xmrig | 06ab053d74652a793af8d2f5eddf3b8203bd0474a3e9d8577d3a0d72383b6831

Analysis

max time kernel
90s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ad9579a6663855a06485ba17b3a9060N.exe
Size

2.9MB
MD5

4ad9579a6663855a06485ba17b3a9060
SHA1

653ff2feacc5ab3ee13848967f50b3abc6ea0033
SHA256

06ab053d74652a793af8d2f5eddf3b8203bd0474a3e9d8577d3a0d72383b6831
SHA512

820ed597c9eadf56355350fd766a407fca95f44ef93e74d5e9913c8dd75558ed9ec3c7cdf3c904ba023b218cf4b8a77df9a57c262172d26cbee44fd566a46855
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5V+J1K7zt:NAB9

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3768-98-0x00007FF7C4360000-0x00007FF7C4752000-memory.dmp	xmrig
behavioral2/memory/3264-113-0x00007FF74B440000-0x00007FF74B832000-memory.dmp	xmrig
behavioral2/memory/4732-127-0x00007FF64D700000-0x00007FF64DAF2000-memory.dmp	xmrig
behavioral2/memory/1452-178-0x00007FF655A10000-0x00007FF655E02000-memory.dmp	xmrig
behavioral2/memory/5004-194-0x00007FF67E810000-0x00007FF67EC02000-memory.dmp	xmrig
behavioral2/memory/3788-219-0x00007FF72EB40000-0x00007FF72EF32000-memory.dmp	xmrig
behavioral2/memory/1140-254-0x00007FF610240000-0x00007FF610632000-memory.dmp	xmrig
behavioral2/memory/2180-267-0x00007FF737AE0000-0x00007FF737ED2000-memory.dmp	xmrig
behavioral2/memory/2316-270-0x00007FF674420000-0x00007FF674812000-memory.dmp	xmrig
behavioral2/memory/4396-269-0x00007FF647E30000-0x00007FF648222000-memory.dmp	xmrig
behavioral2/memory/676-268-0x00007FF784F50000-0x00007FF785342000-memory.dmp	xmrig
behavioral2/memory/2224-258-0x00007FF69AB70000-0x00007FF69AF62000-memory.dmp	xmrig
behavioral2/memory/1100-253-0x00007FF7C6BE0000-0x00007FF7C6FD2000-memory.dmp	xmrig
behavioral2/memory/1420-252-0x00007FF7D84E0000-0x00007FF7D88D2000-memory.dmp	xmrig
behavioral2/memory/4436-218-0x00007FF694D20000-0x00007FF695112000-memory.dmp	xmrig
behavioral2/memory/388-201-0x00007FF7617E0000-0x00007FF761BD2000-memory.dmp	xmrig
behavioral2/memory/4216-163-0x00007FF6B61E0000-0x00007FF6B65D2000-memory.dmp	xmrig
behavioral2/memory/5016-153-0x00007FF68DA60000-0x00007FF68DE52000-memory.dmp	xmrig
behavioral2/memory/3524-135-0x00007FF752AE0000-0x00007FF752ED2000-memory.dmp	xmrig
behavioral2/memory/5036-105-0x00007FF77CF30000-0x00007FF77D322000-memory.dmp	xmrig
behavioral2/memory/4016-102-0x00007FF6C0500000-0x00007FF6C08F2000-memory.dmp	xmrig
behavioral2/memory/1748-101-0x00007FF6F81D0000-0x00007FF6F85C2000-memory.dmp	xmrig
behavioral2/memory/3504-97-0x00007FF73EFE0000-0x00007FF73F3D2000-memory.dmp	xmrig
behavioral2/memory/2280-92-0x00007FF629920000-0x00007FF629D12000-memory.dmp	xmrig
behavioral2/memory/2224-2634-0x00007FF69AB70000-0x00007FF69AF62000-memory.dmp	xmrig
behavioral2/memory/3768-2636-0x00007FF7C4360000-0x00007FF7C4752000-memory.dmp	xmrig
behavioral2/memory/2280-2638-0x00007FF629920000-0x00007FF629D12000-memory.dmp	xmrig
behavioral2/memory/3504-2640-0x00007FF73EFE0000-0x00007FF73F3D2000-memory.dmp	xmrig
behavioral2/memory/3264-2642-0x00007FF74B440000-0x00007FF74B832000-memory.dmp	xmrig
behavioral2/memory/1748-2644-0x00007FF6F81D0000-0x00007FF6F85C2000-memory.dmp	xmrig
behavioral2/memory/4016-2646-0x00007FF6C0500000-0x00007FF6C08F2000-memory.dmp	xmrig
behavioral2/memory/5036-2650-0x00007FF77CF30000-0x00007FF77D322000-memory.dmp	xmrig
behavioral2/memory/5016-2654-0x00007FF68DA60000-0x00007FF68DE52000-memory.dmp	xmrig
behavioral2/memory/4732-2652-0x00007FF64D700000-0x00007FF64DAF2000-memory.dmp	xmrig
behavioral2/memory/2180-2648-0x00007FF737AE0000-0x00007FF737ED2000-memory.dmp	xmrig
behavioral2/memory/3524-2658-0x00007FF752AE0000-0x00007FF752ED2000-memory.dmp	xmrig
behavioral2/memory/1452-2660-0x00007FF655A10000-0x00007FF655E02000-memory.dmp	xmrig
behavioral2/memory/5004-2657-0x00007FF67E810000-0x00007FF67EC02000-memory.dmp	xmrig
behavioral2/memory/4216-2662-0x00007FF6B61E0000-0x00007FF6B65D2000-memory.dmp	xmrig
behavioral2/memory/388-2666-0x00007FF7617E0000-0x00007FF761BD2000-memory.dmp	xmrig
behavioral2/memory/676-2664-0x00007FF784F50000-0x00007FF785342000-memory.dmp	xmrig
behavioral2/memory/2316-2671-0x00007FF674420000-0x00007FF674812000-memory.dmp	xmrig
behavioral2/memory/1100-2678-0x00007FF7C6BE0000-0x00007FF7C6FD2000-memory.dmp	xmrig
behavioral2/memory/1140-2677-0x00007FF610240000-0x00007FF610632000-memory.dmp	xmrig
behavioral2/memory/3788-2669-0x00007FF72EB40000-0x00007FF72EF32000-memory.dmp	xmrig
behavioral2/memory/1420-2682-0x00007FF7D84E0000-0x00007FF7D88D2000-memory.dmp	xmrig
behavioral2/memory/4396-2674-0x00007FF647E30000-0x00007FF648222000-memory.dmp	xmrig
behavioral2/memory/4436-2673-0x00007FF694D20000-0x00007FF695112000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1512	powershell.exe
5	1512	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1512	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2224	vDbkTuA.exe
2280	NSBfusY.exe
3504	xUUTISu.exe
3768	eyPeFCO.exe
1748	fvMVzRS.exe
4016	qJbJdmi.exe
2180	xQcRyvr.exe
5036	vQnmgMn.exe
3264	CbGuLmW.exe
4732	nYsQNnr.exe
3524	gAFktki.exe
5016	gtqWRxN.exe
4216	oDlVPFH.exe
1452	ENuXhLI.exe
5004	ylvzkfg.exe
676	jhUGblT.exe
388	yyTaRRW.exe
4396	uLRQZIF.exe
4436	vRmwFVv.exe
3788	joYxahJ.exe
2316	VOpHhXD.exe
1420	mvyoFjW.exe
1100	equcHuW.exe
1140	KkakFqT.exe
1640	fYNQVgC.exe
376	BRUwVPH.exe
2640	buEypWi.exe
3824	adIGSjX.exe
692	OKvIhox.exe
5088	HyIbevV.exe
1096	gGBRSvk.exe
2200	CgEfbMM.exe
2708	udzydXp.exe
4424	DQiryur.exe
1488	EbrEMrT.exe
5008	YmjiAeK.exe
4776	OoEBPIi.exe
3564	hYEgcHO.exe
5040	YCTsdun.exe
3880	npaYwsh.exe
1728	lmovolX.exe
4476	UTcBALF.exe
3656	WpyiOJR.exe
1492	FhHUEag.exe
3756	tdCsEld.exe
1584	DMgaQGm.exe
4604	sApGGpx.exe
2828	UKPIWKc.exe
4588	QpKBWlO.exe
3980	XfUFsMn.exe
4640	yyZmKsO.exe
4600	VWnrKhh.exe
1612	KdwYCMU.exe
1704	symPYCc.exe
1456	QxPlhrh.exe
1220	uxqknBg.exe
3212	veDuprD.exe
5092	kWbapnr.exe
1344	MmQbCmr.exe
1004	lPxtsEi.exe
1416	frxGniG.exe
432	LKKTcmZ.exe
3556	MjoWQgm.exe
2244	QIcXfks.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4108-0-0x00007FF6B4510000-0x00007FF6B4902000-memory.dmp	upx
behavioral2/files/0x00090000000233d9-6.dat	upx
behavioral2/files/0x0008000000023439-11.dat	upx
behavioral2/files/0x000800000002343c-16.dat	upx
behavioral2/files/0x000700000002343f-35.dat	upx
behavioral2/files/0x0007000000023445-62.dat	upx
behavioral2/files/0x0007000000023444-76.dat	upx
behavioral2/files/0x000700000002344a-96.dat	upx
behavioral2/memory/3768-98-0x00007FF7C4360000-0x00007FF7C4752000-memory.dmp	upx
behavioral2/files/0x000700000002344c-116.dat	upx
behavioral2/memory/3264-113-0x00007FF74B440000-0x00007FF74B832000-memory.dmp	upx
behavioral2/memory/4732-127-0x00007FF64D700000-0x00007FF64DAF2000-memory.dmp	upx
behavioral2/files/0x000700000002344f-143.dat	upx
behavioral2/files/0x0007000000023452-160.dat	upx
behavioral2/memory/1452-178-0x00007FF655A10000-0x00007FF655E02000-memory.dmp	upx
behavioral2/memory/5004-194-0x00007FF67E810000-0x00007FF67EC02000-memory.dmp	upx
behavioral2/memory/3788-219-0x00007FF72EB40000-0x00007FF72EF32000-memory.dmp	upx
behavioral2/memory/1140-254-0x00007FF610240000-0x00007FF610632000-memory.dmp	upx
behavioral2/memory/2180-267-0x00007FF737AE0000-0x00007FF737ED2000-memory.dmp	upx
behavioral2/memory/2316-270-0x00007FF674420000-0x00007FF674812000-memory.dmp	upx
behavioral2/memory/4396-269-0x00007FF647E30000-0x00007FF648222000-memory.dmp	upx
behavioral2/memory/676-268-0x00007FF784F50000-0x00007FF785342000-memory.dmp	upx
behavioral2/memory/2224-258-0x00007FF69AB70000-0x00007FF69AF62000-memory.dmp	upx
behavioral2/memory/1100-253-0x00007FF7C6BE0000-0x00007FF7C6FD2000-memory.dmp	upx
behavioral2/memory/1420-252-0x00007FF7D84E0000-0x00007FF7D88D2000-memory.dmp	upx
behavioral2/memory/4436-218-0x00007FF694D20000-0x00007FF695112000-memory.dmp	upx
behavioral2/memory/388-201-0x00007FF7617E0000-0x00007FF761BD2000-memory.dmp	upx
behavioral2/files/0x0007000000023454-191.dat	upx
behavioral2/files/0x0007000000023453-189.dat	upx
behavioral2/files/0x000700000002345c-187.dat	upx
behavioral2/files/0x000700000002345b-186.dat	upx
behavioral2/files/0x000700000002345a-185.dat	upx
behavioral2/files/0x0007000000023459-184.dat	upx
behavioral2/files/0x0007000000023458-183.dat	upx
behavioral2/files/0x0007000000023457-182.dat	upx
behavioral2/files/0x0007000000023456-188.dat	upx
behavioral2/memory/4216-163-0x00007FF6B61E0000-0x00007FF6B65D2000-memory.dmp	upx
behavioral2/files/0x0007000000023455-162.dat	upx
behavioral2/files/0x0007000000023450-157.dat	upx
behavioral2/files/0x000700000002344e-164.dat	upx
behavioral2/memory/5016-153-0x00007FF68DA60000-0x00007FF68DE52000-memory.dmp	upx
behavioral2/files/0x000700000002344b-148.dat	upx
behavioral2/files/0x0007000000023451-146.dat	upx
behavioral2/files/0x000700000002344d-141.dat	upx
behavioral2/files/0x000800000002343a-139.dat	upx
behavioral2/memory/3524-135-0x00007FF752AE0000-0x00007FF752ED2000-memory.dmp	upx
behavioral2/memory/5036-105-0x00007FF77CF30000-0x00007FF77D322000-memory.dmp	upx
behavioral2/memory/4016-102-0x00007FF6C0500000-0x00007FF6C08F2000-memory.dmp	upx
behavioral2/memory/1748-101-0x00007FF6F81D0000-0x00007FF6F85C2000-memory.dmp	upx
behavioral2/files/0x0007000000023449-99.dat	upx
behavioral2/memory/3504-97-0x00007FF73EFE0000-0x00007FF73F3D2000-memory.dmp	upx
behavioral2/files/0x0007000000023447-93.dat	upx
behavioral2/memory/2280-92-0x00007FF629920000-0x00007FF629D12000-memory.dmp	upx
behavioral2/files/0x0007000000023448-87.dat	upx
behavioral2/files/0x0008000000023440-85.dat	upx
behavioral2/files/0x0008000000023441-71.dat	upx
behavioral2/files/0x0007000000023442-67.dat	upx
behavioral2/files/0x0007000000023446-65.dat	upx
behavioral2/files/0x000700000002343e-54.dat	upx
behavioral2/files/0x0007000000023443-50.dat	upx
behavioral2/files/0x000700000002343d-32.dat	upx
behavioral2/memory/2224-2634-0x00007FF69AB70000-0x00007FF69AF62000-memory.dmp	upx
behavioral2/memory/3768-2636-0x00007FF7C4360000-0x00007FF7C4752000-memory.dmp	upx
behavioral2/memory/2280-2638-0x00007FF629920000-0x00007FF629D12000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zYPBAOz.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\DbuLAuN.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\HIdGJWg.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\ousKbKE.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\KCuVkxV.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\GZCLhol.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\tVcblzF.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\RnfQNtf.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\XOrRaUP.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\vgWLlqF.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\NjdMFuE.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\aAKtozP.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\AQgpYoy.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\MdpRawv.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\RgJwZlh.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\fAgNHKj.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\GkBNKHH.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\YmiUKcz.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\KHlArsu.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\TBRpugW.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\CllDOqV.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\bPdifVm.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\IyuoGqZ.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\pMsGijm.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\jqDpRcC.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\CUcfylV.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\UsuVsgv.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\wLEHTPl.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\jpIiVRc.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\KwXVCIS.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\mdTpjaz.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\PGBezbR.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\UjfMMMB.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\PcBUBkY.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\MLObhxb.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\csfWEOC.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\sKNJNke.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\DUytrcl.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\fLYgeIY.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\JfUDvNR.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\nGKNoJU.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\BdrfuKx.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\bwHtbXo.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\evRusIg.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\avSvJyi.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\bHtHfMu.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\logqMOe.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\cXpWXgl.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\xzeuGVa.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\FfkKemv.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\TrMpkEl.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\vLIxnFk.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\kdbZLfg.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\TnOcqdf.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\sPsShBW.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\ByDCzYN.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\UfFpuRE.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\cJLuhaI.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\xsftoLz.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\qGjmUQJ.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\XoPvWrN.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\HsbgGJZ.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\soRJcSq.exe	4ad9579a6663855a06485ba17b3a9060N.exe
File created	C:\Windows\System\qBXnPZB.exe	4ad9579a6663855a06485ba17b3a9060N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1512	powershell.exe
1512	powershell.exe
1512	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4108	4ad9579a6663855a06485ba17b3a9060N.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeLockMemoryPrivilege	4108	4ad9579a6663855a06485ba17b3a9060N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 1512	4108	4ad9579a6663855a06485ba17b3a9060N.exe	83
PID 4108 wrote to memory of 1512	4108	4ad9579a6663855a06485ba17b3a9060N.exe	83
PID 4108 wrote to memory of 2224	4108	4ad9579a6663855a06485ba17b3a9060N.exe	84
PID 4108 wrote to memory of 2224	4108	4ad9579a6663855a06485ba17b3a9060N.exe	84
PID 4108 wrote to memory of 2280	4108	4ad9579a6663855a06485ba17b3a9060N.exe	85
PID 4108 wrote to memory of 2280	4108	4ad9579a6663855a06485ba17b3a9060N.exe	85
PID 4108 wrote to memory of 3504	4108	4ad9579a6663855a06485ba17b3a9060N.exe	86
PID 4108 wrote to memory of 3504	4108	4ad9579a6663855a06485ba17b3a9060N.exe	86
PID 4108 wrote to memory of 3768	4108	4ad9579a6663855a06485ba17b3a9060N.exe	87
PID 4108 wrote to memory of 3768	4108	4ad9579a6663855a06485ba17b3a9060N.exe	87
PID 4108 wrote to memory of 1748	4108	4ad9579a6663855a06485ba17b3a9060N.exe	88
PID 4108 wrote to memory of 1748	4108	4ad9579a6663855a06485ba17b3a9060N.exe	88
PID 4108 wrote to memory of 4016	4108	4ad9579a6663855a06485ba17b3a9060N.exe	89
PID 4108 wrote to memory of 4016	4108	4ad9579a6663855a06485ba17b3a9060N.exe	89
PID 4108 wrote to memory of 2180	4108	4ad9579a6663855a06485ba17b3a9060N.exe	90
PID 4108 wrote to memory of 2180	4108	4ad9579a6663855a06485ba17b3a9060N.exe	90
PID 4108 wrote to memory of 5036	4108	4ad9579a6663855a06485ba17b3a9060N.exe	91
PID 4108 wrote to memory of 5036	4108	4ad9579a6663855a06485ba17b3a9060N.exe	91
PID 4108 wrote to memory of 3264	4108	4ad9579a6663855a06485ba17b3a9060N.exe	92
PID 4108 wrote to memory of 3264	4108	4ad9579a6663855a06485ba17b3a9060N.exe	92
PID 4108 wrote to memory of 4732	4108	4ad9579a6663855a06485ba17b3a9060N.exe	93
PID 4108 wrote to memory of 4732	4108	4ad9579a6663855a06485ba17b3a9060N.exe	93
PID 4108 wrote to memory of 3524	4108	4ad9579a6663855a06485ba17b3a9060N.exe	94
PID 4108 wrote to memory of 3524	4108	4ad9579a6663855a06485ba17b3a9060N.exe	94
PID 4108 wrote to memory of 5016	4108	4ad9579a6663855a06485ba17b3a9060N.exe	95
PID 4108 wrote to memory of 5016	4108	4ad9579a6663855a06485ba17b3a9060N.exe	95
PID 4108 wrote to memory of 4216	4108	4ad9579a6663855a06485ba17b3a9060N.exe	96
PID 4108 wrote to memory of 4216	4108	4ad9579a6663855a06485ba17b3a9060N.exe	96
PID 4108 wrote to memory of 1452	4108	4ad9579a6663855a06485ba17b3a9060N.exe	97
PID 4108 wrote to memory of 1452	4108	4ad9579a6663855a06485ba17b3a9060N.exe	97
PID 4108 wrote to memory of 5004	4108	4ad9579a6663855a06485ba17b3a9060N.exe	98
PID 4108 wrote to memory of 5004	4108	4ad9579a6663855a06485ba17b3a9060N.exe	98
PID 4108 wrote to memory of 676	4108	4ad9579a6663855a06485ba17b3a9060N.exe	99
PID 4108 wrote to memory of 676	4108	4ad9579a6663855a06485ba17b3a9060N.exe	99
PID 4108 wrote to memory of 388	4108	4ad9579a6663855a06485ba17b3a9060N.exe	100
PID 4108 wrote to memory of 388	4108	4ad9579a6663855a06485ba17b3a9060N.exe	100
PID 4108 wrote to memory of 1100	4108	4ad9579a6663855a06485ba17b3a9060N.exe	101
PID 4108 wrote to memory of 1100	4108	4ad9579a6663855a06485ba17b3a9060N.exe	101
PID 4108 wrote to memory of 4396	4108	4ad9579a6663855a06485ba17b3a9060N.exe	102
PID 4108 wrote to memory of 4396	4108	4ad9579a6663855a06485ba17b3a9060N.exe	102
PID 4108 wrote to memory of 4436	4108	4ad9579a6663855a06485ba17b3a9060N.exe	103
PID 4108 wrote to memory of 4436	4108	4ad9579a6663855a06485ba17b3a9060N.exe	103
PID 4108 wrote to memory of 3788	4108	4ad9579a6663855a06485ba17b3a9060N.exe	104
PID 4108 wrote to memory of 3788	4108	4ad9579a6663855a06485ba17b3a9060N.exe	104
PID 4108 wrote to memory of 376	4108	4ad9579a6663855a06485ba17b3a9060N.exe	105
PID 4108 wrote to memory of 376	4108	4ad9579a6663855a06485ba17b3a9060N.exe	105
PID 4108 wrote to memory of 2316	4108	4ad9579a6663855a06485ba17b3a9060N.exe	106
PID 4108 wrote to memory of 2316	4108	4ad9579a6663855a06485ba17b3a9060N.exe	106
PID 4108 wrote to memory of 1420	4108	4ad9579a6663855a06485ba17b3a9060N.exe	107
PID 4108 wrote to memory of 1420	4108	4ad9579a6663855a06485ba17b3a9060N.exe	107
PID 4108 wrote to memory of 1140	4108	4ad9579a6663855a06485ba17b3a9060N.exe	108
PID 4108 wrote to memory of 1140	4108	4ad9579a6663855a06485ba17b3a9060N.exe	108
PID 4108 wrote to memory of 1640	4108	4ad9579a6663855a06485ba17b3a9060N.exe	109
PID 4108 wrote to memory of 1640	4108	4ad9579a6663855a06485ba17b3a9060N.exe	109
PID 4108 wrote to memory of 2640	4108	4ad9579a6663855a06485ba17b3a9060N.exe	110
PID 4108 wrote to memory of 2640	4108	4ad9579a6663855a06485ba17b3a9060N.exe	110
PID 4108 wrote to memory of 3824	4108	4ad9579a6663855a06485ba17b3a9060N.exe	111
PID 4108 wrote to memory of 3824	4108	4ad9579a6663855a06485ba17b3a9060N.exe	111
PID 4108 wrote to memory of 692	4108	4ad9579a6663855a06485ba17b3a9060N.exe	112
PID 4108 wrote to memory of 692	4108	4ad9579a6663855a06485ba17b3a9060N.exe	112
PID 4108 wrote to memory of 5008	4108	4ad9579a6663855a06485ba17b3a9060N.exe	113
PID 4108 wrote to memory of 5008	4108	4ad9579a6663855a06485ba17b3a9060N.exe	113
PID 4108 wrote to memory of 5088	4108	4ad9579a6663855a06485ba17b3a9060N.exe	114
PID 4108 wrote to memory of 5088	4108	4ad9579a6663855a06485ba17b3a9060N.exe	114

C:\Users\Admin\AppData\Local\Temp\4ad9579a6663855a06485ba17b3a9060N.exe
"C:\Users\Admin\AppData\Local\Temp\4ad9579a6663855a06485ba17b3a9060N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1512" "2960" "2880" "2964" "0" "0" "2968" "0" "0" "0" "0" "0"
    3⤵
    PID:12696
- C:\Windows\System\vDbkTuA.exe
  C:\Windows\System\vDbkTuA.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\NSBfusY.exe
  C:\Windows\System\NSBfusY.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\xUUTISu.exe
  C:\Windows\System\xUUTISu.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\eyPeFCO.exe
  C:\Windows\System\eyPeFCO.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\fvMVzRS.exe
  C:\Windows\System\fvMVzRS.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\qJbJdmi.exe
  C:\Windows\System\qJbJdmi.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\xQcRyvr.exe
  C:\Windows\System\xQcRyvr.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\vQnmgMn.exe
  C:\Windows\System\vQnmgMn.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\CbGuLmW.exe
  C:\Windows\System\CbGuLmW.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\nYsQNnr.exe
  C:\Windows\System\nYsQNnr.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\gAFktki.exe
  C:\Windows\System\gAFktki.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\gtqWRxN.exe
  C:\Windows\System\gtqWRxN.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\oDlVPFH.exe
  C:\Windows\System\oDlVPFH.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\ENuXhLI.exe
  C:\Windows\System\ENuXhLI.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\ylvzkfg.exe
  C:\Windows\System\ylvzkfg.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\jhUGblT.exe
  C:\Windows\System\jhUGblT.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\yyTaRRW.exe
  C:\Windows\System\yyTaRRW.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\equcHuW.exe
  C:\Windows\System\equcHuW.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\uLRQZIF.exe
  C:\Windows\System\uLRQZIF.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\vRmwFVv.exe
  C:\Windows\System\vRmwFVv.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\joYxahJ.exe
  C:\Windows\System\joYxahJ.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\BRUwVPH.exe
  C:\Windows\System\BRUwVPH.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\VOpHhXD.exe
  C:\Windows\System\VOpHhXD.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\mvyoFjW.exe
  C:\Windows\System\mvyoFjW.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\KkakFqT.exe
  C:\Windows\System\KkakFqT.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\fYNQVgC.exe
  C:\Windows\System\fYNQVgC.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\buEypWi.exe
  C:\Windows\System\buEypWi.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\adIGSjX.exe
  C:\Windows\System\adIGSjX.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\OKvIhox.exe
  C:\Windows\System\OKvIhox.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\YmjiAeK.exe
  C:\Windows\System\YmjiAeK.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\HyIbevV.exe
  C:\Windows\System\HyIbevV.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\gGBRSvk.exe
  C:\Windows\System\gGBRSvk.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\CgEfbMM.exe
  C:\Windows\System\CgEfbMM.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\udzydXp.exe
  C:\Windows\System\udzydXp.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\DQiryur.exe
  C:\Windows\System\DQiryur.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\EbrEMrT.exe
  C:\Windows\System\EbrEMrT.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\OoEBPIi.exe
  C:\Windows\System\OoEBPIi.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\hYEgcHO.exe
  C:\Windows\System\hYEgcHO.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\YCTsdun.exe
  C:\Windows\System\YCTsdun.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\npaYwsh.exe
  C:\Windows\System\npaYwsh.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\lmovolX.exe
  C:\Windows\System\lmovolX.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\UTcBALF.exe
  C:\Windows\System\UTcBALF.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\WpyiOJR.exe
  C:\Windows\System\WpyiOJR.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\FhHUEag.exe
  C:\Windows\System\FhHUEag.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\tdCsEld.exe
  C:\Windows\System\tdCsEld.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\DMgaQGm.exe
  C:\Windows\System\DMgaQGm.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\sApGGpx.exe
  C:\Windows\System\sApGGpx.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\UKPIWKc.exe
  C:\Windows\System\UKPIWKc.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\QpKBWlO.exe
  C:\Windows\System\QpKBWlO.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\XfUFsMn.exe
  C:\Windows\System\XfUFsMn.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\yyZmKsO.exe
  C:\Windows\System\yyZmKsO.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\VWnrKhh.exe
  C:\Windows\System\VWnrKhh.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\KdwYCMU.exe
  C:\Windows\System\KdwYCMU.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\symPYCc.exe
  C:\Windows\System\symPYCc.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\QxPlhrh.exe
  C:\Windows\System\QxPlhrh.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\uxqknBg.exe
  C:\Windows\System\uxqknBg.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\veDuprD.exe
  C:\Windows\System\veDuprD.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\kWbapnr.exe
  C:\Windows\System\kWbapnr.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\MmQbCmr.exe
  C:\Windows\System\MmQbCmr.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\lPxtsEi.exe
  C:\Windows\System\lPxtsEi.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\frxGniG.exe
  C:\Windows\System\frxGniG.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\LKKTcmZ.exe
  C:\Windows\System\LKKTcmZ.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\MjoWQgm.exe
  C:\Windows\System\MjoWQgm.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\QIcXfks.exe
  C:\Windows\System\QIcXfks.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\crlDZoJ.exe
  C:\Windows\System\crlDZoJ.exe
  2⤵
  PID:4156
- C:\Windows\System\VCyexUH.exe
  C:\Windows\System\VCyexUH.exe
  2⤵
  PID:672
- C:\Windows\System\MqCPFFR.exe
  C:\Windows\System\MqCPFFR.exe
  2⤵
  PID:4388
- C:\Windows\System\pmCDRSJ.exe
  C:\Windows\System\pmCDRSJ.exe
  2⤵
  PID:784
- C:\Windows\System\tydZCYu.exe
  C:\Windows\System\tydZCYu.exe
  2⤵
  PID:2288
- C:\Windows\System\YIFkchd.exe
  C:\Windows\System\YIFkchd.exe
  2⤵
  PID:3300
- C:\Windows\System\JJpDheJ.exe
  C:\Windows\System\JJpDheJ.exe
  2⤵
  PID:224
- C:\Windows\System\ucKdGfJ.exe
  C:\Windows\System\ucKdGfJ.exe
  2⤵
  PID:1500
- C:\Windows\System\NcXrIag.exe
  C:\Windows\System\NcXrIag.exe
  2⤵
  PID:532
- C:\Windows\System\dufTEuS.exe
  C:\Windows\System\dufTEuS.exe
  2⤵
  PID:2228
- C:\Windows\System\FuoBqgQ.exe
  C:\Windows\System\FuoBqgQ.exe
  2⤵
  PID:1876
- C:\Windows\System\glbmAZs.exe
  C:\Windows\System\glbmAZs.exe
  2⤵
  PID:2700
- C:\Windows\System\oqedxLL.exe
  C:\Windows\System\oqedxLL.exe
  2⤵
  PID:2344
- C:\Windows\System\jxqCPHb.exe
  C:\Windows\System\jxqCPHb.exe
  2⤵
  PID:3248
- C:\Windows\System\PiJQMvm.exe
  C:\Windows\System\PiJQMvm.exe
  2⤵
  PID:1120
- C:\Windows\System\LfeMXyT.exe
  C:\Windows\System\LfeMXyT.exe
  2⤵
  PID:1252
- C:\Windows\System\HcSbuVW.exe
  C:\Windows\System\HcSbuVW.exe
  2⤵
  PID:3792
- C:\Windows\System\goKRQyy.exe
  C:\Windows\System\goKRQyy.exe
  2⤵
  PID:3436
- C:\Windows\System\GSREmMv.exe
  C:\Windows\System\GSREmMv.exe
  2⤵
  PID:2932
- C:\Windows\System\FKnJqur.exe
  C:\Windows\System\FKnJqur.exe
  2⤵
  PID:1284
- C:\Windows\System\jlDpJfB.exe
  C:\Windows\System\jlDpJfB.exe
  2⤵
  PID:2396
- C:\Windows\System\orDAPNB.exe
  C:\Windows\System\orDAPNB.exe
  2⤵
  PID:1524
- C:\Windows\System\jGpcXqa.exe
  C:\Windows\System\jGpcXqa.exe
  2⤵
  PID:4668
- C:\Windows\System\BetJNmi.exe
  C:\Windows\System\BetJNmi.exe
  2⤵
  PID:1048
- C:\Windows\System\qxskShl.exe
  C:\Windows\System\qxskShl.exe
  2⤵
  PID:4356
- C:\Windows\System\tJDBvjQ.exe
  C:\Windows\System\tJDBvjQ.exe
  2⤵
  PID:2896
- C:\Windows\System\NMYGtVT.exe
  C:\Windows\System\NMYGtVT.exe
  2⤵
  PID:3036
- C:\Windows\System\kgiFWHX.exe
  C:\Windows\System\kgiFWHX.exe
  2⤵
  PID:5132
- C:\Windows\System\xnLeIpG.exe
  C:\Windows\System\xnLeIpG.exe
  2⤵
  PID:5152
- C:\Windows\System\VeksqWx.exe
  C:\Windows\System\VeksqWx.exe
  2⤵
  PID:5176
- C:\Windows\System\UZHKEaS.exe
  C:\Windows\System\UZHKEaS.exe
  2⤵
  PID:5196
- C:\Windows\System\OOdxLHl.exe
  C:\Windows\System\OOdxLHl.exe
  2⤵
  PID:5220
- C:\Windows\System\mHioRtl.exe
  C:\Windows\System\mHioRtl.exe
  2⤵
  PID:5240
- C:\Windows\System\twYDtYp.exe
  C:\Windows\System\twYDtYp.exe
  2⤵
  PID:5264
- C:\Windows\System\OSxJcjj.exe
  C:\Windows\System\OSxJcjj.exe
  2⤵
  PID:5288
- C:\Windows\System\mmpKIXy.exe
  C:\Windows\System\mmpKIXy.exe
  2⤵
  PID:5308
- C:\Windows\System\uewFphB.exe
  C:\Windows\System\uewFphB.exe
  2⤵
  PID:5324
- C:\Windows\System\iuGAXWe.exe
  C:\Windows\System\iuGAXWe.exe
  2⤵
  PID:5352
- C:\Windows\System\dgGCVPY.exe
  C:\Windows\System\dgGCVPY.exe
  2⤵
  PID:5376
- C:\Windows\System\eMKuLgU.exe
  C:\Windows\System\eMKuLgU.exe
  2⤵
  PID:5400
- C:\Windows\System\JImATyA.exe
  C:\Windows\System\JImATyA.exe
  2⤵
  PID:5424
- C:\Windows\System\JTJISgQ.exe
  C:\Windows\System\JTJISgQ.exe
  2⤵
  PID:5444
- C:\Windows\System\eUXEujT.exe
  C:\Windows\System\eUXEujT.exe
  2⤵
  PID:5476
- C:\Windows\System\CdlghAK.exe
  C:\Windows\System\CdlghAK.exe
  2⤵
  PID:5500
- C:\Windows\System\pwcmrAN.exe
  C:\Windows\System\pwcmrAN.exe
  2⤵
  PID:5520
- C:\Windows\System\ogxoIEg.exe
  C:\Windows\System\ogxoIEg.exe
  2⤵
  PID:5544
- C:\Windows\System\sfepyQP.exe
  C:\Windows\System\sfepyQP.exe
  2⤵
  PID:5568
- C:\Windows\System\iWArFar.exe
  C:\Windows\System\iWArFar.exe
  2⤵
  PID:5596
- C:\Windows\System\kCRYuBK.exe
  C:\Windows\System\kCRYuBK.exe
  2⤵
  PID:5616
- C:\Windows\System\tRRBmBh.exe
  C:\Windows\System\tRRBmBh.exe
  2⤵
  PID:5640
- C:\Windows\System\qJBwwRa.exe
  C:\Windows\System\qJBwwRa.exe
  2⤵
  PID:5660
- C:\Windows\System\aVtNzit.exe
  C:\Windows\System\aVtNzit.exe
  2⤵
  PID:5680
- C:\Windows\System\oUSEEEc.exe
  C:\Windows\System\oUSEEEc.exe
  2⤵
  PID:5708
- C:\Windows\System\uztUPMu.exe
  C:\Windows\System\uztUPMu.exe
  2⤵
  PID:5740
- C:\Windows\System\jqDpRcC.exe
  C:\Windows\System\jqDpRcC.exe
  2⤵
  PID:5768
- C:\Windows\System\ZwNbTNZ.exe
  C:\Windows\System\ZwNbTNZ.exe
  2⤵
  PID:5792
- C:\Windows\System\UgftgYI.exe
  C:\Windows\System\UgftgYI.exe
  2⤵
  PID:5812
- C:\Windows\System\cxksSVA.exe
  C:\Windows\System\cxksSVA.exe
  2⤵
  PID:5840
- C:\Windows\System\UdCDJcc.exe
  C:\Windows\System\UdCDJcc.exe
  2⤵
  PID:5872
- C:\Windows\System\sTwfKZw.exe
  C:\Windows\System\sTwfKZw.exe
  2⤵
  PID:5896
- C:\Windows\System\zUqaXow.exe
  C:\Windows\System\zUqaXow.exe
  2⤵
  PID:5912
- C:\Windows\System\hmlAsUn.exe
  C:\Windows\System\hmlAsUn.exe
  2⤵
  PID:5936
- C:\Windows\System\MZSiriA.exe
  C:\Windows\System\MZSiriA.exe
  2⤵
  PID:5960
- C:\Windows\System\IRkbjex.exe
  C:\Windows\System\IRkbjex.exe
  2⤵
  PID:5988
- C:\Windows\System\rgHCTML.exe
  C:\Windows\System\rgHCTML.exe
  2⤵
  PID:6008
- C:\Windows\System\wJYpSep.exe
  C:\Windows\System\wJYpSep.exe
  2⤵
  PID:6028
- C:\Windows\System\fcpgAGT.exe
  C:\Windows\System\fcpgAGT.exe
  2⤵
  PID:6052
- C:\Windows\System\XwUPWqh.exe
  C:\Windows\System\XwUPWqh.exe
  2⤵
  PID:6084
- C:\Windows\System\YaANXER.exe
  C:\Windows\System\YaANXER.exe
  2⤵
  PID:6108
- C:\Windows\System\cFvtUAB.exe
  C:\Windows\System\cFvtUAB.exe
  2⤵
  PID:6132
- C:\Windows\System\QkqkfVl.exe
  C:\Windows\System\QkqkfVl.exe
  2⤵
  PID:2988
- C:\Windows\System\qQjNnQS.exe
  C:\Windows\System\qQjNnQS.exe
  2⤵
  PID:5048
- C:\Windows\System\qnmTZdP.exe
  C:\Windows\System\qnmTZdP.exe
  2⤵
  PID:2276
- C:\Windows\System\IXyKmGw.exe
  C:\Windows\System\IXyKmGw.exe
  2⤵
  PID:5204
- C:\Windows\System\ffkfxpa.exe
  C:\Windows\System\ffkfxpa.exe
  2⤵
  PID:536
- C:\Windows\System\XerZrAx.exe
  C:\Windows\System\XerZrAx.exe
  2⤵
  PID:2384
- C:\Windows\System\wEAhNHl.exe
  C:\Windows\System\wEAhNHl.exe
  2⤵
  PID:5408
- C:\Windows\System\ViUYpPk.exe
  C:\Windows\System\ViUYpPk.exe
  2⤵
  PID:5168
- C:\Windows\System\KMeBAqN.exe
  C:\Windows\System\KMeBAqN.exe
  2⤵
  PID:5492
- C:\Windows\System\rcJoFpm.exe
  C:\Windows\System\rcJoFpm.exe
  2⤵
  PID:5316
- C:\Windows\System\PDtLftj.exe
  C:\Windows\System\PDtLftj.exe
  2⤵
  PID:5652
- C:\Windows\System\LewzOrO.exe
  C:\Windows\System\LewzOrO.exe
  2⤵
  PID:5604
- C:\Windows\System\qglswnc.exe
  C:\Windows\System\qglswnc.exe
  2⤵
  PID:5452
- C:\Windows\System\QwEUszw.exe
  C:\Windows\System\QwEUszw.exe
  2⤵
  PID:5820
- C:\Windows\System\szweaaN.exe
  C:\Windows\System\szweaaN.exe
  2⤵
  PID:5552
- C:\Windows\System\VqJnmGI.exe
  C:\Windows\System\VqJnmGI.exe
  2⤵
  PID:5588
- C:\Windows\System\XMrTuVu.exe
  C:\Windows\System\XMrTuVu.exe
  2⤵
  PID:5752
- C:\Windows\System\TokDjiJ.exe
  C:\Windows\System\TokDjiJ.exe
  2⤵
  PID:4660
- C:\Windows\System\lvhOrEo.exe
  C:\Windows\System\lvhOrEo.exe
  2⤵
  PID:4492
- C:\Windows\System\UjfMMMB.exe
  C:\Windows\System\UjfMMMB.exe
  2⤵
  PID:1308
- C:\Windows\System\GFAXSeI.exe
  C:\Windows\System\GFAXSeI.exe
  2⤵
  PID:3808
- C:\Windows\System\AUrzdDg.exe
  C:\Windows\System\AUrzdDg.exe
  2⤵
  PID:6168
- C:\Windows\System\MAhAZsu.exe
  C:\Windows\System\MAhAZsu.exe
  2⤵
  PID:6188
- C:\Windows\System\cvdwQKh.exe
  C:\Windows\System\cvdwQKh.exe
  2⤵
  PID:6212
- C:\Windows\System\rOQoPww.exe
  C:\Windows\System\rOQoPww.exe
  2⤵
  PID:6232
- C:\Windows\System\EpTNGQw.exe
  C:\Windows\System\EpTNGQw.exe
  2⤵
  PID:6260
- C:\Windows\System\MerozaX.exe
  C:\Windows\System\MerozaX.exe
  2⤵
  PID:6284
- C:\Windows\System\pHTNbTl.exe
  C:\Windows\System\pHTNbTl.exe
  2⤵
  PID:6312
- C:\Windows\System\FcVocoL.exe
  C:\Windows\System\FcVocoL.exe
  2⤵
  PID:6332
- C:\Windows\System\bbfnhfe.exe
  C:\Windows\System\bbfnhfe.exe
  2⤵
  PID:6352
- C:\Windows\System\enlhkxE.exe
  C:\Windows\System\enlhkxE.exe
  2⤵
  PID:6376
- C:\Windows\System\GiHXzMy.exe
  C:\Windows\System\GiHXzMy.exe
  2⤵
  PID:6400
- C:\Windows\System\xQIyeYG.exe
  C:\Windows\System\xQIyeYG.exe
  2⤵
  PID:6420
- C:\Windows\System\hUAkZpy.exe
  C:\Windows\System\hUAkZpy.exe
  2⤵
  PID:6444
- C:\Windows\System\XoPvWrN.exe
  C:\Windows\System\XoPvWrN.exe
  2⤵
  PID:6468
- C:\Windows\System\GerzPDS.exe
  C:\Windows\System\GerzPDS.exe
  2⤵
  PID:6492
- C:\Windows\System\xYmSEbR.exe
  C:\Windows\System\xYmSEbR.exe
  2⤵
  PID:6512
- C:\Windows\System\CfaqOeN.exe
  C:\Windows\System\CfaqOeN.exe
  2⤵
  PID:6536
- C:\Windows\System\FKjVLYZ.exe
  C:\Windows\System\FKjVLYZ.exe
  2⤵
  PID:6560
- C:\Windows\System\urtlglL.exe
  C:\Windows\System\urtlglL.exe
  2⤵
  PID:6584
- C:\Windows\System\NhPLajj.exe
  C:\Windows\System\NhPLajj.exe
  2⤵
  PID:6604
- C:\Windows\System\olqOyXu.exe
  C:\Windows\System\olqOyXu.exe
  2⤵
  PID:6628
- C:\Windows\System\vIGBrRo.exe
  C:\Windows\System\vIGBrRo.exe
  2⤵
  PID:6652
- C:\Windows\System\YTTghzS.exe
  C:\Windows\System\YTTghzS.exe
  2⤵
  PID:6680
- C:\Windows\System\iLiDvNh.exe
  C:\Windows\System\iLiDvNh.exe
  2⤵
  PID:6704
- C:\Windows\System\JKFGFfr.exe
  C:\Windows\System\JKFGFfr.exe
  2⤵
  PID:6744
- C:\Windows\System\eERCxSo.exe
  C:\Windows\System\eERCxSo.exe
  2⤵
  PID:6776
- C:\Windows\System\xFXxFle.exe
  C:\Windows\System\xFXxFle.exe
  2⤵
  PID:6792
- C:\Windows\System\YFTjKtw.exe
  C:\Windows\System\YFTjKtw.exe
  2⤵
  PID:6820
- C:\Windows\System\jmiIGml.exe
  C:\Windows\System\jmiIGml.exe
  2⤵
  PID:6844
- C:\Windows\System\EnuHHpq.exe
  C:\Windows\System\EnuHHpq.exe
  2⤵
  PID:6872
- C:\Windows\System\plDDxgR.exe
  C:\Windows\System\plDDxgR.exe
  2⤵
  PID:6900
- C:\Windows\System\kMuBdEh.exe
  C:\Windows\System\kMuBdEh.exe
  2⤵
  PID:6924
- C:\Windows\System\FMfMvbz.exe
  C:\Windows\System\FMfMvbz.exe
  2⤵
  PID:6944
- C:\Windows\System\OJoSiIW.exe
  C:\Windows\System\OJoSiIW.exe
  2⤵
  PID:6972
- C:\Windows\System\hMnMsJh.exe
  C:\Windows\System\hMnMsJh.exe
  2⤵
  PID:7000
- C:\Windows\System\etPWREn.exe
  C:\Windows\System\etPWREn.exe
  2⤵
  PID:7052
- C:\Windows\System\deMnZGk.exe
  C:\Windows\System\deMnZGk.exe
  2⤵
  PID:7076
- C:\Windows\System\RaDWtpy.exe
  C:\Windows\System\RaDWtpy.exe
  2⤵
  PID:7096
- C:\Windows\System\IYjtBiV.exe
  C:\Windows\System\IYjtBiV.exe
  2⤵
  PID:7128
- C:\Windows\System\iZyNBZz.exe
  C:\Windows\System\iZyNBZz.exe
  2⤵
  PID:7148
- C:\Windows\System\efBZqZa.exe
  C:\Windows\System\efBZqZa.exe
  2⤵
  PID:5852
- C:\Windows\System\CFrhCqD.exe
  C:\Windows\System\CFrhCqD.exe
  2⤵
  PID:5828
- C:\Windows\System\TXjBouJ.exe
  C:\Windows\System\TXjBouJ.exe
  2⤵
  PID:5956
- C:\Windows\System\tcCTmUl.exe
  C:\Windows\System\tcCTmUl.exe
  2⤵
  PID:5996
- C:\Windows\System\JrMepPK.exe
  C:\Windows\System\JrMepPK.exe
  2⤵
  PID:3320
- C:\Windows\System\BXJByET.exe
  C:\Windows\System\BXJByET.exe
  2⤵
  PID:6044
- C:\Windows\System\XsbmOEW.exe
  C:\Windows\System\XsbmOEW.exe
  2⤵
  PID:6076
- C:\Windows\System\pBixSrL.exe
  C:\Windows\System\pBixSrL.exe
  2⤵
  PID:6124
- C:\Windows\System\kZNWDYD.exe
  C:\Windows\System\kZNWDYD.exe
  2⤵
  PID:5576
- C:\Windows\System\cqrqfIu.exe
  C:\Windows\System\cqrqfIu.exe
  2⤵
  PID:6344
- C:\Windows\System\EqaNXOZ.exe
  C:\Windows\System\EqaNXOZ.exe
  2⤵
  PID:6396
- C:\Windows\System\axqYYNV.exe
  C:\Windows\System\axqYYNV.exe
  2⤵
  PID:5364
- C:\Windows\System\gJqDhVs.exe
  C:\Windows\System\gJqDhVs.exe
  2⤵
  PID:5608
- C:\Windows\System\BUqyUtp.exe
  C:\Windows\System\BUqyUtp.exe
  2⤵
  PID:6504
- C:\Windows\System\ZYqJjyw.exe
  C:\Windows\System\ZYqJjyw.exe
  2⤵
  PID:6660
- C:\Windows\System\yuzalbF.exe
  C:\Windows\System\yuzalbF.exe
  2⤵
  PID:6368
- C:\Windows\System\OcUyirW.exe
  C:\Windows\System\OcUyirW.exe
  2⤵
  PID:6908
- C:\Windows\System\sQtcBSQ.exe
  C:\Windows\System\sQtcBSQ.exe
  2⤵
  PID:6552
- C:\Windows\System\EXaBBbk.exe
  C:\Windows\System\EXaBBbk.exe
  2⤵
  PID:6964
- C:\Windows\System\xwBpgLH.exe
  C:\Windows\System\xwBpgLH.exe
  2⤵
  PID:6248
- C:\Windows\System\tGRxmYa.exe
  C:\Windows\System\tGRxmYa.exe
  2⤵
  PID:6276
- C:\Windows\System\SvSXQLZ.exe
  C:\Windows\System\SvSXQLZ.exe
  2⤵
  PID:7156
- C:\Windows\System\TDwHWmF.exe
  C:\Windows\System\TDwHWmF.exe
  2⤵
  PID:5808
- C:\Windows\System\gaKpaVD.exe
  C:\Windows\System\gaKpaVD.exe
  2⤵
  PID:6016
- C:\Windows\System\TLoPIWi.exe
  C:\Windows\System\TLoPIWi.exe
  2⤵
  PID:6520
- C:\Windows\System\rNLEpAV.exe
  C:\Windows\System\rNLEpAV.exe
  2⤵
  PID:7184
- C:\Windows\System\NlcvShP.exe
  C:\Windows\System\NlcvShP.exe
  2⤵
  PID:7208
- C:\Windows\System\kRdsWSw.exe
  C:\Windows\System\kRdsWSw.exe
  2⤵
  PID:7236
- C:\Windows\System\qkSGXjz.exe
  C:\Windows\System\qkSGXjz.exe
  2⤵
  PID:7268
- C:\Windows\System\JUbaFCW.exe
  C:\Windows\System\JUbaFCW.exe
  2⤵
  PID:7292
- C:\Windows\System\lmWrQvj.exe
  C:\Windows\System\lmWrQvj.exe
  2⤵
  PID:7328
- C:\Windows\System\clqzXIp.exe
  C:\Windows\System\clqzXIp.exe
  2⤵
  PID:7352
- C:\Windows\System\tJkDmWf.exe
  C:\Windows\System\tJkDmWf.exe
  2⤵
  PID:7380
- C:\Windows\System\jQaCuau.exe
  C:\Windows\System\jQaCuau.exe
  2⤵
  PID:7404
- C:\Windows\System\jPjkHiD.exe
  C:\Windows\System\jPjkHiD.exe
  2⤵
  PID:7424
- C:\Windows\System\vZesDQW.exe
  C:\Windows\System\vZesDQW.exe
  2⤵
  PID:7444
- C:\Windows\System\hPajwdE.exe
  C:\Windows\System\hPajwdE.exe
  2⤵
  PID:7468
- C:\Windows\System\jpQhyUM.exe
  C:\Windows\System\jpQhyUM.exe
  2⤵
  PID:7496
- C:\Windows\System\HVmTyYr.exe
  C:\Windows\System\HVmTyYr.exe
  2⤵
  PID:7520
- C:\Windows\System\tCGxAxx.exe
  C:\Windows\System\tCGxAxx.exe
  2⤵
  PID:7544
- C:\Windows\System\AHnmYjl.exe
  C:\Windows\System\AHnmYjl.exe
  2⤵
  PID:7568
- C:\Windows\System\xXiUWSE.exe
  C:\Windows\System\xXiUWSE.exe
  2⤵
  PID:7588
- C:\Windows\System\WDctkCe.exe
  C:\Windows\System\WDctkCe.exe
  2⤵
  PID:7612
- C:\Windows\System\FgSLyqY.exe
  C:\Windows\System\FgSLyqY.exe
  2⤵
  PID:7640
- C:\Windows\System\WAFqSeY.exe
  C:\Windows\System\WAFqSeY.exe
  2⤵
  PID:7680
- C:\Windows\System\MkfBQcG.exe
  C:\Windows\System\MkfBQcG.exe
  2⤵
  PID:7700
- C:\Windows\System\uNuZTzu.exe
  C:\Windows\System\uNuZTzu.exe
  2⤵
  PID:7728
- C:\Windows\System\mlJrFhX.exe
  C:\Windows\System\mlJrFhX.exe
  2⤵
  PID:7752
- C:\Windows\System\Bhgdejt.exe
  C:\Windows\System\Bhgdejt.exe
  2⤵
  PID:7776
- C:\Windows\System\VWZoHJK.exe
  C:\Windows\System\VWZoHJK.exe
  2⤵
  PID:8152
- C:\Windows\System\XIgUIyu.exe
  C:\Windows\System\XIgUIyu.exe
  2⤵
  PID:6700
- C:\Windows\System\bpegGVY.exe
  C:\Windows\System\bpegGVY.exe
  2⤵
  PID:6772
- C:\Windows\System\eQbgPcY.exe
  C:\Windows\System\eQbgPcY.exe
  2⤵
  PID:7164
- C:\Windows\System\CUcfylV.exe
  C:\Windows\System\CUcfylV.exe
  2⤵
  PID:6580
- C:\Windows\System\ariHCZR.exe
  C:\Windows\System\ariHCZR.exe
  2⤵
  PID:6268
- C:\Windows\System\MzarcGg.exe
  C:\Windows\System\MzarcGg.exe
  2⤵
  PID:6320
- C:\Windows\System\AcZvhsg.exe
  C:\Windows\System\AcZvhsg.exe
  2⤵
  PID:4928
- C:\Windows\System\ZhfsmNK.exe
  C:\Windows\System\ZhfsmNK.exe
  2⤵
  PID:7104
- C:\Windows\System\bTwewiG.exe
  C:\Windows\System\bTwewiG.exe
  2⤵
  PID:2508
- C:\Windows\System\aCbLAJD.exe
  C:\Windows\System\aCbLAJD.exe
  2⤵
  PID:5884
- C:\Windows\System\lrdgcUH.exe
  C:\Windows\System\lrdgcUH.exe
  2⤵
  PID:6180
- C:\Windows\System\YXLuXtN.exe
  C:\Windows\System\YXLuXtN.exe
  2⤵
  PID:6228
- C:\Windows\System\bukqTvt.exe
  C:\Windows\System\bukqTvt.exe
  2⤵
  PID:7204
- C:\Windows\System\xywWhhH.exe
  C:\Windows\System\xywWhhH.exe
  2⤵
  PID:5488
- C:\Windows\System\TYaCTZz.exe
  C:\Windows\System\TYaCTZz.exe
  2⤵
  PID:7304
- C:\Windows\System\RsPTyyU.exe
  C:\Windows\System\RsPTyyU.exe
  2⤵
  PID:3328
- C:\Windows\System\DbTwYMP.exe
  C:\Windows\System\DbTwYMP.exe
  2⤵
  PID:6428
- C:\Windows\System\QWcttKP.exe
  C:\Windows\System\QWcttKP.exe
  2⤵
  PID:6440
- C:\Windows\System\lSfXNvN.exe
  C:\Windows\System\lSfXNvN.exe
  2⤵
  PID:7980
- C:\Windows\System\CifyIqg.exe
  C:\Windows\System\CifyIqg.exe
  2⤵
  PID:7960
- C:\Windows\System\CZIvEoK.exe
  C:\Windows\System\CZIvEoK.exe
  2⤵
  PID:7836
- C:\Windows\System\PdgYmPr.exe
  C:\Windows\System\PdgYmPr.exe
  2⤵
  PID:7676
- C:\Windows\System\fWPyizB.exe
  C:\Windows\System\fWPyizB.exe
  2⤵
  PID:7620
- C:\Windows\System\xvAvumT.exe
  C:\Windows\System\xvAvumT.exe
  2⤵
  PID:7388
- C:\Windows\System\RnfQNtf.exe
  C:\Windows\System\RnfQNtf.exe
  2⤵
  PID:7716
- C:\Windows\System\pXtZQjC.exe
  C:\Windows\System\pXtZQjC.exe
  2⤵
  PID:6768
- C:\Windows\System\shYoEzR.exe
  C:\Windows\System\shYoEzR.exe
  2⤵
  PID:5320
- C:\Windows\System\tfyzJkg.exe
  C:\Windows\System\tfyzJkg.exe
  2⤵
  PID:7740
- C:\Windows\System\UNBYGvO.exe
  C:\Windows\System\UNBYGvO.exe
  2⤵
  PID:7556
- C:\Windows\System\vEaTYsJ.exe
  C:\Windows\System\vEaTYsJ.exe
  2⤵
  PID:7300
- C:\Windows\System\qVLPnPN.exe
  C:\Windows\System\qVLPnPN.exe
  2⤵
  PID:7200
- C:\Windows\System\VYQuzYe.exe
  C:\Windows\System\VYQuzYe.exe
  2⤵
  PID:7512
- C:\Windows\System\lJHdIEF.exe
  C:\Windows\System\lJHdIEF.exe
  2⤵
  PID:2844
- C:\Windows\System\qJJuHyB.exe
  C:\Windows\System\qJJuHyB.exe
  2⤵
  PID:2712
- C:\Windows\System\okrhUDH.exe
  C:\Windows\System\okrhUDH.exe
  2⤵
  PID:7284
- C:\Windows\System\xxlzyhO.exe
  C:\Windows\System\xxlzyhO.exe
  2⤵
  PID:6272
- C:\Windows\System\KoSSSWU.exe
  C:\Windows\System\KoSSSWU.exe
  2⤵
  PID:8160
- C:\Windows\System\iTNTsyO.exe
  C:\Windows\System\iTNTsyO.exe
  2⤵
  PID:6804
- C:\Windows\System\LXIJUhF.exe
  C:\Windows\System\LXIJUhF.exe
  2⤵
  PID:6392
- C:\Windows\System\nxrnKyD.exe
  C:\Windows\System\nxrnKyD.exe
  2⤵
  PID:6644
- C:\Windows\System\YeDtsMe.exe
  C:\Windows\System\YeDtsMe.exe
  2⤵
  PID:6896
- C:\Windows\System\wxtfNvc.exe
  C:\Windows\System\wxtfNvc.exe
  2⤵
  PID:8016
- C:\Windows\System\NzmTCfW.exe
  C:\Windows\System\NzmTCfW.exe
  2⤵
  PID:7436
- C:\Windows\System\jjizXeL.exe
  C:\Windows\System\jjizXeL.exe
  2⤵
  PID:7736
- C:\Windows\System\YYTyKhF.exe
  C:\Windows\System\YYTyKhF.exe
  2⤵
  PID:8220
- C:\Windows\System\LCgnrhb.exe
  C:\Windows\System\LCgnrhb.exe
  2⤵
  PID:8252
- C:\Windows\System\RdbtnZm.exe
  C:\Windows\System\RdbtnZm.exe
  2⤵
  PID:8272
- C:\Windows\System\MMBvCwj.exe
  C:\Windows\System\MMBvCwj.exe
  2⤵
  PID:8308
- C:\Windows\System\TBCInYG.exe
  C:\Windows\System\TBCInYG.exe
  2⤵
  PID:8336
- C:\Windows\System\rHWKgYq.exe
  C:\Windows\System\rHWKgYq.exe
  2⤵
  PID:8364
- C:\Windows\System\pipOhid.exe
  C:\Windows\System\pipOhid.exe
  2⤵
  PID:8392
- C:\Windows\System\OAnRJkI.exe
  C:\Windows\System\OAnRJkI.exe
  2⤵
  PID:8416
- C:\Windows\System\IPisHzn.exe
  C:\Windows\System\IPisHzn.exe
  2⤵
  PID:8440
- C:\Windows\System\xJfIfnF.exe
  C:\Windows\System\xJfIfnF.exe
  2⤵
  PID:8472
- C:\Windows\System\oRKGdHv.exe
  C:\Windows\System\oRKGdHv.exe
  2⤵
  PID:8496
- C:\Windows\System\igzUPZy.exe
  C:\Windows\System\igzUPZy.exe
  2⤵
  PID:8520
- C:\Windows\System\NdeMwXr.exe
  C:\Windows\System\NdeMwXr.exe
  2⤵
  PID:8540
- C:\Windows\System\PBRWigZ.exe
  C:\Windows\System\PBRWigZ.exe
  2⤵
  PID:8564
- C:\Windows\System\JSCbDDt.exe
  C:\Windows\System\JSCbDDt.exe
  2⤵
  PID:8620
- C:\Windows\System\fNXvCXW.exe
  C:\Windows\System\fNXvCXW.exe
  2⤵
  PID:8648
- C:\Windows\System\JOqWjwV.exe
  C:\Windows\System\JOqWjwV.exe
  2⤵
  PID:8672
- C:\Windows\System\vvkftcV.exe
  C:\Windows\System\vvkftcV.exe
  2⤵
  PID:8696
- C:\Windows\System\pFLbgDh.exe
  C:\Windows\System\pFLbgDh.exe
  2⤵
  PID:8724
- C:\Windows\System\shSbwuY.exe
  C:\Windows\System\shSbwuY.exe
  2⤵
  PID:8744
- C:\Windows\System\gFUhnWQ.exe
  C:\Windows\System\gFUhnWQ.exe
  2⤵
  PID:8772
- C:\Windows\System\VTtUfxZ.exe
  C:\Windows\System\VTtUfxZ.exe
  2⤵
  PID:8796
- C:\Windows\System\MeSuCdb.exe
  C:\Windows\System\MeSuCdb.exe
  2⤵
  PID:8828
- C:\Windows\System\OqtuKNp.exe
  C:\Windows\System\OqtuKNp.exe
  2⤵
  PID:8860
- C:\Windows\System\jqKXWUg.exe
  C:\Windows\System\jqKXWUg.exe
  2⤵
  PID:8880
- C:\Windows\System\MFzptZe.exe
  C:\Windows\System\MFzptZe.exe
  2⤵
  PID:8896
- C:\Windows\System\SszhKcO.exe
  C:\Windows\System\SszhKcO.exe
  2⤵
  PID:8916
- C:\Windows\System\Rljqpsi.exe
  C:\Windows\System\Rljqpsi.exe
  2⤵
  PID:8944
- C:\Windows\System\jsgUtTT.exe
  C:\Windows\System\jsgUtTT.exe
  2⤵
  PID:8968
- C:\Windows\System\JhGMEHI.exe
  C:\Windows\System\JhGMEHI.exe
  2⤵
  PID:8992
- C:\Windows\System\hXcWfDY.exe
  C:\Windows\System\hXcWfDY.exe
  2⤵
  PID:9020
- C:\Windows\System\iVOApdj.exe
  C:\Windows\System\iVOApdj.exe
  2⤵
  PID:9040
- C:\Windows\System\HcNnmyN.exe
  C:\Windows\System\HcNnmyN.exe
  2⤵
  PID:9064
- C:\Windows\System\svCNmjW.exe
  C:\Windows\System\svCNmjW.exe
  2⤵
  PID:9092
- C:\Windows\System\XbBZsvj.exe
  C:\Windows\System\XbBZsvj.exe
  2⤵
  PID:9116
- C:\Windows\System\rilMhoF.exe
  C:\Windows\System\rilMhoF.exe
  2⤵
  PID:9144
- C:\Windows\System\mZSlwFW.exe
  C:\Windows\System\mZSlwFW.exe
  2⤵
  PID:9172
- C:\Windows\System\FluuYEi.exe
  C:\Windows\System\FluuYEi.exe
  2⤵
  PID:9196
- C:\Windows\System\olbsQBH.exe
  C:\Windows\System\olbsQBH.exe
  2⤵
  PID:340
- C:\Windows\System\mCsqZcb.exe
  C:\Windows\System\mCsqZcb.exe
  2⤵
  PID:7860
- C:\Windows\System\hlbYAJm.exe
  C:\Windows\System\hlbYAJm.exe
  2⤵
  PID:6020
- C:\Windows\System\tpYknZO.exe
  C:\Windows\System\tpYknZO.exe
  2⤵
  PID:7748
- C:\Windows\System\gIsFepN.exe
  C:\Windows\System\gIsFepN.exe
  2⤵
  PID:7584
- C:\Windows\System\VwBlNjS.exe
  C:\Windows\System\VwBlNjS.exe
  2⤵
  PID:6456
- C:\Windows\System\hFfRzkb.exe
  C:\Windows\System\hFfRzkb.exe
  2⤵
  PID:5736
- C:\Windows\System\auLRYJt.exe
  C:\Windows\System\auLRYJt.exe
  2⤵
  PID:8428
- C:\Windows\System\IOnBNTW.exe
  C:\Windows\System\IOnBNTW.exe
  2⤵
  PID:1392
- C:\Windows\System\fzGXeWo.exe
  C:\Windows\System\fzGXeWo.exe
  2⤵
  PID:8264
- C:\Windows\System\jmyjzZT.exe
  C:\Windows\System\jmyjzZT.exe
  2⤵
  PID:2484
- C:\Windows\System\LCCKdQX.exe
  C:\Windows\System\LCCKdQX.exe
  2⤵
  PID:8408
- C:\Windows\System\IppSRPZ.exe
  C:\Windows\System\IppSRPZ.exe
  2⤵
  PID:3288
- C:\Windows\System\BAwheIL.exe
  C:\Windows\System\BAwheIL.exe
  2⤵
  PID:8452
- C:\Windows\System\ERWwLxz.exe
  C:\Windows\System\ERWwLxz.exe
  2⤵
  PID:8720
- C:\Windows\System\AIRZmzE.exe
  C:\Windows\System\AIRZmzE.exe
  2⤵
  PID:8532
- C:\Windows\System\juDksxP.exe
  C:\Windows\System\juDksxP.exe
  2⤵
  PID:8588
- C:\Windows\System\yEoFDDx.exe
  C:\Windows\System\yEoFDDx.exe
  2⤵
  PID:2168
- C:\Windows\System\BoljlYn.exe
  C:\Windows\System\BoljlYn.exe
  2⤵
  PID:8612
- C:\Windows\System\ETNeUUY.exe
  C:\Windows\System\ETNeUUY.exe
  2⤵
  PID:2928
- C:\Windows\System\aIKjIfh.exe
  C:\Windows\System\aIKjIfh.exe
  2⤵
  PID:8688
- C:\Windows\System\iZcYmmc.exe
  C:\Windows\System\iZcYmmc.exe
  2⤵
  PID:8580
- C:\Windows\System\JrIaenN.exe
  C:\Windows\System\JrIaenN.exe
  2⤵
  PID:8836
- C:\Windows\System\RbcZYwa.exe
  C:\Windows\System\RbcZYwa.exe
  2⤵
  PID:5804
- C:\Windows\System\jFHZHpz.exe
  C:\Windows\System\jFHZHpz.exe
  2⤵
  PID:9048
- C:\Windows\System\MYtuByY.exe
  C:\Windows\System\MYtuByY.exe
  2⤵
  PID:9056
- C:\Windows\System\Uuliftt.exe
  C:\Windows\System\Uuliftt.exe
  2⤵
  PID:2132
- C:\Windows\System\vSTIqbL.exe
  C:\Windows\System\vSTIqbL.exe
  2⤵
  PID:8492
- C:\Windows\System\MDWyocK.exe
  C:\Windows\System\MDWyocK.exe
  2⤵
  PID:8872
- C:\Windows\System\UsuVsgv.exe
  C:\Windows\System\UsuVsgv.exe
  2⤵
  PID:8404
- C:\Windows\System\wytGntR.exe
  C:\Windows\System\wytGntR.exe
  2⤵
  PID:8712
- C:\Windows\System\ZUWtAcY.exe
  C:\Windows\System\ZUWtAcY.exe
  2⤵
  PID:9236
- C:\Windows\System\gQCClAh.exe
  C:\Windows\System\gQCClAh.exe
  2⤵
  PID:9260
- C:\Windows\System\vVawwwt.exe
  C:\Windows\System\vVawwwt.exe
  2⤵
  PID:9276
- C:\Windows\System\BZfOmbT.exe
  C:\Windows\System\BZfOmbT.exe
  2⤵
  PID:9304
- C:\Windows\System\NvNYfwg.exe
  C:\Windows\System\NvNYfwg.exe
  2⤵
  PID:9336
- C:\Windows\System\GHRwnEN.exe
  C:\Windows\System\GHRwnEN.exe
  2⤵
  PID:9356
- C:\Windows\System\adlAGvr.exe
  C:\Windows\System\adlAGvr.exe
  2⤵
  PID:9380
- C:\Windows\System\GEElNQh.exe
  C:\Windows\System\GEElNQh.exe
  2⤵
  PID:9404
- C:\Windows\System\zDODWeE.exe
  C:\Windows\System\zDODWeE.exe
  2⤵
  PID:9428
- C:\Windows\System\bgjQzad.exe
  C:\Windows\System\bgjQzad.exe
  2⤵
  PID:9452
- C:\Windows\System\IIKMfuz.exe
  C:\Windows\System\IIKMfuz.exe
  2⤵
  PID:9480
- C:\Windows\System\QqHAWTs.exe
  C:\Windows\System\QqHAWTs.exe
  2⤵
  PID:9504
- C:\Windows\System\jwhwEkl.exe
  C:\Windows\System\jwhwEkl.exe
  2⤵
  PID:9532
- C:\Windows\System\uvtvaXK.exe
  C:\Windows\System\uvtvaXK.exe
  2⤵
  PID:9552
- C:\Windows\System\SHNaKNd.exe
  C:\Windows\System\SHNaKNd.exe
  2⤵
  PID:9584
- C:\Windows\System\eAbBCnn.exe
  C:\Windows\System\eAbBCnn.exe
  2⤵
  PID:9604
- C:\Windows\System\cbKTYhu.exe
  C:\Windows\System\cbKTYhu.exe
  2⤵
  PID:9632
- C:\Windows\System\PTSoLDd.exe
  C:\Windows\System\PTSoLDd.exe
  2⤵
  PID:9660
- C:\Windows\System\EKBcGxa.exe
  C:\Windows\System\EKBcGxa.exe
  2⤵
  PID:9684
- C:\Windows\System\QQUzINi.exe
  C:\Windows\System\QQUzINi.exe
  2⤵
  PID:9712
- C:\Windows\System\ErOUxaA.exe
  C:\Windows\System\ErOUxaA.exe
  2⤵
  PID:9732
- C:\Windows\System\SXzuwFM.exe
  C:\Windows\System\SXzuwFM.exe
  2⤵
  PID:9760
- C:\Windows\System\IhIAdJd.exe
  C:\Windows\System\IhIAdJd.exe
  2⤵
  PID:9780
- C:\Windows\System\BLTrxzx.exe
  C:\Windows\System\BLTrxzx.exe
  2⤵
  PID:9808
- C:\Windows\System\VexjzDC.exe
  C:\Windows\System\VexjzDC.exe
  2⤵
  PID:9828
- C:\Windows\System\WHwlrIt.exe
  C:\Windows\System\WHwlrIt.exe
  2⤵
  PID:9856
- C:\Windows\System\BwwJEwB.exe
  C:\Windows\System\BwwJEwB.exe
  2⤵
  PID:9880
- C:\Windows\System\LeMtgyz.exe
  C:\Windows\System\LeMtgyz.exe
  2⤵
  PID:9904
- C:\Windows\System\jPaguet.exe
  C:\Windows\System\jPaguet.exe
  2⤵
  PID:9928
- C:\Windows\System\ZMHPhSv.exe
  C:\Windows\System\ZMHPhSv.exe
  2⤵
  PID:9956
- C:\Windows\System\GcInfXI.exe
  C:\Windows\System\GcInfXI.exe
  2⤵
  PID:9980
- C:\Windows\System\zYPBAOz.exe
  C:\Windows\System\zYPBAOz.exe
  2⤵
  PID:10008
- C:\Windows\System\gGoJrti.exe
  C:\Windows\System\gGoJrti.exe
  2⤵
  PID:10028
- C:\Windows\System\gDcDpod.exe
  C:\Windows\System\gDcDpod.exe
  2⤵
  PID:10056
- C:\Windows\System\UDgYbya.exe
  C:\Windows\System\UDgYbya.exe
  2⤵
  PID:10092
- C:\Windows\System\wpPuaAJ.exe
  C:\Windows\System\wpPuaAJ.exe
  2⤵
  PID:10116
- C:\Windows\System\vBwsvol.exe
  C:\Windows\System\vBwsvol.exe
  2⤵
  PID:10136
- C:\Windows\System\zYcaSzO.exe
  C:\Windows\System\zYcaSzO.exe
  2⤵
  PID:10180
- C:\Windows\System\qdUkdZt.exe
  C:\Windows\System\qdUkdZt.exe
  2⤵
  PID:10204
- C:\Windows\System\bNmieuP.exe
  C:\Windows\System\bNmieuP.exe
  2⤵
  PID:10232
- C:\Windows\System\xrQkkDY.exe
  C:\Windows\System\xrQkkDY.exe
  2⤵
  PID:9112
- C:\Windows\System\ByDCzYN.exe
  C:\Windows\System\ByDCzYN.exe
  2⤵
  PID:8616
- C:\Windows\System\XVlhctG.exe
  C:\Windows\System\XVlhctG.exe
  2⤵
  PID:8704
- C:\Windows\System\CfUMGxX.exe
  C:\Windows\System\CfUMGxX.exe
  2⤵
  PID:6484
- C:\Windows\System\XDvJssR.exe
  C:\Windows\System\XDvJssR.exe
  2⤵
  PID:8640
- C:\Windows\System\JZaIvOn.exe
  C:\Windows\System\JZaIvOn.exe
  2⤵
  PID:8536
- C:\Windows\System\GghpghY.exe
  C:\Windows\System\GghpghY.exe
  2⤵
  PID:9296
- C:\Windows\System\Jnddiln.exe
  C:\Windows\System\Jnddiln.exe
  2⤵
  PID:8268
- C:\Windows\System\xdobxlI.exe
  C:\Windows\System\xdobxlI.exe
  2⤵
  PID:8460
- C:\Windows\System\RbndvfH.exe
  C:\Windows\System\RbndvfH.exe
  2⤵
  PID:8820
- C:\Windows\System\ZFqShch.exe
  C:\Windows\System\ZFqShch.exe
  2⤵
  PID:9036
- C:\Windows\System\AAFkyDg.exe
  C:\Windows\System\AAFkyDg.exe
  2⤵
  PID:7176
- C:\Windows\System\OHSpWgl.exe
  C:\Windows\System\OHSpWgl.exe
  2⤵
  PID:9524
- C:\Windows\System\KkkaXhj.exe
  C:\Windows\System\KkkaXhj.exe
  2⤵
  PID:3228
- C:\Windows\System\qxBgLnp.exe
  C:\Windows\System\qxBgLnp.exe
  2⤵
  PID:9344
- C:\Windows\System\wLldNZO.exe
  C:\Windows\System\wLldNZO.exe
  2⤵
  PID:9752
- C:\Windows\System\RKiKXVg.exe
  C:\Windows\System\RKiKXVg.exe
  2⤵
  PID:9788
- C:\Windows\System\eHhwydv.exe
  C:\Windows\System\eHhwydv.exe
  2⤵
  PID:9888
- C:\Windows\System\iiesoBv.exe
  C:\Windows\System\iiesoBv.exe
  2⤵
  PID:9468
- C:\Windows\System\ofEmGyt.exe
  C:\Windows\System\ofEmGyt.exe
  2⤵
  PID:9948
- C:\Windows\System\iqzxLcn.exe
  C:\Windows\System\iqzxLcn.exe
  2⤵
  PID:9220
- C:\Windows\System\ZGktZmK.exe
  C:\Windows\System\ZGktZmK.exe
  2⤵
  PID:10020
- C:\Windows\System\pEnMlyO.exe
  C:\Windows\System\pEnMlyO.exe
  2⤵
  PID:9672
- C:\Windows\System\kQusnSm.exe
  C:\Windows\System\kQusnSm.exe
  2⤵
  PID:9744
- C:\Windows\System\RmcMGbW.exe
  C:\Windows\System\RmcMGbW.exe
  2⤵
  PID:10196
- C:\Windows\System\UmHuvAA.exe
  C:\Windows\System\UmHuvAA.exe
  2⤵
  PID:10260
- C:\Windows\System\hbDKAff.exe
  C:\Windows\System\hbDKAff.exe
  2⤵
  PID:10284
- C:\Windows\System\WPOIPpN.exe
  C:\Windows\System\WPOIPpN.exe
  2⤵
  PID:10308
- C:\Windows\System\CplAeGN.exe
  C:\Windows\System\CplAeGN.exe
  2⤵
  PID:10336
- C:\Windows\System\nUCYVwd.exe
  C:\Windows\System\nUCYVwd.exe
  2⤵
  PID:10364
- C:\Windows\System\TOcFYJH.exe
  C:\Windows\System\TOcFYJH.exe
  2⤵
  PID:10396
- C:\Windows\System\plMYpQk.exe
  C:\Windows\System\plMYpQk.exe
  2⤵
  PID:10416
- C:\Windows\System\JDbfSQk.exe
  C:\Windows\System\JDbfSQk.exe
  2⤵
  PID:10436
- C:\Windows\System\miJCpKM.exe
  C:\Windows\System\miJCpKM.exe
  2⤵
  PID:10464
- C:\Windows\System\bhVEcUp.exe
  C:\Windows\System\bhVEcUp.exe
  2⤵
  PID:10488
- C:\Windows\System\vDdeGgp.exe
  C:\Windows\System\vDdeGgp.exe
  2⤵
  PID:10508
- C:\Windows\System\slCBcpZ.exe
  C:\Windows\System\slCBcpZ.exe
  2⤵
  PID:10528
- C:\Windows\System\lLBHMKI.exe
  C:\Windows\System\lLBHMKI.exe
  2⤵
  PID:10560
- C:\Windows\System\NIUCLRp.exe
  C:\Windows\System\NIUCLRp.exe
  2⤵
  PID:10588
- C:\Windows\System\CFFIFmv.exe
  C:\Windows\System\CFFIFmv.exe
  2⤵
  PID:10604
- C:\Windows\System\GxKkFwZ.exe
  C:\Windows\System\GxKkFwZ.exe
  2⤵
  PID:10644
- C:\Windows\System\aUzjjCJ.exe
  C:\Windows\System\aUzjjCJ.exe
  2⤵
  PID:10676
- C:\Windows\System\RgJwZlh.exe
  C:\Windows\System\RgJwZlh.exe
  2⤵
  PID:10708
- C:\Windows\System\KZrInPz.exe
  C:\Windows\System\KZrInPz.exe
  2⤵
  PID:10732
- C:\Windows\System\EJtgylU.exe
  C:\Windows\System\EJtgylU.exe
  2⤵
  PID:10756
- C:\Windows\System\YTeVKYI.exe
  C:\Windows\System\YTeVKYI.exe
  2⤵
  PID:10780
- C:\Windows\System\swXEAnz.exe
  C:\Windows\System\swXEAnz.exe
  2⤵
  PID:10808
- C:\Windows\System\ubCOmfJ.exe
  C:\Windows\System\ubCOmfJ.exe
  2⤵
  PID:10832
- C:\Windows\System\QYqVCst.exe
  C:\Windows\System\QYqVCst.exe
  2⤵
  PID:10860
- C:\Windows\System\eLUcZzp.exe
  C:\Windows\System\eLUcZzp.exe
  2⤵
  PID:10888
- C:\Windows\System\bpdwqAc.exe
  C:\Windows\System\bpdwqAc.exe
  2⤵
  PID:10916
- C:\Windows\System\XvHsIUw.exe
  C:\Windows\System\XvHsIUw.exe
  2⤵
  PID:10940
- C:\Windows\System\nvrHgXa.exe
  C:\Windows\System\nvrHgXa.exe
  2⤵
  PID:10960
- C:\Windows\System\FSpwukw.exe
  C:\Windows\System\FSpwukw.exe
  2⤵
  PID:10976
- C:\Windows\System\VRfKSrT.exe
  C:\Windows\System\VRfKSrT.exe
  2⤵
  PID:10996
- C:\Windows\System\xZdTgbM.exe
  C:\Windows\System\xZdTgbM.exe
  2⤵
  PID:11016
- C:\Windows\System\pdYHaiP.exe
  C:\Windows\System\pdYHaiP.exe
  2⤵
  PID:11040
- C:\Windows\System\QtHhkpZ.exe
  C:\Windows\System\QtHhkpZ.exe
  2⤵
  PID:11060
- C:\Windows\System\LKfBdPD.exe
  C:\Windows\System\LKfBdPD.exe
  2⤵
  PID:11088
- C:\Windows\System\DwkguFD.exe
  C:\Windows\System\DwkguFD.exe
  2⤵
  PID:11112
- C:\Windows\System\phKBZJq.exe
  C:\Windows\System\phKBZJq.exe
  2⤵
  PID:11140
- C:\Windows\System\dtzqdtZ.exe
  C:\Windows\System\dtzqdtZ.exe
  2⤵
  PID:11160
- C:\Windows\System\PFncfcH.exe
  C:\Windows\System\PFncfcH.exe
  2⤵
  PID:11184
- C:\Windows\System\TrMpkEl.exe
  C:\Windows\System\TrMpkEl.exe
  2⤵
  PID:11208
- C:\Windows\System\TyMRtoh.exe
  C:\Windows\System\TyMRtoh.exe
  2⤵
  PID:11232
- C:\Windows\System\mpAgILE.exe
  C:\Windows\System\mpAgILE.exe
  2⤵
  PID:11256
- C:\Windows\System\dFKCBrR.exe
  C:\Windows\System\dFKCBrR.exe
  2⤵
  PID:9100
- C:\Windows\System\JfnQMPa.exe
  C:\Windows\System\JfnQMPa.exe
  2⤵
  PID:4888
- C:\Windows\System\sAidyvO.exe
  C:\Windows\System\sAidyvO.exe
  2⤵
  PID:9968
- C:\Windows\System\fUOgKxq.exe
  C:\Windows\System\fUOgKxq.exe
  2⤵
  PID:9160
- C:\Windows\System\DYzxQIP.exe
  C:\Windows\System\DYzxQIP.exe
  2⤵
  PID:10432
- C:\Windows\System\VWTBpMv.exe
  C:\Windows\System\VWTBpMv.exe
  2⤵
  PID:11200
- C:\Windows\System\ULObkaW.exe
  C:\Windows\System\ULObkaW.exe
  2⤵
  PID:11224
- C:\Windows\System\cXpWXgl.exe
  C:\Windows\System\cXpWXgl.exe
  2⤵
  PID:10752
- C:\Windows\System\TszOzui.exe
  C:\Windows\System\TszOzui.exe
  2⤵
  PID:10908
- C:\Windows\System\EHGdlEh.exe
  C:\Windows\System\EHGdlEh.exe
  2⤵
  PID:10968
- C:\Windows\System\luMpnhR.exe
  C:\Windows\System\luMpnhR.exe
  2⤵
  PID:9184
- C:\Windows\System\pcBxDzN.exe
  C:\Windows\System\pcBxDzN.exe
  2⤵
  PID:9268
- C:\Windows\System\uQwejiY.exe
  C:\Windows\System\uQwejiY.exe
  2⤵
  PID:10108
- C:\Windows\System\qoBmDfk.exe
  C:\Windows\System\qoBmDfk.exe
  2⤵
  PID:10376
- C:\Windows\System\rTHBzJM.exe
  C:\Windows\System\rTHBzJM.exe
  2⤵
  PID:9900
- C:\Windows\System\wQdUwaj.exe
  C:\Windows\System\wQdUwaj.exe
  2⤵
  PID:10744
- C:\Windows\System\XCPhSMn.exe
  C:\Windows\System\XCPhSMn.exe
  2⤵
  PID:10872
- C:\Windows\System\klZLCxo.exe
  C:\Windows\System\klZLCxo.exe
  2⤵
  PID:9320
- C:\Windows\System\SaNndxC.exe
  C:\Windows\System\SaNndxC.exe
  2⤵
  PID:11104
- C:\Windows\System\EnRIyEI.exe
  C:\Windows\System\EnRIyEI.exe
  2⤵
  PID:10576
- C:\Windows\System\eIhIzyg.exe
  C:\Windows\System\eIhIzyg.exe
  2⤵
  PID:11272
- C:\Windows\System\SkbPXaI.exe
  C:\Windows\System\SkbPXaI.exe
  2⤵
  PID:11296
- C:\Windows\System\nVGBzCy.exe
  C:\Windows\System\nVGBzCy.exe
  2⤵
  PID:11324
- C:\Windows\System\IbGgHae.exe
  C:\Windows\System\IbGgHae.exe
  2⤵
  PID:11348
- C:\Windows\System\CHAiMae.exe
  C:\Windows\System\CHAiMae.exe
  2⤵
  PID:11368
- C:\Windows\System\zoWmbUm.exe
  C:\Windows\System\zoWmbUm.exe
  2⤵
  PID:11396
- C:\Windows\System\OmFqTqK.exe
  C:\Windows\System\OmFqTqK.exe
  2⤵
  PID:11416
- C:\Windows\System\xybLTra.exe
  C:\Windows\System\xybLTra.exe
  2⤵
  PID:11448
- C:\Windows\System\EClLPGX.exe
  C:\Windows\System\EClLPGX.exe
  2⤵
  PID:11468
- C:\Windows\System\aEwPGUh.exe
  C:\Windows\System\aEwPGUh.exe
  2⤵
  PID:11488
- C:\Windows\System\ywDyDxN.exe
  C:\Windows\System\ywDyDxN.exe
  2⤵
  PID:11512
- C:\Windows\System\IDJVRsS.exe
  C:\Windows\System\IDJVRsS.exe
  2⤵
  PID:11540
- C:\Windows\System\doeeaWU.exe
  C:\Windows\System\doeeaWU.exe
  2⤵
  PID:11568
- C:\Windows\System\KvtNESy.exe
  C:\Windows\System\KvtNESy.exe
  2⤵
  PID:11588
- C:\Windows\System\kWxPChz.exe
  C:\Windows\System\kWxPChz.exe
  2⤵
  PID:11608
- C:\Windows\System\WMlQHZH.exe
  C:\Windows\System\WMlQHZH.exe
  2⤵
  PID:11624
- C:\Windows\System\kipyWrc.exe
  C:\Windows\System\kipyWrc.exe
  2⤵
  PID:11644
- C:\Windows\System\xHaJleQ.exe
  C:\Windows\System\xHaJleQ.exe
  2⤵
  PID:11660
- C:\Windows\System\iXqYqPh.exe
  C:\Windows\System\iXqYqPh.exe
  2⤵
  PID:11680
- C:\Windows\System\ZFJaMox.exe
  C:\Windows\System\ZFJaMox.exe
  2⤵
  PID:11696
- C:\Windows\System\XsXThsc.exe
  C:\Windows\System\XsXThsc.exe
  2⤵
  PID:11716
- C:\Windows\System\DezSFHL.exe
  C:\Windows\System\DezSFHL.exe
  2⤵
  PID:11732
- C:\Windows\System\UuSYFVA.exe
  C:\Windows\System\UuSYFVA.exe
  2⤵
  PID:11748
- C:\Windows\System\wEtnYEB.exe
  C:\Windows\System\wEtnYEB.exe
  2⤵
  PID:11776
- C:\Windows\System\YfijteE.exe
  C:\Windows\System\YfijteE.exe
  2⤵
  PID:11804
- C:\Windows\System\YRLXGXR.exe
  C:\Windows\System\YRLXGXR.exe
  2⤵
  PID:11824
- C:\Windows\System\REDZSQy.exe
  C:\Windows\System\REDZSQy.exe
  2⤵
  PID:11848
- C:\Windows\System\LqeDaXM.exe
  C:\Windows\System\LqeDaXM.exe
  2⤵
  PID:11872
- C:\Windows\System\HIdGJWg.exe
  C:\Windows\System\HIdGJWg.exe
  2⤵
  PID:11888
- C:\Windows\System\zMoTGEQ.exe
  C:\Windows\System\zMoTGEQ.exe
  2⤵
  PID:11912
- C:\Windows\System\rGdnEyO.exe
  C:\Windows\System\rGdnEyO.exe
  2⤵
  PID:11940
- C:\Windows\System\rFCQIWi.exe
  C:\Windows\System\rFCQIWi.exe
  2⤵
  PID:11960
- C:\Windows\System\wTkOHxV.exe
  C:\Windows\System\wTkOHxV.exe
  2⤵
  PID:11976
- C:\Windows\System\uLVUUHS.exe
  C:\Windows\System\uLVUUHS.exe
  2⤵
  PID:11996
- C:\Windows\System\wVXvdju.exe
  C:\Windows\System\wVXvdju.exe
  2⤵
  PID:12016
- C:\Windows\System\ECSFdsR.exe
  C:\Windows\System\ECSFdsR.exe
  2⤵
  PID:12036
- C:\Windows\System\dbKJaIB.exe
  C:\Windows\System\dbKJaIB.exe
  2⤵
  PID:12068
- C:\Windows\System\TnSPNrs.exe
  C:\Windows\System\TnSPNrs.exe
  2⤵
  PID:12092
- C:\Windows\System\kYFOloT.exe
  C:\Windows\System\kYFOloT.exe
  2⤵
  PID:12120
- C:\Windows\System\coSEpqo.exe
  C:\Windows\System\coSEpqo.exe
  2⤵
  PID:12144
- C:\Windows\System\bJQYHJs.exe
  C:\Windows\System\bJQYHJs.exe
  2⤵
  PID:12172
- C:\Windows\System\RWNufGY.exe
  C:\Windows\System\RWNufGY.exe
  2⤵
  PID:12200
- C:\Windows\System\qqshBhO.exe
  C:\Windows\System\qqshBhO.exe
  2⤵
  PID:12220
- C:\Windows\System\OYqDHkm.exe
  C:\Windows\System\OYqDHkm.exe
  2⤵
  PID:12248
- C:\Windows\System\Savuzsk.exe
  C:\Windows\System\Savuzsk.exe
  2⤵
  PID:12264
- C:\Windows\System\EHXKDGw.exe
  C:\Windows\System\EHXKDGw.exe
  2⤵
  PID:10984
- C:\Windows\System\NsJdJXf.exe
  C:\Windows\System\NsJdJXf.exe
  2⤵
  PID:9152
- C:\Windows\System\zUSjMkF.exe
  C:\Windows\System\zUSjMkF.exe
  2⤵
  PID:11216
- C:\Windows\System\xzeuGVa.exe
  C:\Windows\System\xzeuGVa.exe
  2⤵
  PID:11356
- C:\Windows\System\SLYQlkR.exe
  C:\Windows\System\SLYQlkR.exe
  2⤵
  PID:2520
- C:\Windows\System\RrDWQWY.exe
  C:\Windows\System\RrDWQWY.exe
  2⤵
  PID:11280
- C:\Windows\System\fQXoGyv.exe
  C:\Windows\System\fQXoGyv.exe
  2⤵
  PID:11536
- C:\Windows\System\iszYRCQ.exe
  C:\Windows\System\iszYRCQ.exe
  2⤵
  PID:11604
- C:\Windows\System\PGZvCPJ.exe
  C:\Windows\System\PGZvCPJ.exe
  2⤵
  PID:11756
- C:\Windows\System\zNryVEJ.exe
  C:\Windows\System\zNryVEJ.exe
  2⤵
  PID:11500
- C:\Windows\System\OrhKrAh.exe
  C:\Windows\System\OrhKrAh.exe
  2⤵
  PID:11380
- C:\Windows\System\GnpsRjT.exe
  C:\Windows\System\GnpsRjT.exe
  2⤵
  PID:11560
- C:\Windows\System\pfUTqMD.exe
  C:\Windows\System\pfUTqMD.exe
  2⤵
  PID:4448
- C:\Windows\System\HejSCxN.exe
  C:\Windows\System\HejSCxN.exe
  2⤵
  PID:11636
- C:\Windows\System\LZhgfdJ.exe
  C:\Windows\System\LZhgfdJ.exe
  2⤵
  PID:11692
- C:\Windows\System\yIPINKM.exe
  C:\Windows\System\yIPINKM.exe
  2⤵
  PID:11476
- C:\Windows\System\NZWghBi.exe
  C:\Windows\System\NZWghBi.exe
  2⤵
  PID:12100
- C:\Windows\System\qlsRatU.exe
  C:\Windows\System\qlsRatU.exe
  2⤵
  PID:12156
- C:\Windows\System\NJSEnJj.exe
  C:\Windows\System\NJSEnJj.exe
  2⤵
  PID:11596
- C:\Windows\System\vnNQvDJ.exe
  C:\Windows\System\vnNQvDJ.exe
  2⤵
  PID:11672
- C:\Windows\System\GBeewHT.exe
  C:\Windows\System\GBeewHT.exe
  2⤵
  PID:11856
- C:\Windows\System\kaDFUFn.exe
  C:\Windows\System\kaDFUFn.exe
  2⤵
  PID:10524
- C:\Windows\System\speltZD.exe
  C:\Windows\System\speltZD.exe
  2⤵
  PID:11908
- C:\Windows\System\lVkRMFv.exe
  C:\Windows\System\lVkRMFv.exe
  2⤵
  PID:11424
- C:\Windows\System\JhKektL.exe
  C:\Windows\System\JhKektL.exe
  2⤵
  PID:11948
- C:\Windows\System\yHbrGcH.exe
  C:\Windows\System\yHbrGcH.exe
  2⤵
  PID:12312
- C:\Windows\System\OeLVlub.exe
  C:\Windows\System\OeLVlub.exe
  2⤵
  PID:12336
- C:\Windows\System\ZimFsoB.exe
  C:\Windows\System\ZimFsoB.exe
  2⤵
  PID:12356
- C:\Windows\System\pwHkHnu.exe
  C:\Windows\System\pwHkHnu.exe
  2⤵
  PID:12384
- C:\Windows\System\oziPbqI.exe
  C:\Windows\System\oziPbqI.exe
  2⤵
  PID:12408
- C:\Windows\System\nQaIrjQ.exe
  C:\Windows\System\nQaIrjQ.exe
  2⤵
  PID:12432
- C:\Windows\System\ssrvkPp.exe
  C:\Windows\System\ssrvkPp.exe
  2⤵
  PID:12456
- C:\Windows\System\WaZNxeu.exe
  C:\Windows\System\WaZNxeu.exe
  2⤵
  PID:12488
- C:\Windows\System\ZiRaLOx.exe
  C:\Windows\System\ZiRaLOx.exe
  2⤵
  PID:12512
- C:\Windows\System\GfgZlPg.exe
  C:\Windows\System\GfgZlPg.exe
  2⤵
  PID:12536
- C:\Windows\System\AfbDneW.exe
  C:\Windows\System\AfbDneW.exe
  2⤵
  PID:12564
- C:\Windows\System\lmfVsNy.exe
  C:\Windows\System\lmfVsNy.exe
  2⤵
  PID:12584
- C:\Windows\System\ooVqwVT.exe
  C:\Windows\System\ooVqwVT.exe
  2⤵
  PID:12604
- C:\Windows\System\oUazzsi.exe
  C:\Windows\System\oUazzsi.exe
  2⤵
  PID:12732
- C:\Windows\System\bDLcwCE.exe
  C:\Windows\System\bDLcwCE.exe
  2⤵
  PID:13208
- C:\Windows\System\AkgWQtW.exe
  C:\Windows\System\AkgWQtW.exe
  2⤵
  PID:13240
- C:\Windows\System\yTmLkRS.exe
  C:\Windows\System\yTmLkRS.exe
  2⤵
  PID:13296
- C:\Windows\System\ynVSEAC.exe
  C:\Windows\System\ynVSEAC.exe
  2⤵
  PID:12280
- C:\Windows\System\AFrzQEM.exe
  C:\Windows\System\AFrzQEM.exe
  2⤵
  PID:12024
- C:\Windows\System\hjaFFQA.exe
  C:\Windows\System\hjaFFQA.exe
  2⤵
  PID:11480
- C:\Windows\System\ZTDfsWE.exe
  C:\Windows\System\ZTDfsWE.exe
  2⤵
  PID:12524
- C:\Windows\System\NiBMaQh.exe
  C:\Windows\System\NiBMaQh.exe
  2⤵
  PID:9944
- C:\Windows\System\MdANbxy.exe
  C:\Windows\System\MdANbxy.exe
  2⤵
  PID:11832
- C:\Windows\System\ZZqohDC.exe
  C:\Windows\System\ZZqohDC.exe
  2⤵
  PID:11928
- C:\Windows\System\hNVHNnG.exe
  C:\Windows\System\hNVHNnG.exe
  2⤵
  PID:12872
- C:\Windows\System\BaRSamn.exe
  C:\Windows\System\BaRSamn.exe
  2⤵
  PID:13036
- C:\Windows\System\HMAhvnI.exe
  C:\Windows\System\HMAhvnI.exe
  2⤵
  PID:12444
- C:\Windows\System\rEfvpwl.exe
  C:\Windows\System\rEfvpwl.exe
  2⤵
  PID:13156
- C:\Windows\System\FunfNBl.exe
  C:\Windows\System\FunfNBl.exe
  2⤵
  PID:12620
- C:\Windows\System\dCSYZGS.exe
  C:\Windows\System\dCSYZGS.exe
  2⤵
  PID:11312
- C:\Windows\System\RUDMuOd.exe
  C:\Windows\System\RUDMuOd.exe
  2⤵
  PID:12448
- C:\Windows\System\ZaRCXFP.exe
  C:\Windows\System\ZaRCXFP.exe
  2⤵
  PID:12308
- C:\Windows\System\zxeGTzC.exe
  C:\Windows\System\zxeGTzC.exe
  2⤵
  PID:13276
- C:\Windows\System\bsvvbom.exe
  C:\Windows\System\bsvvbom.exe
  2⤵
  PID:12860
- C:\Windows\System\oFEPKcy.exe
  C:\Windows\System\oFEPKcy.exe
  2⤵
  PID:4804
- C:\Windows\System\CwLPMiR.exe
  C:\Windows\System\CwLPMiR.exe
  2⤵
  PID:13292
- C:\Windows\System\MCaJdkA.exe
  C:\Windows\System\MCaJdkA.exe
  2⤵
  PID:12256
- C:\Windows\System\gLIwGde.exe
  C:\Windows\System\gLIwGde.exe
  2⤵
  PID:12944
- C:\Windows\System\qkoLsyD.exe
  C:\Windows\System\qkoLsyD.exe
  2⤵
  PID:13160
- C:\Windows\System\lQtNYHp.exe
  C:\Windows\System\lQtNYHp.exe
  2⤵
  PID:12884
- C:\Windows\System\OokSqnb.exe
  C:\Windows\System\OokSqnb.exe
  2⤵
  PID:13048
- C:\Windows\System\tlTSrAg.exe
  C:\Windows\System\tlTSrAg.exe
  2⤵
  PID:13012
- C:\Windows\System\iCoVhxr.exe
  C:\Windows\System\iCoVhxr.exe
  2⤵
  PID:13072
- C:\Windows\System\OohJqpQ.exe
  C:\Windows\System\OohJqpQ.exe
  2⤵
  PID:10080
- C:\Windows\System\RZCBCAj.exe
  C:\Windows\System\RZCBCAj.exe
  2⤵
  PID:13172
- C:\Windows\System\begMxes.exe
  C:\Windows\System\begMxes.exe
  2⤵
  PID:13100
- C:\Windows\System\RGFZtAG.exe
  C:\Windows\System\RGFZtAG.exe
  2⤵
  PID:12592
- C:\Windows\System\QiBVlAc.exe
  C:\Windows\System\QiBVlAc.exe
  2⤵
  PID:11460
- C:\Windows\System\CDpAxSp.exe
  C:\Windows\System\CDpAxSp.exe
  2⤵
  PID:11932
- C:\Windows\System\myfwPOS.exe
  C:\Windows\System\myfwPOS.exe
  2⤵
  PID:12116
- C:\Windows\System\rghlxAN.exe
  C:\Windows\System\rghlxAN.exe
  2⤵
  PID:11584
- C:\Windows\System\uYjQnhn.exe
  C:\Windows\System\uYjQnhn.exe
  2⤵
  PID:1380
- C:\Windows\System\CuKejWF.exe
  C:\Windows\System\CuKejWF.exe
  2⤵
  PID:7040
- C:\Windows\System\HJDWikX.exe
  C:\Windows\System\HJDWikX.exe
  2⤵
  PID:13228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4hl0s1kp.twp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BRUwVPH.exe

Filesize
2.9MB

MD5
1a95f933d94cb99b2c7661b742f2edf1

SHA1
326206d06bac3c17eaa79b32f3901e3e91748426

SHA256
0e2918a28e171be5104b16242008945fa44b79d23ffb9e0c7392729f11915472

SHA512
98d58f592e18e0cbf1498c04d1882f05c1b218cec18bb395253a6669d5a326feba24629b1ca2a2782e7ebeb381b20abee95c3e235d3a04e3977e14722bcb4c22

Download Submit
C:\Windows\System\CbGuLmW.exe

Filesize
2.9MB

MD5
6d6492ca747cb6fc8eda17f4cdfe6518

SHA1
5fe2296bf853de18ff601f65b29e179b03a05e11

SHA256
d018f6e581dab4de018a14ddfa5441429433fb6ecdd6918f93449064a1e7991f

SHA512
7d675fa4632811329c2b987f56857c7445351fb68db2d84237191b03effe5b54a30d7c145e0ac5e13e56bf37ffb246d27547aaea9f560ee5f5d8aecf69420cbf

Download Submit
C:\Windows\System\CgEfbMM.exe

Filesize
2.9MB

MD5
52764247d76936daa3de1a95e9abbbea

SHA1
94fa34a9a67274860ec18af8bdaef9ef34f65008

SHA256
3f34e11db8ed70ff65688a960392b9993f51f6d8314a78678647099599f99ff5

SHA512
b8df64f86d2b922d16445e9f13a1c070e65baa01b4760eddfb7e0ac0b96d7a007b1505030e417e3a3320098499b499a2ad4ef524d8525de82975da9dc5ac9385

Download Submit
C:\Windows\System\DQiryur.exe

Filesize
2.9MB

MD5
e7effa10f1ab576a415e32f02615f52f

SHA1
3b4ab875f953827d6713e945dd163a72b0585332

SHA256
5bc216f1d5b58a639fca22efde2fcc64f75dfc565c005c9aed601f2c92294060

SHA512
49926d9004390e1ae59b496dc06e27e3d10b74d70d7f672802c9aac8505fa810a10ca195ca6329727a83c8bbd5670013ec3f5474bc35bc7ad07e199f37d2c077

Download Submit
C:\Windows\System\ENuXhLI.exe

Filesize
2.9MB

MD5
e964babeb47e6c378c6753b0130ff3e9

SHA1
bc058ee8be4d6b520876efa3dc769f6e97cc362c

SHA256
79b0d46786955e31ef38841c5b4b072500d4f6c602025b47e261eefa24d8cc2e

SHA512
bf39b8de1df01196ef4d2e8784ea09e3b77a60fb69eb8736780802097f0cdefd870c86e0d1c4fdd9735ac46d390eec234f4838c6c737579e810062c1c11344ad

Download Submit
C:\Windows\System\EbrEMrT.exe

Filesize
2.9MB

MD5
6bb232274a436a36e4edf6a8a744fc68

SHA1
a998f0a70719142f501c3f4cfeb97ec3522c109a

SHA256
b3b6e6eeb0265204358ef99cd783e0760232050793f780b159f2be2cb8b9a161

SHA512
929904af438cc3679e4a5e58f8e9efaac44aa0e9f5df312c6fda4e00968fb722e95c4bd94cc76799bd2ee93c7290026cdefa575f4b859e66f5e2e8ae73302813

Download Submit
C:\Windows\System\HyIbevV.exe

Filesize
2.9MB

MD5
289e41a0e19782b48fdc8b3c5a4b8610

SHA1
854b0a55bfac95949e2f16daeb48144e4f8e017b

SHA256
5553727e054de23fdc0ec73a9bee7adac0f990bc0ee0952767649b1cacb11b61

SHA512
bd2b11d1edce49d82f40e4ea1b6ccc3cf41c52dbff4e3a60da5c2bd88ca1a3cdb03015f5c6de31fe143fc6159f892e8c88040b6cba3240d41526dd9275c41bd1

Download Submit
C:\Windows\System\KkakFqT.exe

Filesize
2.9MB

MD5
bd75b62d1892d42b00275cbb2c9bf8c5

SHA1
eaea305d681ebebf464bd4e7aa2307b75ed7fe9b

SHA256
00df253a91ed32d7e2f740b46da06aa844d4adbabbbdd1e78c10ed5ba43d72a4

SHA512
993f96b0a2f9f4b8ce3c79671cacee81281e7238de23618b9f0a1e89b0b29fed4c908742bfb0209d87194ad8e3db88cfb3ee8e2cc7a244043b2e847b43a12863

Download Submit
C:\Windows\System\NSBfusY.exe

Filesize
2.9MB

MD5
160183ff8e991b1874aa422b9bb369ed

SHA1
4bb07d8deb0c42805488e339aeba61c63ac252e8

SHA256
68b609f60b7fe2c61282676de5fd0d37936c012e75a5933c443c9bce94a61824

SHA512
3da8e634a66054f873c934aeb1854c22b66446037b6fd86880851cb99fac8759f5bd26253e52dd96435c8fecb7869318a03edb59d64e99350680239880c40703

Download Submit
C:\Windows\System\OKvIhox.exe

Filesize
2.9MB

MD5
507523fb9476146f4118170d0859706c

SHA1
3032cbd258801dd82084f7a41c6523e5dea74e14

SHA256
9ed8425754a4d497f6f987c46f563db6fdb2782557e895d7a0ebcbbeac602d1e

SHA512
d5274c8ca19458592d1cb80348557599673a08c4046d260bdd8d1692ce11c29b0dab87334fb0aedd9571cab8367432ff903eff548727fcf5f29e2ba681082589

Download Submit
C:\Windows\System\VOpHhXD.exe

Filesize
2.9MB

MD5
8366ded79c5fb10f442fdaac59178934

SHA1
00a241eda0a818a5d9392b4f3ec17c74a678d6bd

SHA256
489013247052adc57e45c731dd91dc1bc9e226276e6cf6be90d6b001da424ac1

SHA512
93b40f1b3eb214555571dd929ac12fdb80fab84e7718f005f7fd2986dc523f74345e9971bf2990afc700e72ce8fc6ad7cab36edb2a076df97375dc4cc4d3c59c

Download Submit
C:\Windows\System\YmjiAeK.exe

Filesize
2.9MB

MD5
b2116f249c2fc2e9050a67dbabb0f21e

SHA1
508aa9aedbbc837163295a928c0f307e044b50c9

SHA256
bbc65318b376a8ccedffab9e5751442e3573e7605c6dc20d03645a9198cc6ee4

SHA512
9f4ce664d92fe51b29aebe1544cb7007cf42607d326d37784fdc953286ac13826cd709d444d079921683bc500f14e0187180753f47848577fb1d06e9356d75d8

Download Submit
C:\Windows\System\adIGSjX.exe

Filesize
2.9MB

MD5
9260e4904a5024aeb29850a090d4504a

SHA1
d9fa5b4e839bd7fc2c5e47bab46a0597a50d2839

SHA256
ea17466d24fbefc5023e5a14d882a451de4df1edc2d646b044587788b737ef84

SHA512
fd49936c45ee95c9954a3855aa03700b532f2bd7cd1cf2ae6b14a1ec818bdb0def4444c9ca9ff596f95668696d22304bf333d1f0e27ba277b0c25a2ad312f2a2

Download Submit
C:\Windows\System\buEypWi.exe

Filesize
2.9MB

MD5
1dedfea38869c3bc48fabf2719abfa07

SHA1
e45024e80ae446349798ea00ef2fd13e28fc7c0c

SHA256
d71bcc3e5790f9a763ed47b5e560430accb43cc2f682e71b7e17d85788a888f8

SHA512
44a63ce65aab2bd3fb9303b8a228933c47e3cc6780ea600940831613aaae88289c9c754314c9cbe99feab12384e86c03acba9d560f2dea3e5bd93d2b9aa2ea6c

Download Submit
C:\Windows\System\equcHuW.exe

Filesize
2.9MB

MD5
8183b699b261511fb11ef3abc3e42be0

SHA1
ff69beebfd41086e1952d7e376bfa18bbaaf13c7

SHA256
b324e482ca1f939d79376cb6c4d2eb1f3d79911a9ac6abd84a7ddcdc9c0522c2

SHA512
bfb0c2b21697c7a00b99ae1ddc62eadd42c38de04a72d274aec49b4b8d91e6215d8694ab7b84ab6f7d5ec03b5b022236923541626864a0f2a9caa69eb0279b3f

Download Submit
C:\Windows\System\eyPeFCO.exe

Filesize
2.9MB

MD5
e0008e342c5a916f8c9767bc173d2f30

SHA1
e50c2c26785129e69d5dc1686179dd6625a6ce51

SHA256
1ae87916a0ea5b780a655dc8458398c80a2cd64f160e8e52dd0c99d71368cc23

SHA512
2be2fa59c048b72c2f0c9fd03e9cfc86caafa4e46f88f46a014195f3a9be60a97679b2a2413119f388e3b8fd5c77f785e49add4c0a04d8c867e1dc45b2fdca26

Download Submit
C:\Windows\System\fYNQVgC.exe

Filesize
2.9MB

MD5
4abeb994a19238cb1f07c5565981a5e0

SHA1
12d69bc32ce339d9721c23a367a01bd63f692b93

SHA256
5c76d8449fb7dfb2e1820e8f4a002342599409c0ab286a7f894fe00a3ffa0c49

SHA512
7fa6e18ebdbcf9b4245af0891cd7b482a4bddf5993906d498d16fa43e634c6c299c959809eada5be6eb6e6d4e8e34b4a4393a910b3a667bb08d1e301cfdf3446

Download Submit
C:\Windows\System\fvMVzRS.exe

Filesize
2.9MB

MD5
4850774fe519696fa761d4f7ba29731a

SHA1
40563b325c1d7503f290b6a8f3b0bb7876784d27

SHA256
1f92776b738ed2b33a06d7d31a752f485be466c793019682b85f2b96b6dc783e

SHA512
121fc697d66f35d541cce3f6d07771dfc035e2efd4882e1ea9d5144ee4322d78653c91cc618a11cb01ecd0e174c6ae6430f0684541efcc19c8db26fb4e0fd2e9

Download Submit
C:\Windows\System\gAFktki.exe

Filesize
2.9MB

MD5
2cff50d52fad6c474ee5d6e240a8a043

SHA1
25cb420b267bd410f30c801a7ae7a35344d52d1c

SHA256
e76703d1d60466ee85cbd0f6cb8c1d558bb6f11bc4e028ae6368167eeef665f9

SHA512
9cee0203f2eef82c691a70e5405acfff5ad5eb4b3f05b2f126126ef4c8d4ad0f9d6ce812ecb9694c7a5f4d57971cb64f1dc6b58079c41e6bb20bdecb1b9af495

Download Submit
C:\Windows\System\gGBRSvk.exe

Filesize
2.9MB

MD5
8e6ee4b3b0736d53694a87bb80f78b9b

SHA1
4d4f2717bf34c7b6a83269a6beae3071527d08f7

SHA256
96036437b74733e3aee62d9d385774b755b851b3bc9b17de3846f3df5199b064

SHA512
bd841da1b2580c9387ed7958eb22b1293886cf8652846511581725efe7e13c17c8c96b837774facd45d35f96fd358afecba3d94c2a3148ed7ed0cef9d00e5fac

Download Submit
C:\Windows\System\gtqWRxN.exe

Filesize
2.9MB

MD5
6b4c32ef7344a5004320fa488501bb2d

SHA1
fba08bf93d59560551f895d1c34c02bfb19d2f56

SHA256
46a725c853b8a3cac8142e1f9eeecc0d7ab45c5a11accc47109038084e8cc7e4

SHA512
a7638683895de0b0d0e89c9bc5485a998a59c4e6df5a031b4c9fa9c5f2cf3a89465d9aa46539a6395490f37aa8234dd8222c20a586e65ace00f84257c0d27758

Download Submit
C:\Windows\System\jhUGblT.exe

Filesize
2.9MB

MD5
65b595493348f8a01b266bfb9224d827

SHA1
a6b5fb4fce7611a90175f4267028be780837cdb3

SHA256
11f1f6bb472a9c7405b400da22f9b8dbd023957194f61704b347612b49bb8840

SHA512
62167bd52fb03e4cb0b5ae21e0c77bdcbbb31f9db078cfb70d24053e94c560808270eec411ae7c59b21a7c41f45158119d0a675dfceb7caed6df211a2b2a5504

Download Submit
C:\Windows\System\joYxahJ.exe

Filesize
2.9MB

MD5
dfb134e08314f6185bce32e9f2355c18

SHA1
d6e8984bc3b04a771efc563c956aac93ffd58e98

SHA256
0ad7a7284b2cfc47774fa18d91295e9779a9d85c835cccc672c3ac8d2c33d711

SHA512
f5e61e3923a30869d22d0a01093b672842a6e85db6245f5880cd420b4c4adf7c0a6f03a8fe5daa39d42257fa99a255d514cc9f3ded0b5238bbd36e03619c1eae

Download Submit
C:\Windows\System\mvyoFjW.exe

Filesize
2.9MB

MD5
6e5bd4e0277b525dd02cb1c7f2deca62

SHA1
b2cc263c7e8757d03c4f5bd15134d67f426d1a78

SHA256
154d771a7383213b0fcf9c2aaf19cdfc52e7018efd9a45cb9789ca0ffb3b5119

SHA512
f64ed563d6ebd4f12f3609b9b61c9f1db3b5e1616b5cac68d8fcf4a2576241cd0a3b2ee4cbd3dea7c26f7d05d6e228b0bff588dc7db0687af7fa7527e31dd19c

Download Submit
C:\Windows\System\nYsQNnr.exe

Filesize
2.9MB

MD5
6ab480caab9ef91c4aa517d0740ead73

SHA1
17159acada4f869e3a4f415e5bf24621c4bebc7a

SHA256
ba6e0de40bf5aec73aa4be758fea7791a98fd73b7c9900eb7df875084bbe2aba

SHA512
9cd10c4a0ccadeadcc91e4bb2fcb8c4f4724ad28f3616578dc6f493cd4755f475e6ad30d15ef477cfb8766a93b2eabaadb8da4641cf8117d372783b25a2a8f7a

Download Submit
C:\Windows\System\oDlVPFH.exe

Filesize
2.9MB

MD5
2cffeb643f2f01b7ebe9704d69b24fe8

SHA1
d012c472462627ee28e4694e1929cef2ac328c07

SHA256
27c40442a511be4adc44857730af0229aa6edfc82881d5fbe0ef52e5ecb1b658

SHA512
ed192add8e7040b8180535ea703c2385a0962271de4ab48a87c4955c5b08d38e36f39b3005aac34f7cddd1d81b9c4bebdba7f47fca2d097d58ce67ac9a4c51c6

Download Submit
C:\Windows\System\qJbJdmi.exe

Filesize
2.9MB

MD5
2711d2b0d9cd1d84ba95142178b5cffa

SHA1
f261afebd4f55c0c371dd423f9cfcafe562ae5cb

SHA256
5ec7d87997d090d6cc627b947de52e87641734d8f4604318d70ce48bfafc7e9a

SHA512
6dd1a739581eee9e2191130516a85cb1ed745a7071c669393c25be9b84b5145dcdc107d097ef97b0d7f598c8305b83560c3f4dcc0c354f71560c63b7652fb0a7

Download Submit
C:\Windows\System\uLRQZIF.exe

Filesize
2.9MB

MD5
766821981c0f557ffbd2ae580ed90cd3

SHA1
b152343321626c4da478480dfd2c2020284cfbaf

SHA256
ce4ab332bfa21a8aacb23f351e97ca43b2300a4aeea976d884db52e243949926

SHA512
6b97f219c1df57b417f53732fb9d2d9c2b80c626b689c2c38ea5992f4f0a8d821c4bda5012484c9a724f7b26f4b2f1d3ae858005cbcd40dd3378c1ebdac44d39

Download Submit
C:\Windows\System\udzydXp.exe

Filesize
2.9MB

MD5
29acd17524ba9bc77d9d745ab4c6229c

SHA1
f84bf153cad42c0a72134e6b13f71022762babc5

SHA256
a5bae5ca88b0f6d932ccf98a5ab08bcfa991f02e785d85c9999ed710c889cba0

SHA512
53ff37607a00c529257a975ddc8f365a8c7b2f1b41f6409017f96aab87687957f2f22354b6d8d830e0c5174e3940243ed9d00ac1b0bb72165591d118b65d303d

Download Submit
C:\Windows\System\vDbkTuA.exe

Filesize
2.9MB

MD5
135f3cc6d51cff80c1ddc3d3c7973442

SHA1
959aa5d571a395aa420c08ebaed92e42ccc9000e

SHA256
0a8f3d313ea10b3d80f9bf44bd6473a510d8995732d51f77dbe74b7d12076897

SHA512
f804c5d39865776ea5cfb0a96b087f66c8b47381ae124763a135028f0c7f8b4612be45b692fed53711d230dee9f4d1ed9b0eccc5b5fd070d470ef67f75b5e417

Download Submit
C:\Windows\System\vQnmgMn.exe

Filesize
2.9MB

MD5
83d70449c079054d202d1a544c0c6756

SHA1
da320709e1c80d3efbd12537bfde4725d6ee85f7

SHA256
87a39ba01b9a7dbd8674b6547eee32d663b13067cbe2ec3bbc65284df4ebcc22

SHA512
12e148c37997975bf171c0c94b7e423159ea29f4784c184c88d2cf441dab32a4d4017b954d5c06da4aa5f604261e87227e3a1b25dbe10c949897ecf9e9700ed1

Download Submit
C:\Windows\System\vRmwFVv.exe

Filesize
2.9MB

MD5
a2f7ad5d5fb31fe4407f6ddbf8477464

SHA1
ad9f6e7655bca61037e09a2c2fd2bd64a549068c

SHA256
2f85e89bf9d63d25ccfed4e3b7ef279ffde5bdc8ce59eb7d589e5a9be6bdfd66

SHA512
24212ba870c17e6c1f2dab49fa9e4c095a3352479f2464e90cdee2c3c88c316aab57995e50ebcbc16f1041df97a4e7f6a9474390f1676ccc2ed4ad6354d89798

Download Submit
C:\Windows\System\xQcRyvr.exe

Filesize
2.9MB

MD5
769317249f5a294899a0e368cc242bf9

SHA1
2a795a7ab93dd29f6eebb235e9b65dbaeea12ac7

SHA256
569c4a8a2c28763197093fbdf2e6d28aebeaaace7b2c50a58c09d076970edfb6

SHA512
85911af2cb62eb5a6786f7e2eb2def5d3011d9f05a3bb69642bad30d865cc8dbe7ee9517152d55c1181c5a19a6445595d81ec2b729a4693a48e057e7e35380f8

Download Submit
C:\Windows\System\xUUTISu.exe

Filesize
2.9MB

MD5
16514f2187f27af8bf7ad9e85d741c69

SHA1
d63f345d790c25de89531c5809a7bfaf9167a123

SHA256
f9c1cde03bb331ea24554b8ab4dd453d8dd37a3a3d4a1d732b2b133748794b64

SHA512
b08ccbc661ea23bb80c860894193456a60391784822fb1bda7ed778897280f2d1c0c76753cb75b26dd33cca357317d44cca73b0e536dfb2c63a84632cb80f40e

Download Submit
C:\Windows\System\xWgwgER.exe

Filesize
8B

MD5
f6061fc6a7c99ae821a125be5d34b682

SHA1
cd62deeb3efa237b04e342e9238578fd370ae14d

SHA256
700c9a719b011e50437e2fa1d083a87e3381f4f178b8b9f9899f4bbf7503df60

SHA512
cc6b78f85499cc18661ced0cca34cc6f25b4f82783646930e95bb966639561cabaf13feff5c13c58aa77b6804729d0ec64978f44b9a573d37b44aa1603320b3d

Download Submit
C:\Windows\System\ylvzkfg.exe

Filesize
2.9MB

MD5
f88fa2f97f0113995255f850c0c1a20c

SHA1
c951f0e19dc30c1cafd7de8370798d0d72f1a4bd

SHA256
995f48cd264ee64734dcc3da2add420b2a03574b64d055a50b97d4e7f2ecc5c5

SHA512
407ef1f147bc4ad03157e9f2a2a8420086d517989e4cbaa16e12773ba702afe0a0b32a09bae6ef5f932d14e3c450c331935bbf2a6d8d0535d078a4ed09a53699

Download Submit
C:\Windows\System\yyTaRRW.exe

Filesize
2.9MB

MD5
2708a222aafed1f4f540f6f51188ae7c

SHA1
0cca2fd59c50a1d6ae930bc616475873badb79ee

SHA256
8fea9dc40d66c0d0145b5aa607bbac226e1782fb30a75e8a925fda68ab417986

SHA512
f5e7af03c21e53084f5fe43640c8386de924b6f643d85e085dfe6873315b3d4417515812a11154facb0ee19dad79402dc0777686acfe1b03f9d9d7c106c5fd18

Download Submit
memory/388-2666-0x00007FF7617E0000-0x00007FF761BD2000-memory.dmp

Filesize
3.9MB

Download
memory/388-201-0x00007FF7617E0000-0x00007FF761BD2000-memory.dmp

Filesize
3.9MB

Download
memory/676-268-0x00007FF784F50000-0x00007FF785342000-memory.dmp

Filesize
3.9MB

Download
memory/676-2664-0x00007FF784F50000-0x00007FF785342000-memory.dmp

Filesize
3.9MB

Download
memory/1100-2678-0x00007FF7C6BE0000-0x00007FF7C6FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1100-253-0x00007FF7C6BE0000-0x00007FF7C6FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1140-2677-0x00007FF610240000-0x00007FF610632000-memory.dmp

Filesize
3.9MB

Download
memory/1140-254-0x00007FF610240000-0x00007FF610632000-memory.dmp

Filesize
3.9MB

Download
memory/1420-2682-0x00007FF7D84E0000-0x00007FF7D88D2000-memory.dmp

Filesize
3.9MB

Download
memory/1420-252-0x00007FF7D84E0000-0x00007FF7D88D2000-memory.dmp

Filesize
3.9MB

Download
memory/1452-2660-0x00007FF655A10000-0x00007FF655E02000-memory.dmp

Filesize
3.9MB

Download
memory/1452-178-0x00007FF655A10000-0x00007FF655E02000-memory.dmp

Filesize
3.9MB

Download
memory/1512-3-0x00007FFC18EE3000-0x00007FFC18EE5000-memory.dmp

Filesize
8KB

Download
memory/1512-41-0x00007FFC18EE0000-0x00007FFC199A1000-memory.dmp

Filesize
10.8MB

Download
memory/1512-276-0x00000247A1650000-0x00000247A1DF6000-memory.dmp

Filesize
7.6MB

Download
memory/1512-17-0x00000247A0940000-0x00000247A0962000-memory.dmp

Filesize
136KB

Download
memory/1512-79-0x00007FFC18EE0000-0x00007FFC199A1000-memory.dmp

Filesize
10.8MB

Download
memory/1748-101-0x00007FF6F81D0000-0x00007FF6F85C2000-memory.dmp

Filesize
3.9MB

Download
memory/1748-2644-0x00007FF6F81D0000-0x00007FF6F85C2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-267-0x00007FF737AE0000-0x00007FF737ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-2648-0x00007FF737AE0000-0x00007FF737ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-258-0x00007FF69AB70000-0x00007FF69AF62000-memory.dmp

Filesize
3.9MB

Download
memory/2224-2634-0x00007FF69AB70000-0x00007FF69AF62000-memory.dmp

Filesize
3.9MB

Download
memory/2280-92-0x00007FF629920000-0x00007FF629D12000-memory.dmp

Filesize
3.9MB

Download
memory/2280-2638-0x00007FF629920000-0x00007FF629D12000-memory.dmp

Filesize
3.9MB

Download
memory/2316-2671-0x00007FF674420000-0x00007FF674812000-memory.dmp

Filesize
3.9MB

Download
memory/2316-270-0x00007FF674420000-0x00007FF674812000-memory.dmp

Filesize
3.9MB

Download
memory/3264-2642-0x00007FF74B440000-0x00007FF74B832000-memory.dmp

Filesize
3.9MB

Download
memory/3264-113-0x00007FF74B440000-0x00007FF74B832000-memory.dmp

Filesize
3.9MB

Download
memory/3504-97-0x00007FF73EFE0000-0x00007FF73F3D2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-2640-0x00007FF73EFE0000-0x00007FF73F3D2000-memory.dmp

Filesize
3.9MB

Download
memory/3524-135-0x00007FF752AE0000-0x00007FF752ED2000-memory.dmp

Filesize
3.9MB

Download
memory/3524-2658-0x00007FF752AE0000-0x00007FF752ED2000-memory.dmp

Filesize
3.9MB

Download
memory/3768-2636-0x00007FF7C4360000-0x00007FF7C4752000-memory.dmp

Filesize
3.9MB

Download
memory/3768-98-0x00007FF7C4360000-0x00007FF7C4752000-memory.dmp

Filesize
3.9MB

Download
memory/3788-219-0x00007FF72EB40000-0x00007FF72EF32000-memory.dmp

Filesize
3.9MB

Download
memory/3788-2669-0x00007FF72EB40000-0x00007FF72EF32000-memory.dmp

Filesize
3.9MB

Download
memory/4016-102-0x00007FF6C0500000-0x00007FF6C08F2000-memory.dmp

Filesize
3.9MB

Download
memory/4016-2646-0x00007FF6C0500000-0x00007FF6C08F2000-memory.dmp

Filesize
3.9MB

Download
memory/4108-0-0x00007FF6B4510000-0x00007FF6B4902000-memory.dmp

Filesize
3.9MB

Download
memory/4108-1-0x000002931B9E0000-0x000002931B9F0000-memory.dmp

Filesize
64KB

Download
memory/4216-163-0x00007FF6B61E0000-0x00007FF6B65D2000-memory.dmp

Filesize
3.9MB

Download
memory/4216-2662-0x00007FF6B61E0000-0x00007FF6B65D2000-memory.dmp

Filesize
3.9MB

Download
memory/4396-269-0x00007FF647E30000-0x00007FF648222000-memory.dmp

Filesize
3.9MB

Download
memory/4396-2674-0x00007FF647E30000-0x00007FF648222000-memory.dmp

Filesize
3.9MB

Download
memory/4436-218-0x00007FF694D20000-0x00007FF695112000-memory.dmp

Filesize
3.9MB

Download
memory/4436-2673-0x00007FF694D20000-0x00007FF695112000-memory.dmp

Filesize
3.9MB

Download
memory/4732-2652-0x00007FF64D700000-0x00007FF64DAF2000-memory.dmp

Filesize
3.9MB

Download
memory/4732-127-0x00007FF64D700000-0x00007FF64DAF2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-194-0x00007FF67E810000-0x00007FF67EC02000-memory.dmp

Filesize
3.9MB

Download
memory/5004-2657-0x00007FF67E810000-0x00007FF67EC02000-memory.dmp

Filesize
3.9MB

Download
memory/5016-2654-0x00007FF68DA60000-0x00007FF68DE52000-memory.dmp

Filesize
3.9MB

Download
memory/5016-153-0x00007FF68DA60000-0x00007FF68DE52000-memory.dmp

Filesize
3.9MB

Download
memory/5036-2650-0x00007FF77CF30000-0x00007FF77D322000-memory.dmp

Filesize
3.9MB

Download
memory/5036-105-0x00007FF77CF30000-0x00007FF77D322000-memory.dmp

Filesize
3.9MB

Download