzRougV.exe
  2⤵
  PID:12388
- C:\Windows\System\miVWuuC.exe
  C:\Windows\System\miVWuuC.exe
  2⤵
  PID:12408
- C:\Windows\System\TmwFffh.exe
  C:\Windows\System\TmwFffh.exe
  2⤵
  PID:12436
- C:\Windows\System\fDAJSIo.exe
  C:\Windows\System\fDAJSIo.exe
  2⤵
  PID:12452
- C:\Windows\System\ocGOhAL.exe
  C:\Windows\System\ocGOhAL.exe
  2⤵
  PID:12476
- C:\Windows\System\DSuhtwv.exe
  C:\Windows\System\DSuhtwv.exe
  2⤵
  PID:12500
- C:\Windows\System\HclCNlY.exe
  C:\Windows\System\HclCNlY.exe
  2⤵
  PID:12528
- C:\Windows\System\vOhnyWg.exe
  C:\Windows\System\vOhnyWg.exe
  2⤵
  PID:12544
- C:\Windows\System\TZLMIvS.exe
  C:\Windows\System\TZLMIvS.exe
  2⤵
  PID:12564
- C:\Windows\System\lHjqdIU.exe
  C:\Windows\System\lHjqdIU.exe
  2⤵
  PID:12584
- C:\Windows\System\eQTVquB.exe
  C:\Windows\System\eQTVquB.exe
  2⤵
  PID:12600
- C:\Windows\System\ZEPYYNr.exe
  C:\Windows\System\ZEPYYNr.exe
  2⤵
  PID:12620
- C:\Windows\System\XVLWHse.exe
  C:\Windows\System\XVLWHse.exe
  2⤵
  PID:12640
- C:\Windows\System\EDBkfcM.exe
  C:\Windows\System\EDBkfcM.exe
  2⤵
  PID:12660
- C:\Windows\System\vPDCpXo.exe
  C:\Windows\System\vPDCpXo.exe
  2⤵
  PID:12680
- C:\Windows\System\oYZPjvN.exe
  C:\Windows\System\oYZPjvN.exe
  2⤵
  PID:12700
- C:\Windows\System\efOqzRs.exe
  C:\Windows\System\efOqzRs.exe
  2⤵
  PID:12720
- C:\Windows\System\RuNJboi.exe
  C:\Windows\System\RuNJboi.exe
  2⤵
  PID:12736
- C:\Windows\System\LblPnoD.exe
  C:\Windows\System\LblPnoD.exe
  2⤵
  PID:12756
- C:\Windows\System\NmQfDrJ.exe
  C:\Windows\System\NmQfDrJ.exe
  2⤵
  PID:11760
- C:\Windows\System\LLzKMdc.exe
  C:\Windows\System\LLzKMdc.exe
  2⤵
  PID:12656
- C:\Windows\System\aQbdrwX.exe
  C:\Windows\System\aQbdrwX.exe
  2⤵
  PID:12784
- C:\Windows\System\IfGVENJ.exe
  C:\Windows\System\IfGVENJ.exe
  2⤵
  PID:11976
- C:\Windows\System\hKcbCKD.exe
  C:\Windows\System\hKcbCKD.exe
  2⤵
  PID:13200
- C:\Windows\System\xgHkMrc.exe
  C:\Windows\System\xgHkMrc.exe
  2⤵
  PID:12128
- C:\Windows\System\iNAbWrE.exe
  C:\Windows\System\iNAbWrE.exe
  2⤵
  PID:12180
- C:\Windows\System\ozgUkpU.exe
  C:\Windows\System\ozgUkpU.exe
  2⤵
  PID:12980
- C:\Windows\System\PoEdDtM.exe
  C:\Windows\System\PoEdDtM.exe
  2⤵
  PID:10268
- C:\Windows\System\FcXGYNy.exe
  C:\Windows\System\FcXGYNy.exe
  2⤵
  PID:11080
- C:\Windows\System\nFBWmKC.exe
  C:\Windows\System\nFBWmKC.exe
  2⤵
  PID:13248
- C:\Windows\System\JamtNaE.exe
  C:\Windows\System\JamtNaE.exe
  2⤵
  PID:12340
- C:\Windows\System\tbrNWcD.exe
  C:\Windows\System\tbrNWcD.exe
  2⤵
  PID:12400
- C:\Windows\System\ozHtlvA.exe
  C:\Windows\System\ozHtlvA.exe
  2⤵
  PID:13088
- C:\Windows\System\cttdfVt.exe
  C:\Windows\System\cttdfVt.exe
  2⤵
  PID:13120
- C:\Windows\System\ytooBhu.exe
  C:\Windows\System\ytooBhu.exe
  2⤵
  PID:13140
- C:\Windows\System\ctfbNMN.exe
  C:\Windows\System\ctfbNMN.exe
  2⤵
  PID:12692
- C:\Windows\System\tVARDwn.exe
  C:\Windows\System\tVARDwn.exe
  2⤵
  PID:12804
- C:\Windows\System\gJZaEJA.exe
  C:\Windows\System\gJZaEJA.exe
  2⤵
  PID:12860
- C:\Windows\System\AwFpmtT.exe
  C:\Windows\System\AwFpmtT.exe
  2⤵
  PID:12924
- C:\Windows\System\BgezpbX.exe
  C:\Windows\System\BgezpbX.exe
  2⤵
  PID:13004
- C:\Windows\System\rypuHIf.exe
  C:\Windows\System\rypuHIf.exe
  2⤵
  PID:13228
- C:\Windows\System\tZuBmZN.exe
  C:\Windows\System\tZuBmZN.exe
  2⤵
  PID:10996
- C:\Windows\System\VSsUgAH.exe
  C:\Windows\System\VSsUgAH.exe
  2⤵
  PID:10764
- C:\Windows\System\ZnbLHTz.exe
  C:\Windows\System\ZnbLHTz.exe
  2⤵
  PID:10752
- C:\Windows\System\nPxSxtf.exe
  C:\Windows\System\nPxSxtf.exe
  2⤵
  PID:10084
- C:\Windows\System\ZKEkCYG.exe
  C:\Windows\System\ZKEkCYG.exe
  2⤵
  PID:4184
- C:\Windows\System\hvhnBuH.exe
  C:\Windows\System\hvhnBuH.exe
  2⤵
  PID:7340
- C:\Windows\System\LJPqHRF.exe
  C:\Windows\System\LJPqHRF.exe
  2⤵
  PID:12344
- C:\Windows\System\lXrAHID.exe
  C:\Windows\System\lXrAHID.exe
  2⤵
  PID:10768
- C:\Windows\System\lgBmSKF.exe
  C:\Windows\System\lgBmSKF.exe
  2⤵
  PID:13304
- C:\Windows\System\hjNhrZW.exe
  C:\Windows\System\hjNhrZW.exe
  2⤵
  PID:12712
- C:\Windows\System\lZOVzhy.exe
  C:\Windows\System\lZOVzhy.exe
  2⤵
  PID:10228
- C:\Windows\System\yEOGPdJ.exe
  C:\Windows\System\yEOGPdJ.exe
  2⤵
  PID:9376
- C:\Windows\System\DrLAHFh.exe
  C:\Windows\System\DrLAHFh.exe
  2⤵
  PID:10924
- C:\Windows\System\WXMrQKk.exe
  C:\Windows\System\WXMrQKk.exe
  2⤵
  PID:12960
- C:\Windows\System\GIwoJAy.exe
  C:\Windows\System\GIwoJAy.exe
  2⤵
  PID:12996
- C:\Windows\System\DuSxvTP.exe
  C:\Windows\System\DuSxvTP.exe
  2⤵
  PID:11792
- C:\Windows\System\iMibPLb.exe
  C:\Windows\System\iMibPLb.exe
  2⤵
  PID:9880
- C:\Windows\System\oLSQFsc.exe
  C:\Windows\System\oLSQFsc.exe
  2⤵
  PID:12748
- C:\Windows\System\vnMQKhf.exe
  C:\Windows\System\vnMQKhf.exe
  2⤵
  PID:3540
- C:\Windows\System\aFXRJOw.exe
  C:\Windows\System\aFXRJOw.exe
  2⤵
  PID:12272
- C:\Windows\System\TaKFOEk.exe
  C:\Windows\System\TaKFOEk.exe
  2⤵
  PID:12492
- C:\Windows\System\OTUfAgO.exe
  C:\Windows\System\OTUfAgO.exe
  2⤵
  PID:5012
- C:\Windows\System\prJqraj.exe
  C:\Windows\System\prJqraj.exe
  2⤵
  PID:11764
- C:\Windows\System\KHrqonZ.exe
  C:\Windows\System\KHrqonZ.exe
  2⤵
  PID:12984
- C:\Windows\System\sBcRvsK.exe
  C:\Windows\System\sBcRvsK.exe
  2⤵
  PID:11936
- C:\Windows\System\dFrFzXL.exe
  C:\Windows\System\dFrFzXL.exe
  2⤵
  PID:4340
- C:\Windows\System\lEwaSbw.exe
  C:\Windows\System\lEwaSbw.exe
  2⤵
  PID:12580
- C:\Windows\System\tLYUhaP.exe
  C:\Windows\System\tLYUhaP.exe
  2⤵
  PID:12608
- C:\Windows\System\DocFZzF.exe
  C:\Windows\System\DocFZzF.exe
  2⤵
  PID:11900
- C:\Windows\System\YYpWOWd.exe
  C:\Windows\System\YYpWOWd.exe
  2⤵
  PID:12672
- C:\Windows\System\IwSeAkt.exe
  C:\Windows\System\IwSeAkt.exe
  2⤵
  PID:13204
- C:\Windows\System\AjsbeIg.exe
  C:\Windows\System\AjsbeIg.exe
  2⤵
  PID:10880
- C:\Windows\System\FvDlqze.exe
  C:\Windows\System\FvDlqze.exe
  2⤵
  PID:11804
- C:\Windows\System\saJfqIf.exe
  C:\Windows\System\saJfqIf.exe
  2⤵
  PID:12236
- C:\Windows\System\VXKsenD.exe
  C:\Windows\System\VXKsenD.exe
  2⤵
  PID:9492
- C:\Windows\System\OUWzXtm.exe
  C:\Windows\System\OUWzXtm.exe
  2⤵
  PID:11996
- C:\Windows\System\sWCnHaF.exe
  C:\Windows\System\sWCnHaF.exe
  2⤵
  PID:13036
- C:\Windows\System\VIVjJQi.exe
  C:\Windows\System\VIVjJQi.exe
  2⤵
  PID:13112
- C:\Windows\System\aTFhXvU.exe
  C:\Windows\System\aTFhXvU.exe
  2⤵
  PID:1844
- C:\Windows\System\tlPbWHR.exe
  C:\Windows\System\tlPbWHR.exe
  2⤵
  PID:2580
- C:\Windows\System\mJykofz.exe
  C:\Windows\System\mJykofz.exe
  2⤵
  PID:7256
- C:\Windows\System\OOhetnj.exe
  C:\Windows\System\OOhetnj.exe
  2⤵
  PID:7184
- C:\Windows\System\YPCfoqS.exe
  C:\Windows\System\YPCfoqS.exe
  2⤵
  PID:7244
- C:\Windows\System\sgSkHjG.exe
  C:\Windows\System\sgSkHjG.exe
  2⤵
  PID:1344
- C:\Windows\System\kthGJjr.exe
  C:\Windows\System\kthGJjr.exe
  2⤵
  PID:8528
- C:\Windows\System\BgWuwSZ.exe
  C:\Windows\System\BgWuwSZ.exe
  2⤵
  PID:11656
- C:\Windows\System\cvhaYCv.exe
  C:\Windows\System\cvhaYCv.exe
  2⤵
  PID:10632
- C:\Windows\System\dVoHfzk.exe
  C:\Windows\System\dVoHfzk.exe
  2⤵
  PID:11744
- C:\Windows\System\lbrzibk.exe
  C:\Windows\System\lbrzibk.exe
  2⤵
  PID:5036
- C:\Windows\System\AiKoSDV.exe
  C:\Windows\System\AiKoSDV.exe
  2⤵
  PID:13240
- C:\Windows\System\yItLJHq.exe
  C:\Windows\System\yItLJHq.exe
  2⤵
  PID:11240
- C:\Windows\System\YrwZdkr.exe
  C:\Windows\System\YrwZdkr.exe
  2⤵
  PID:9668
- C:\Windows\System\lFtWZsX.exe
  C:\Windows\System\lFtWZsX.exe
  2⤵
  PID:6296
- C:\Windows\System\cNTQpst.exe
  C:\Windows\System\cNTQpst.exe
  2⤵
  PID:12792
- C:\Windows\System\iafAEuw.exe
  C:\Windows\System\iafAEuw.exe
  2⤵
  PID:12280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3gorusb5.4v1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ATBmGgL.exe

Filesize
1.3MB

MD5
d481abf80810a8a437fe786799abff76

SHA1
aecc24ef7c0ba03c5058fe3d6e5c6a70c9375dc1

SHA256
459039d848e11b2ad2f6e0ac7981d9dd8c908d1b02c8d28825f70ba47f888061

SHA512
e163596d8cf6e23637825f0260dac33dc40fa626b6a91003835bbabae153518023115c0b0ebf50c13fb3484c6ca28b8c3afa4d5cf9e8f9b836f463e5001a3d91

Download Submit
C:\Windows\System\BCOoHzN.exe

Filesize
1.2MB

MD5
709298ed5fdef1781af0434580068fba

SHA1
9175f824a27c0e2200e17c6e3e5caa23fd4a6aab

SHA256
68f7acae12676befc1defd80661bfdd5a48c490ed225d3fcdfc6712c0e98aea2

SHA512
0e35b5b5eb44915cf33707eea11b34ad6d95d2434926c0802d255892fb36f4cedd98074bb8936937bd259831edb33838dbbea1607f7ab597175355c16f0d598d

Download Submit
C:\Windows\System\CMzVFPQ.exe

Filesize
1.2MB

MD5
ba7645a7aa5b57dabdfefe93221aab86

SHA1
8fce4c5f3bb40d4237a145c92cd49ed9f0649a15

SHA256
642ca61f1c2e46f381916df53dff1d8fb66d948e5c76d143eb5fbef2b9386ec2

SHA512
486df7cc72a0695eed4bac4033a1ce78576312ecd27bad8f926ce02d833e79f6bc4ef09b8704f6e20a24bafa77095f4602e5e055f8da9c4f98cf9951e23fdf10

Download Submit
C:\Windows\System\DpmlmQs.exe

Filesize
1.3MB

MD5
0827167b7d56d2c544034f7055637683

SHA1
7e34df3c959383eea7e03cfa6051bd56d3066059

SHA256
a07f1830e9aa1c0c5d036fcc6701ccd29c491c75fd8d252684bf0744798d8d2b

SHA512
210c7d4c49509ef8b219b1db5e34b63fdb1c2fa2b80456b55e88092397c8f2f2315e432630d7bcd7953263ea9f5180242c4a7890bcea3f9b1f8f798a13f87752

Download Submit
C:\Windows\System\GuDnrYy.exe

Filesize
1.3MB

MD5
d7b66afcb266d4ba2a7a807fce142ecb

SHA1
30db40b549343b2ef9c0fbd9a3be2245ad1bb3ea

SHA256
0a654bad1c52a1a866a973d92d084fc0585ffc0d9183b81c61db50e9af5d4ed5

SHA512
d35c438a0167eee1f5b950b4a68076475e0914fd93c729b2e1390e3b5d8f4ce28d7519e141adef57b0baa6bdb99c9acd225256db4fda2c1b4ec764d4d78bfbda

Download Submit
C:\Windows\System\HNrmPQh.exe

Filesize
1.2MB

MD5
6b471b2179b023b56b1ac37e631b6a2b

SHA1
709096cc835d7b6b4335cf5658bd2a1bdbd1b90e

SHA256
a5ec726ef6ec9eaeaaf645aa7b6c34d9579bccd78f749f67093fbd72bbb75b8d

SHA512
f7266c9ad97f2940768c1ac01cb3416f9366861274e63da9269493b7766d2bf496713ee323e97409f66928902345c8dce3c2fac41a233daaed958243ad846293

Download Submit
C:\Windows\System\JTkAPbb.exe

Filesize
1.2MB

MD5
310c74db60058d868666b82c70696a7a

SHA1
27b24aaf76220b97a6c10fccc729b8e342657976

SHA256
93f1beda6aa689a8d026f29e4b2cb641d19076d7d592aa38e705ae7e2acdd48e

SHA512
9b5e0402d2c22bcb31266e6fd95570199ccf1a15a20c7005c52e1c115547340b7fd7fe07f6d1bbcf4c84ed7f8e6908fd05d86831c8f1dc17d2d3c21ca40c13b0

Download Submit
C:\Windows\System\JXRRfxM.exe

Filesize
1.3MB

MD5
c21cf32f6b6de3c2918aac67220fefdf

SHA1
8ed0ca4e8d15fb69306a160342cfc6322832aaaa

SHA256
2bcf095686f51d3da6444216e4407eaf8fc832099d4b53bbe990b070b1efc5a3

SHA512
c2c68e0a88b0174c047097fbfe33a049ba398c2b31adf7e0fac091e18f2d81c789c70544baf5ab4ca15a4bc947ab64add9bd2de8b8215c22268abadaa9e017e9

Download Submit
C:\Windows\System\JhgwdfM.exe

Filesize
1.3MB

MD5
8c61fff8f811cbec695969d4d735e59d

SHA1
74ff710dcdf6bba63f8b4b889f804dad7819a250

SHA256
01d57a34cd947d83438cd9bed4b98eb4d94d3cfc3cc4fd42bd22898ecf86cd16

SHA512
4dbcd57b45eb849520642bc2b5758a4708b9630a5bb2cd8f8765dacf2678bb5a561e45c7c7119b14f2a7b3b684c58015f4312f17ac569dbfcd7455b2caca33da

Download Submit
C:\Windows\System\KYEDigp.exe

Filesize
8B

MD5
0a09bd2e5542320a20ec8eafd2246c28

SHA1
7106c9c7587e96586e92363c5ef70ad925a395b7

SHA256
a2d90ea83d8a1ec8d2d933492892f6a19aa1f0a0628b1cc62b162e5271ee863b

SHA512
994b306b70fd71b0a462a50b9fc03457eac19be8a156ca56f4b5a47c058947eb0f9ce4c706b5ff16df4ad9b5c6da35585e95b3f5ce9ff8ead75dc92e4757e9c1

Download Submit
C:\Windows\System\NptlsLw.exe

Filesize
1.2MB

MD5
7b5beba870324ecb30e5de7c643603ab

SHA1
5f3ee3fb90550f54c3a3419fa964d51a49e44594

SHA256
bb779110765d6aa7aa88f8592e5e5ae82140f144e119a112a69d079d834da870

SHA512
f454a93782d88499b91cdbbc8a882351c589f5311b8a5d4a4289f616a1b214e98c7efb116fef1ef5fcb0a6b9d92973ae0ebb0e0dbd47ac9756a742614132a431

Download Submit
C:\Windows\System\PEiCEMP.exe

Filesize
1.3MB

MD5
f21c7e87654c96b9f04168e0460aae84

SHA1
c73bdaa205994718a4348b77676bbe3b900730f9

SHA256
facc3cc897e37ea40e0b056eaafcf2425434c7e98c3d2288e3d6f55229c6f2b1

SHA512
2079288eab5ace112a4ab8441cc1b94674018bf569c889e61a10d2d67be42dfd6df968baca9b322e8b07d1ad8f548984f4279f876972abd213fdc7d6a498d177

Download Submit
C:\Windows\System\PcJsVzn.exe

Filesize
1.3MB

MD5
43d8639c8bac0a3f5428e8261e46e360

SHA1
0641f89b4bf0181913bd01ed8d64c4a6b107d8a4

SHA256
696d041a8704a993417895c15bb2e59726df6585e87994a645fd9bc2f9dd29a3

SHA512
7869098ee2032da053ced7aeb18748191e3fa54b7b83a032ce7867b2a85e8d463217f5804cdc848ffef5f50bacf34fe237175a9f296d6ab45b52f76c026d5795

Download Submit
C:\Windows\System\Qleohah.exe

Filesize
1.3MB

MD5
928794acc12abb031e65803269fecd86

SHA1
e1ea5c81ac4339cfe87efe38c17447ddd3305fcc

SHA256
91e4484177c92d4f04c20e246f8e91676f7d3ca547c9d42ff1c3173b3b2b5956

SHA512
b73263e71a80457854c618d4763f5b267c028307e4e725f243a1ad0d1e8bba82e6264d36e91ef2a1302023973940d1b548262dfd1047f8c2cf4b6d6bfe21e599

Download Submit
C:\Windows\System\RERCkPh.exe

Filesize
1.3MB

MD5
1f01de8ab7393fc3cdde9fe985374126

SHA1
21fb706704f2244c81e62997c6eb514de0e3c48e

SHA256
aeea60563a3d2f17ad4462be04033c537dc65c9d5ce156c796bb8564e1d4ced7

SHA512
fdd03d22d046f288dba420e4065967af95b050e38dfd03329f950bdf13c023690a8f698a279eafecfeafbbd849a823c92a460249364f4bd313333c46808d6acf

Download Submit
C:\Windows\System\RzayQHi.exe

Filesize
1.2MB

MD5
0ac7b6a9df86cae0b32b615ff9c1b074

SHA1
a694f0a54e004b1318b58959b11fb55e5589fb77

SHA256
0ee54eca8657cccd4d7c7e37c94c4e352b46786b42f313a430c66eb1764cc5d0

SHA512
cd1e7b471a8e4213f2ba0f757663d23c35aeb6d64f7df293227cf5d71e3ff0b0c49b0e02762e01067333c506da031e58f3898cb95edf2e6b55b3e22db51b3145

Download Submit
C:\Windows\System\TAbuCTm.exe

Filesize
1.3MB

MD5
3ce7362f9446f5ae5daa3f9f0ef6acde

SHA1
33c2431fb5a47ee43c7d0d2edcafb2fd88be260d

SHA256
535142c6cd2771e818253d5cb477b29945688d8a1055df0a7c09b96aa02d0e7f

SHA512
cbeb5dada44a0dc2fc6cd9d7931e2277f6454cbd4f87c2308bb44e3a93cce4d2d2fc13763973df889a051e95b4b177b57124aec47bb66b6e0f0ef3cd58ae126c

Download Submit
C:\Windows\System\TSvHAFO.exe

Filesize
1.2MB

MD5
a4a6952c681022731ce70e76a37c09a9

SHA1
16f9bef5d0febef06874a2d448c33191d4d46011

SHA256
4c464356e894a0a7b75ef7cef6ff681d6c03eb19a68845cd627ac49fc4b685c8

SHA512
7c8de8030f103d8d7aa7842d70d73863e6ce1b2662c2fd83791ee97db683d5d1923c2c5a1106b6357db4f1ca4c26bc3621303ba508b935ea5c76b9096a01eaed

Download Submit
C:\Windows\System\VCximlx.exe

Filesize
1.3MB

MD5
285ec58e86d57b182bf1a7fe80ccb9c6

SHA1
b3df50f40d97ebfa59721c407d4883d252d17b8a

SHA256
1f28e9b6fc4e66cd0db9ab4025dcab385eb5de21487289c033ead017d409b2c8

SHA512
3def0d533f5499665c5866fa72cce632991c6facdc0ff6a1a3a813779d0fa96ccb7a9916401d81bd9d2240839d2ff83065488ae1aa66703f85a7d6641e28e8c9

Download Submit
C:\Windows\System\VGXJdeN.exe

Filesize
1.2MB

MD5
41ada6cc44f1b943e74feacf777c1532

SHA1
842e770e51c28e977ac11a78a141141127c40530

SHA256
531acc303ba01e7a5f99150476ba87ce7f6d371048dae03775cca59e0843adf7

SHA512
0ea1292f5989de98d53e71a74ecce0b2aa3e5357d5393c268380376fa6ffb82e51a9cc7c8d122268f987830b7ed119ac3d3a63008e30f0bc82c9fe16fcf9065a

Download Submit
C:\Windows\System\VUlqbnL.exe

Filesize
1.3MB

MD5
281031f17d5d14e9a66b1281aca268c7

SHA1
f677d227088df1a888516e765c1e2af92a322582

SHA256
b441059ef5cb808c93cb51c970b59ba80cdcdaa3b2ebfde7394b2081bcbb6950

SHA512
cac217edc1d1bf58a316088705780a67e0a328ef39ba4d54f626f902499800bd289e229a63e86bafea93bc0845015ce883148af9bcdfd79368af998a91df1ba1

Download Submit
C:\Windows\System\bqSJPHR.exe

Filesize
1.3MB

MD5
0ea35cef6c42b1b407761a1a548d6454

SHA1
60f130a1fde3b277fdb4ccce10e39fd585ddf87c

SHA256
46bd42be4268c14dc6c08b3b4b3bfd37169f120e0e3946517dde97806947276b

SHA512
d05e1fa5740bbe690e88a8a10e9c9b166900c9c51fa2e6154d67123d562aaa5df27e605d419183196a7a42862e07488d4464d33d5e7a638ae7f7bd3cf44df898

Download Submit
C:\Windows\System\cYPgzWA.exe

Filesize
1.3MB

MD5
2e81ec5eee5331db4311d5b57d7c1b59

SHA1
ca7d5d49cf9e92604c117c50dd2174295f9d162e

SHA256
3c523b3189c7e973d61b05750898d676e7bf77b5fcd8c659d364d80ad9772558

SHA512
7efe9eb593622df580cffc75f9ec873723d073dde16a1606741cdc44a726956cabb0acd9f335ac8f38ced01b21783fad846508d53611eac594dcc7bf4d9dbbb3

Download Submit
C:\Windows\System\eFeNmYN.exe

Filesize
1.3MB

MD5
5b9ddeb01e693a7b71de3bb1436c829d

SHA1
a9ee843c5dbb999386db514dabc8ff86a1950f37

SHA256
911a9a583dc0b9a3bd453ecb6393c4c119f70079e604c505ecb011a11c94a2c0

SHA512
e127f204daf93dde563cb47a89fcbb02332e8db639362878d0c9344d07117b80cf438b64cb48e36bdae46f1adcbc901ad06170c8c104e71a7f943a482df12c79

Download Submit
C:\Windows\System\emAcQtB.exe

Filesize
1.3MB

MD5
3b78a339fd685b0ce9f66e8701bc6ff4

SHA1
4a4d559abb0239a5e8276e474112eb7e2fe96eeb

SHA256
2f9e0cc9aca069db5154011c64060ad60a4a4fbd5d1d478c8f9a0b310827a573

SHA512
d9fc444ddb1fd991e0fd90f26c8a7287a08d572f1f0e469da2fd279f76ff0ec919fa95b67a2bdd61f5f923ccad51c4ff054b0fc015020a29136c8ef2420e4d45

Download Submit
C:\Windows\System\gUXjXut.exe

Filesize
1.2MB

MD5
fee0b9ce64f842b74295d8373332e3f4

SHA1
3208bf37036ece7dca5a6b085ca2c9fd41ea47a3

SHA256
ba854c2ec5fe0c6daa6de395d3297c23097ea26323bcdd6f63e69eef6d13231d

SHA512
879f551f4ce6307385edbd1bc8b7948eb22a959d33ab18870ba825f42733f13b7135efcf4b683106340e552f78cb451135971c569412a80d2390f85e382427d5

Download Submit
C:\Windows\System\hiwFLGh.exe

Filesize
1.3MB

MD5
1c85dae80cc2dea05afb6c81eabed82e

SHA1
2a5c9f90fba1630a43c63b3147c82ab49313f6e5

SHA256
43208e20e1716e5de2e7fc2a940a54f6a7e520bcfb632ad63fb56cf5fa110183

SHA512
caf33765ce1700feb096d81ef651500c388ca45497297adc1964afbd633c9a07e46ba0b6920c4893186e86a1a68b65155ebb9ba648c8c356bc254a59c6cd0ac5

Download Submit
C:\Windows\System\itwwUKp.exe

Filesize
1.3MB

MD5
060d44299ecf22a1dbabe840076ac3ae

SHA1
3c8f4966f55bb382766cee7bc14611f6dbf91460

SHA256
9adddfe9e7f4adf0dbfed771edc255dd6fc02d4df1c31304d12ed60bbba19ecf

SHA512
7c7561998ff07e20ce6e019d032862edf8beb8c76cf2f5759323f1d11ef2722cd128034dbd174b471e243b421d3bea92390858fe971e23837afdfe3eb525b978

Download Submit
C:\Windows\System\krhMVue.exe

Filesize
1.3MB

MD5
c74f638082f25e35d722792971a3b344

SHA1
2da94e52f3d7b292b171aae4e4a6b8739e20a43e

SHA256
55cb68b6916b303bc09ec8d0550523890a78cd155aa12d87c08447e68109fc91

SHA512
d958fc2143cf29e330e3070af15fb585933163e4444fcf80c620f07d30f319e1c002729bcd51b1ea48d65ff1483d7cdd857ab7021cd5fa20728db299a00a34ae

Download Submit
C:\Windows\System\lMXgwza.exe

Filesize
1.2MB

MD5
c6742df5d85165c0c49dc833a208ea84

SHA1
b23be03fb468f01487285e70d63aea62a7ac5cdf

SHA256
045f79ea5cca6a6ea887d572c88f11bff568d821e03918ceb7d2aac18fd499ba

SHA512
8fcecc3551e4d4e3a0a6bea3469b0b70cf756454da6327bf487ed1ac2d5cdd60bb886a1d213aa7dab13e7f99f76a41171cfe86f0f42a61dae130b3b5b8c918b9

Download Submit
C:\Windows\System\mFBIFzt.exe

Filesize
1.2MB

MD5
dd34deac9e5ccbfdeb56b527566664cd

SHA1
2b84e28f5747ac1a164be74a9fd80a20a434335e

SHA256
29575b1b6e543629417059a4aae47b8156b1279daa42602f4b18848411e6acba

SHA512
26e11b884edb8a5149790a2329d72851bba119596057f985fc3ced650b815fbab38044b75749c8eeeaa08bd9e3d14dfc9d36770cf00f6db3467121dc0129eb40

Download Submit
C:\Windows\System\rafkWmb.exe

Filesize
1.2MB

MD5
e133e697571e85d6c12639862dae7a23

SHA1
f5133450044ec7b180e24f2c234e77b7c0b48529

SHA256
56ff3d3fbbe43aa69877d287783c8eecf2413f154d14a8722b85de6c2e80bd75

SHA512
b8139779273657cd7f7d62f8f79b753b18e98388ce483cb02022c0a627dfa6fb2ab5ba7626e49657b16134805a851ecb447144a319e83922a8ed9fe75ffcd07e

Download Submit
C:\Windows\System\ryhjifx.exe

Filesize
1.3MB

MD5
4fd790b6995e06368a67a1cbe9922336

SHA1
a8fd37122e485a88ffabe172f46072f42e5b1d1b

SHA256
c03ebee8d7621124b80a89a9dc585e26b62e615f11b9d6f5244a3362d1ad5385

SHA512
fd79caafec37a03c14a05c0ed0e9c50f2d02a02f6c3534ec0c7a8c699d78bcfc431c38e525ae145aca1b73fb8d4525886babbd1b716c94d373760f32e33f5954

Download Submit
C:\Windows\System\swANndu.exe

Filesize
1.2MB

MD5
8c157dc305f235c235ee08b9009e903d

SHA1
7e2cf5215f17c5f74640106959560a50a72a9cf4

SHA256
81934dfcaac0ff094b8a59ce5ec07d7fe8450a1148eb52f8363eb785b928b672

SHA512
5518f329acceeb91f546e40cead4a9b3332666644346835bb01754c2d8e7fe135165f720d8b9ecc61b0bebc1ee1502224dfcaadc1722e4ef1ccb5e445ba86904

Download Submit
C:\Windows\System\uHYOheI.exe

Filesize
1.3MB

MD5
a8fc05812aa125f2c6f8bb758967ff8e

SHA1
4ed50c69d97811af7e71a7257285709d9558ead4

SHA256
790da83ae6105287892fb205b3811ae3616553e2809e5e444dfd6fae7ec1b4e7

SHA512
150c97ba5add1663e3a6baf402a9e6ddb9490c8ca75621611889695b0f7efc43420f5fae54b91fc07102b8dc0feb909e2fce7c99226b44b5ab9e6a4ebb9e47f8

Download Submit
C:\Windows\System\uhrnTHv.exe

Filesize
1.2MB

MD5
c507fa86a3ab6c13e0674f43a05b03ef

SHA1
0c79eaa9e79a3ebfa8e4ad2d0f28580dbac2281f

SHA256
83efc8a64856b50c49844d1e1140402c6a3ab7564e8e50eced1201836d3b7cd5

SHA512
5f2341aa53a710e91692e8bacdfebcb3675413b3c79d6adb795f82327c70f7419e4949b6b555acc2dd223c4dc51a242b8193a6df2e93213e4b4c46d69a7f929a

Download Submit
C:\Windows\System\uyOGoLW.exe

Filesize
1.2MB

MD5
740ccac6adb5a3e052d73e9a925c6231

SHA1
e5dcba91f996e72956c46b2ca55723169544976f

SHA256
1dc634995b3941601627b14ca0be45bcb0a4e0fc04da5ca65c6011784a178fd5

SHA512
66f9990a875491ae2238ce7ffd0d68ba34214f974a01c06454da6ff9de30f06af5fe7937a962350383fc18e222e4638819d2ca783f88637bec6e076549442959

Download Submit
C:\Windows\System\xwvkOhr.exe

Filesize
1.2MB

MD5
63e308d34556c18776205b7d35d2b72a

SHA1
2f588eee0a6aede9df2a8fb4d334c822a48684c4

SHA256
717bdd9fe64443c641c4a95d76f8f14809963fa826fac87143e1f33fbc7ae073

SHA512
8f3c0a9ae5804c49b1d3073720e5a1c1a0b34c6024b0b2b77648b424e3a8040008bb9dbebfd02a2a4dfc6bc973b82ba909caac02070c8c3c82c3c60350263557

Download Submit
C:\Windows\System\yJKkCbD.exe

Filesize
1.3MB

MD5
b356d5bdaa8e88e0648c32f719b18958

SHA1
b13fdb047a985679f8337526cc54e397ad215ae7

SHA256
eb3f32a972d994830c0817c8b8f31f786fb9f60a1d67bfee7db2100dbcf289e9

SHA512
6077f1deee5b9cd1b9fe6febce699c6c43a9a6453843201df4480acdd604463a6edbbcc40019533cf505c6a9dc20590fa632fade73e776fca934ad41938fa13e

Download Submit
C:\Windows\System\yZuniZS.exe

Filesize
1.3MB

MD5
6fdb2f4c32d01f1e3248fd369e9c3075

SHA1
8132a03bfca1f833c4b5be0e09e21ef915862c23

SHA256
a7c69f74c1bafd2d49891dd6185d4201291f7f9449178f5a5262ce6792ce3e08

SHA512
9bad5022b070c1ebd8013604c1f04e8367a7cb1ba9a1d2cde72c7406b7370affe1a54dde7f75b70a803315d985fd8fbde72a28856731e36491212becb7ec1b26

Download Submit
C:\Windows\System\ynImgdX.exe

Filesize
1.3MB

MD5
e3d5ffa2094ef39fc8d21ee59b2f5b9b

SHA1
08ed0e6f49ecbf034ee9b1b009ff06593b299f38

SHA256
9c98a9d7ed4aff6edcc735e9fb038ef20062f1bcc0601281ec9c811d9248a895

SHA512
a481daf630edd09391c68902186bad223b9542ffa3d4fc5a425ec2d719451d026125d69e296cee611ca56d206739a58026ff3c2abf7b3d11d166f95ec404fe2a

Download Submit
memory/372-1056-0x00007FF6CA3E0000-0x00007FF6CA7D2000-memory.dmp

Filesize
3.9MB

Download
memory/372-2892-0x00007FF6CA3E0000-0x00007FF6CA7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1120-2815-0x00007FF69E2E0000-0x00007FF69E6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1120-103-0x00007FF69E2E0000-0x00007FF69E6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1280-921-0x00007FF706AB0000-0x00007FF706EA2000-memory.dmp

Filesize
3.9MB

Download
memory/1280-2934-0x00007FF706AB0000-0x00007FF706EA2000-memory.dmp

Filesize
3.9MB

Download
memory/1684-816-0x00007FF7385B0000-0x00007FF7389A2000-memory.dmp

Filesize
3.9MB

Download
memory/1684-2884-0x00007FF7385B0000-0x00007FF7389A2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-2915-0x00007FF7E75D0000-0x00007FF7E79C2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-1007-0x00007FF7E75D0000-0x00007FF7E79C2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-188-0x00007FF8ECA50000-0x00007FF8ED511000-memory.dmp

Filesize
10.8MB

Download
memory/2044-106-0x00007FF8ECA53000-0x00007FF8ECA55000-memory.dmp

Filesize
8KB

Download
memory/2044-288-0x000001D2F4560000-0x000001D2F4582000-memory.dmp

Filesize
136KB

Download
memory/2136-1006-0x00007FF659500000-0x00007FF6598F2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-2913-0x00007FF659500000-0x00007FF6598F2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-1045-0x00007FF7F2CA0000-0x00007FF7F3092000-memory.dmp

Filesize
3.9MB

Download
memory/2332-2859-0x00007FF7F2CA0000-0x00007FF7F3092000-memory.dmp

Filesize
3.9MB

Download
memory/2392-919-0x00007FF67B600000-0x00007FF67B9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2905-0x00007FF67B600000-0x00007FF67B9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-2897-0x00007FF7785A0000-0x00007FF778992000-memory.dmp

Filesize
3.9MB

Download
memory/2484-452-0x00007FF7785A0000-0x00007FF778992000-memory.dmp

Filesize
3.9MB

Download
memory/2648-607-0x00007FF752910000-0x00007FF752D02000-memory.dmp

Filesize
3.9MB

Download
memory/2648-2873-0x00007FF752910000-0x00007FF752D02000-memory.dmp

Filesize
3.9MB

Download
memory/2664-985-0x00007FF604E20000-0x00007FF605212000-memory.dmp

Filesize
3.9MB

Download
memory/2664-2909-0x00007FF604E20000-0x00007FF605212000-memory.dmp

Filesize
3.9MB

Download
memory/3028-2813-0x00007FF63DF60000-0x00007FF63E352000-memory.dmp

Filesize
3.9MB

Download
memory/3028-2808-0x00007FF63DF60000-0x00007FF63E352000-memory.dmp

Filesize
3.9MB

Download
memory/3028-12-0x00007FF63DF60000-0x00007FF63E352000-memory.dmp

Filesize
3.9MB

Download
memory/3132-870-0x00007FF6427E0000-0x00007FF642BD2000-memory.dmp

Filesize
3.9MB

Download
memory/3132-2902-0x00007FF6427E0000-0x00007FF642BD2000-memory.dmp

Filesize
3.9MB

Download
memory/3188-2889-0x00007FF686780000-0x00007FF686B72000-memory.dmp

Filesize
3.9MB

Download
memory/3188-1046-0x00007FF686780000-0x00007FF686B72000-memory.dmp

Filesize
3.9MB

Download
memory/3280-821-0x00007FF7F3140000-0x00007FF7F3532000-memory.dmp

Filesize
3.9MB

Download
memory/3280-2890-0x00007FF7F3140000-0x00007FF7F3532000-memory.dmp

Filesize
3.9MB

Download
memory/3364-2861-0x00007FF7FAC20000-0x00007FF7FB012000-memory.dmp

Filesize
3.9MB

Download
memory/3364-296-0x00007FF7FAC20000-0x00007FF7FB012000-memory.dmp

Filesize
3.9MB

Download
memory/3436-2839-0x00007FF723E30000-0x00007FF724222000-memory.dmp

Filesize
3.9MB

Download
memory/3436-2809-0x00007FF723E30000-0x00007FF724222000-memory.dmp

Filesize
3.9MB

Download
memory/3436-43-0x00007FF723E30000-0x00007FF724222000-memory.dmp

Filesize
3.9MB

Download
memory/3676-1-0x0000017A88160000-0x0000017A88170000-memory.dmp

Filesize
64KB

Download
memory/3676-0-0x00007FF616780000-0x00007FF616B72000-memory.dmp

Filesize
3.9MB

Download
memory/3720-1005-0x00007FF61B9D0000-0x00007FF61BDC2000-memory.dmp

Filesize
3.9MB

Download
memory/3720-2911-0x00007FF61B9D0000-0x00007FF61BDC2000-memory.dmp

Filesize
3.9MB

Download
memory/3972-2899-0x00007FF6B4CB0000-0x00007FF6B50A2000-memory.dmp

Filesize
3.9MB

Download
memory/3972-386-0x00007FF6B4CB0000-0x00007FF6B50A2000-memory.dmp

Filesize
3.9MB

Download
memory/4420-90-0x00007FF77E640000-0x00007FF77EA32000-memory.dmp

Filesize
3.9MB

Download
memory/4420-2810-0x00007FF77E640000-0x00007FF77EA32000-memory.dmp

Filesize
3.9MB

Download
memory/4420-2837-0x00007FF77E640000-0x00007FF77EA32000-memory.dmp

Filesize
3.9MB

Download
memory/4508-867-0x00007FF64F840000-0x00007FF64FC32000-memory.dmp

Filesize
3.9MB

Download
memory/4508-2894-0x00007FF64F840000-0x00007FF64FC32000-memory.dmp

Filesize
3.9MB

Download
memory/4528-2900-0x00007FF62C340000-0x00007FF62C732000-memory.dmp

Filesize
3.9MB

Download
memory/4528-454-0x00007FF62C340000-0x00007FF62C732000-memory.dmp

Filesize
3.9MB

Download
memory/4800-295-0x00007FF7A5750000-0x00007FF7A5B42000-memory.dmp

Filesize
3.9MB

Download
memory/4800-2855-0x00007FF7A5750000-0x00007FF7A5B42000-memory.dmp

Filesize
3.9MB

Download
memory/5032-52-0x00007FF66C2C0000-0x00007FF66C6B2000-memory.dmp

Filesize
3.9MB

Download
memory/5032-2811-0x00007FF66C2C0000-0x00007FF66C6B2000-memory.dmp

Filesize
3.9MB

Download
memory/5032-2828-0x00007FF66C2C0000-0x00007FF66C6B2000-memory.dmp

Filesize
3.9MB

Download