xmrig | a072bea941cfec5f54f6ba55bfdd4961eee39348f37781e6db69393d61651501

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93b2c0de0e2dd21beed2be603d6529f0N.exe
Size

2.0MB
MD5

93b2c0de0e2dd21beed2be603d6529f0
SHA1

efed2c0522abd24e2c90918ce7194715608fb33e
SHA256

a072bea941cfec5f54f6ba55bfdd4961eee39348f37781e6db69393d61651501
SHA512

5e57ba98241899b14114945001f026b9f03d767b217d2318ba4cc30701e4730c9a197cec4de13cc8060b78327211c251a0d4872935c70e2b80b72583b0770c11
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vbj3vrS:NABd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4868-180-0x00007FF7A8CD0000-0x00007FF7A90C2000-memory.dmp	xmrig
behavioral2/memory/716-181-0x00007FF657E70000-0x00007FF658262000-memory.dmp	xmrig
behavioral2/memory/4472-192-0x00007FF753250000-0x00007FF753642000-memory.dmp	xmrig
behavioral2/memory/2348-264-0x00007FF7DEC40000-0x00007FF7DF032000-memory.dmp	xmrig
behavioral2/memory/3332-283-0x00007FF646E80000-0x00007FF647272000-memory.dmp	xmrig
behavioral2/memory/4584-273-0x00007FF71E200000-0x00007FF71E5F2000-memory.dmp	xmrig
behavioral2/memory/1992-193-0x00007FF65FD10000-0x00007FF660102000-memory.dmp	xmrig
behavioral2/memory/4488-191-0x00007FF6BAE80000-0x00007FF6BB272000-memory.dmp	xmrig
behavioral2/memory/2328-190-0x00007FF6648D0000-0x00007FF664CC2000-memory.dmp	xmrig
behavioral2/memory/3356-189-0x00007FF734410000-0x00007FF734802000-memory.dmp	xmrig
behavioral2/memory/4048-187-0x00007FF606820000-0x00007FF606C12000-memory.dmp	xmrig
behavioral2/memory/684-185-0x00007FF732790000-0x00007FF732B82000-memory.dmp	xmrig
behavioral2/memory/968-184-0x00007FF636B90000-0x00007FF636F82000-memory.dmp	xmrig
behavioral2/memory/4924-183-0x00007FF6D4780000-0x00007FF6D4B72000-memory.dmp	xmrig
behavioral2/memory/3328-182-0x00007FF6555C0000-0x00007FF6559B2000-memory.dmp	xmrig
behavioral2/memory/2060-144-0x00007FF72BCE0000-0x00007FF72C0D2000-memory.dmp	xmrig
behavioral2/memory/3184-42-0x00007FF65DBF0000-0x00007FF65DFE2000-memory.dmp	xmrig
behavioral2/memory/4172-2591-0x00007FF7C2400000-0x00007FF7C27F2000-memory.dmp	xmrig
behavioral2/memory/3184-2592-0x00007FF65DBF0000-0x00007FF65DFE2000-memory.dmp	xmrig
behavioral2/memory/2384-2593-0x00007FF75FFE0000-0x00007FF7603D2000-memory.dmp	xmrig
behavioral2/memory/4860-2594-0x00007FF7E3D80000-0x00007FF7E4172000-memory.dmp	xmrig
behavioral2/memory/1124-2595-0x00007FF7C3740000-0x00007FF7C3B32000-memory.dmp	xmrig
behavioral2/memory/2860-2628-0x00007FF7D5BA0000-0x00007FF7D5F92000-memory.dmp	xmrig
behavioral2/memory/3952-2629-0x00007FF6C8630000-0x00007FF6C8A22000-memory.dmp	xmrig
behavioral2/memory/4472-2631-0x00007FF753250000-0x00007FF753642000-memory.dmp	xmrig
behavioral2/memory/4172-2633-0x00007FF7C2400000-0x00007FF7C27F2000-memory.dmp	xmrig
behavioral2/memory/3184-2635-0x00007FF65DBF0000-0x00007FF65DFE2000-memory.dmp	xmrig
behavioral2/memory/1992-2637-0x00007FF65FD10000-0x00007FF660102000-memory.dmp	xmrig
behavioral2/memory/2384-2641-0x00007FF75FFE0000-0x00007FF7603D2000-memory.dmp	xmrig
behavioral2/memory/1124-2640-0x00007FF7C3740000-0x00007FF7C3B32000-memory.dmp	xmrig
behavioral2/memory/2348-2643-0x00007FF7DEC40000-0x00007FF7DF032000-memory.dmp	xmrig
behavioral2/memory/2060-2651-0x00007FF72BCE0000-0x00007FF72C0D2000-memory.dmp	xmrig
behavioral2/memory/4488-2655-0x00007FF6BAE80000-0x00007FF6BB272000-memory.dmp	xmrig
behavioral2/memory/684-2653-0x00007FF732790000-0x00007FF732B82000-memory.dmp	xmrig
behavioral2/memory/4584-2648-0x00007FF71E200000-0x00007FF71E5F2000-memory.dmp	xmrig
behavioral2/memory/968-2650-0x00007FF636B90000-0x00007FF636F82000-memory.dmp	xmrig
behavioral2/memory/716-2646-0x00007FF657E70000-0x00007FF658262000-memory.dmp	xmrig
behavioral2/memory/2328-2657-0x00007FF6648D0000-0x00007FF664CC2000-memory.dmp	xmrig
behavioral2/memory/4868-2659-0x00007FF7A8CD0000-0x00007FF7A90C2000-memory.dmp	xmrig
behavioral2/memory/4924-2662-0x00007FF6D4780000-0x00007FF6D4B72000-memory.dmp	xmrig
behavioral2/memory/3356-2663-0x00007FF734410000-0x00007FF734802000-memory.dmp	xmrig
behavioral2/memory/3328-2668-0x00007FF6555C0000-0x00007FF6559B2000-memory.dmp	xmrig
behavioral2/memory/4048-2666-0x00007FF606820000-0x00007FF606C12000-memory.dmp	xmrig
behavioral2/memory/3332-2679-0x00007FF646E80000-0x00007FF647272000-memory.dmp	xmrig
behavioral2/memory/2860-2676-0x00007FF7D5BA0000-0x00007FF7D5F92000-memory.dmp	xmrig
behavioral2/memory/3952-2682-0x00007FF6C8630000-0x00007FF6C8A22000-memory.dmp	xmrig
behavioral2/memory/4860-2678-0x00007FF7E3D80000-0x00007FF7E4172000-memory.dmp	xmrig
behavioral2/memory/2392-2674-0x00007FF656510000-0x00007FF656902000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3128	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4172	XcSKpqC.exe
3184	mYSbRpO.exe
4472	HGZhYtQ.exe
1992	MNJUygA.exe
2384	FpZdtsO.exe
4860	sQXRMDO.exe
1124	DqTunnA.exe
2060	ebCQETQ.exe
2392	IXsBTLB.exe
2348	BLfEXro.exe
4868	gOGOvuK.exe
716	QJbvXYk.exe
3328	hVduzOD.exe
4924	WYOtYUc.exe
968	juczWxM.exe
684	JGfXvjS.exe
4584	iaxMtAp.exe
2860	puvPxWj.exe
4048	fcKfjut.exe
3952	mhVNxvG.exe
3356	hflGfbN.exe
2328	OgXTuEH.exe
4488	naWPEmR.exe
3332	yunLgSB.exe
4064	GiEnMvt.exe
836	kBJEYTl.exe
4836	CdHAaja.exe
1292	CshoEtN.exe
2356	PwxYvqF.exe
1388	GEriySW.exe
3224	kbyvfoY.exe
3708	dSrNsxH.exe
2744	DHJJoVA.exe
3176	UDRvAfO.exe
1012	TgZgMNu.exe
2096	OAqgsfM.exe
3880	kApTvcB.exe
3096	aFxbylH.exe
3124	JZxMYNq.exe
3728	LAImfYf.exe
3544	zzOqnYL.exe
4824	fuBrkOW.exe
2972	eqfYvWN.exe
4412	ocyfWtr.exe
1056	jaHpMNB.exe
1984	UyqrxhK.exe
1864	wKtbYvQ.exe
1644	vIZYToJ.exe
3692	ICjVhfE.exe
4144	TFntkbJ.exe
3744	VAPSVES.exe
2628	vCzfyrg.exe
4604	KJvnynb.exe
4612	xpyzkhA.exe
1356	MrRLOeH.exe
4616	LPVVdFq.exe
3272	kgaHTZk.exe
212	heUsIOF.exe
3440	DVySFYb.exe
1072	egrYPsQ.exe
3964	jNNZFNk.exe
348	uDScdJl.exe
3612	rReVTtE.exe
4384	kuMyUeP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1208-0-0x00007FF7433F0000-0x00007FF7437E2000-memory.dmp	upx
behavioral2/files/0x00080000000234d8-5.dat	upx
behavioral2/files/0x00080000000234de-11.dat	upx
behavioral2/files/0x00070000000234e5-39.dat	upx
behavioral2/files/0x00070000000234e8-115.dat	upx
behavioral2/files/0x00070000000234ee-149.dat	upx
behavioral2/memory/4868-180-0x00007FF7A8CD0000-0x00007FF7A90C2000-memory.dmp	upx
behavioral2/memory/716-181-0x00007FF657E70000-0x00007FF658262000-memory.dmp	upx
behavioral2/memory/3952-188-0x00007FF6C8630000-0x00007FF6C8A22000-memory.dmp	upx
behavioral2/memory/4472-192-0x00007FF753250000-0x00007FF753642000-memory.dmp	upx
behavioral2/files/0x00070000000234f8-197.dat	upx
behavioral2/memory/2348-264-0x00007FF7DEC40000-0x00007FF7DF032000-memory.dmp	upx
behavioral2/memory/3332-283-0x00007FF646E80000-0x00007FF647272000-memory.dmp	upx
behavioral2/memory/4584-273-0x00007FF71E200000-0x00007FF71E5F2000-memory.dmp	upx
behavioral2/files/0x0007000000023504-227.dat	upx
behavioral2/files/0x0007000000023503-225.dat	upx
behavioral2/files/0x0007000000023502-224.dat	upx
behavioral2/files/0x00070000000234f4-215.dat	upx
behavioral2/memory/2392-194-0x00007FF656510000-0x00007FF656902000-memory.dmp	upx
behavioral2/memory/1992-193-0x00007FF65FD10000-0x00007FF660102000-memory.dmp	upx
behavioral2/memory/4488-191-0x00007FF6BAE80000-0x00007FF6BB272000-memory.dmp	upx
behavioral2/memory/2328-190-0x00007FF6648D0000-0x00007FF664CC2000-memory.dmp	upx
behavioral2/memory/3356-189-0x00007FF734410000-0x00007FF734802000-memory.dmp	upx
behavioral2/memory/4048-187-0x00007FF606820000-0x00007FF606C12000-memory.dmp	upx
behavioral2/memory/2860-186-0x00007FF7D5BA0000-0x00007FF7D5F92000-memory.dmp	upx
behavioral2/memory/684-185-0x00007FF732790000-0x00007FF732B82000-memory.dmp	upx
behavioral2/memory/968-184-0x00007FF636B90000-0x00007FF636F82000-memory.dmp	upx
behavioral2/memory/4924-183-0x00007FF6D4780000-0x00007FF6D4B72000-memory.dmp	upx
behavioral2/memory/3328-182-0x00007FF6555C0000-0x00007FF6559B2000-memory.dmp	upx
behavioral2/files/0x00070000000234ff-175.dat	upx
behavioral2/files/0x00070000000234f1-172.dat	upx
behavioral2/files/0x0007000000023501-171.dat	upx
behavioral2/files/0x0007000000023500-170.dat	upx
behavioral2/files/0x00070000000234ea-160.dat	upx
behavioral2/files/0x00070000000234ef-159.dat	upx
behavioral2/files/0x00070000000234fe-158.dat	upx
behavioral2/files/0x00070000000234fd-154.dat	upx
behavioral2/files/0x00070000000234fc-153.dat	upx
behavioral2/memory/2060-144-0x00007FF72BCE0000-0x00007FF72C0D2000-memory.dmp	upx
behavioral2/files/0x00070000000234fb-143.dat	upx
behavioral2/files/0x00070000000234fa-142.dat	upx
behavioral2/files/0x00070000000234f9-141.dat	upx
behavioral2/files/0x00070000000234e3-140.dat	upx
behavioral2/files/0x00070000000234f2-135.dat	upx
behavioral2/files/0x00070000000234ec-129.dat	upx
behavioral2/files/0x00070000000234f7-128.dat	upx
behavioral2/files/0x00070000000234f6-125.dat	upx
behavioral2/files/0x00070000000234e6-124.dat	upx
behavioral2/files/0x00070000000234e9-118.dat	upx
behavioral2/files/0x00070000000234f5-117.dat	upx
behavioral2/files/0x00070000000234f3-106.dat	upx
behavioral2/files/0x00070000000234eb-97.dat	upx
behavioral2/files/0x00070000000234f0-95.dat	upx
behavioral2/files/0x00070000000234ed-85.dat	upx
behavioral2/files/0x00070000000234e7-80.dat	upx
behavioral2/memory/1124-102-0x00007FF7C3740000-0x00007FF7C3B32000-memory.dmp	upx
behavioral2/files/0x00070000000234e2-75.dat	upx
behavioral2/memory/4860-72-0x00007FF7E3D80000-0x00007FF7E4172000-memory.dmp	upx
behavioral2/files/0x00070000000234e4-77.dat	upx
behavioral2/memory/2384-51-0x00007FF75FFE0000-0x00007FF7603D2000-memory.dmp	upx
behavioral2/files/0x00070000000234e0-45.dat	upx
behavioral2/memory/3184-42-0x00007FF65DBF0000-0x00007FF65DFE2000-memory.dmp	upx
behavioral2/files/0x00070000000234e1-46.dat	upx
behavioral2/memory/4172-27-0x00007FF7C2400000-0x00007FF7C27F2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bJDjeki.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\veXILNa.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\ZVvbUEy.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\GOAiLWN.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\HnjAElY.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\zmTuQEQ.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\WQecoHe.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\SiOPTos.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\NeSeVgl.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\rSpEurO.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\ztSEeqk.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\aiaYyjh.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\GPZJTzm.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\UcCCAOk.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\roLhNwR.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\YuGcrCi.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\YXYgdxR.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\fZaHdnb.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\eqfYvWN.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\kuMyUeP.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\qqkKgle.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\mPLyOwf.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\ASqLQCe.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\JZxMYNq.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\sDWOvfP.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\EINirGx.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\MJIzSxj.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\dvsMxnG.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\tIUiYIL.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\ISUMCfC.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\IsiKqIK.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\JDroKzH.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\nVbAujb.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\chAIHIr.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\vuGpgGw.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\lSfaqRQ.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\juspLCy.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\xfefNUc.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\NotIVUc.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\HljQqJA.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\xNmOHrp.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\xiaomIg.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\ejQuFHe.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\JGfXvjS.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\VcJinsN.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\mIQSgIN.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\TMWoRRO.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\tSCFfuT.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\JjkneZI.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\RMMUpyK.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\RzOcSRw.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\cMoxxyD.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\WuONkKX.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\lClvKYs.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\IKqPZnj.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\ZWDDcwy.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\nymmNkr.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\AzfUZbR.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\kNhaLbc.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\HAKKqfB.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\VUbIOTK.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\DHJJoVA.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\eerFmTZ.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe
File created	C:\Windows\System\NeXAMxL.exe	93b2c0de0e2dd21beed2be603d6529f0N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe
Token: SeLockMemoryPrivilege	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe
Token: SeDebugPrivilege	3128	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 3128	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	86
PID 1208 wrote to memory of 3128	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	86
PID 1208 wrote to memory of 4172	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	87
PID 1208 wrote to memory of 4172	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	87
PID 1208 wrote to memory of 3184	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	88
PID 1208 wrote to memory of 3184	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	88
PID 1208 wrote to memory of 4472	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	89
PID 1208 wrote to memory of 4472	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	89
PID 1208 wrote to memory of 1992	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	90
PID 1208 wrote to memory of 1992	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	90
PID 1208 wrote to memory of 2392	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	91
PID 1208 wrote to memory of 2392	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	91
PID 1208 wrote to memory of 2384	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	92
PID 1208 wrote to memory of 2384	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	92
PID 1208 wrote to memory of 4860	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	93
PID 1208 wrote to memory of 4860	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	93
PID 1208 wrote to memory of 1124	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	94
PID 1208 wrote to memory of 1124	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	94
PID 1208 wrote to memory of 2060	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	95
PID 1208 wrote to memory of 2060	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	95
PID 1208 wrote to memory of 3328	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	96
PID 1208 wrote to memory of 3328	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	96
PID 1208 wrote to memory of 2348	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	97
PID 1208 wrote to memory of 2348	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	97
PID 1208 wrote to memory of 4868	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	98
PID 1208 wrote to memory of 4868	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	98
PID 1208 wrote to memory of 716	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	99
PID 1208 wrote to memory of 716	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	99
PID 1208 wrote to memory of 4924	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	100
PID 1208 wrote to memory of 4924	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	100
PID 1208 wrote to memory of 968	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	101
PID 1208 wrote to memory of 968	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	101
PID 1208 wrote to memory of 684	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	102
PID 1208 wrote to memory of 684	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	102
PID 1208 wrote to memory of 4584	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	103
PID 1208 wrote to memory of 4584	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	103
PID 1208 wrote to memory of 2860	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	104
PID 1208 wrote to memory of 2860	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	104
PID 1208 wrote to memory of 4048	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	105
PID 1208 wrote to memory of 4048	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	105
PID 1208 wrote to memory of 3952	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	106
PID 1208 wrote to memory of 3952	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	106
PID 1208 wrote to memory of 3356	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	107
PID 1208 wrote to memory of 3356	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	107
PID 1208 wrote to memory of 2328	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	108
PID 1208 wrote to memory of 2328	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	108
PID 1208 wrote to memory of 4488	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	109
PID 1208 wrote to memory of 4488	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	109
PID 1208 wrote to memory of 3332	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	110
PID 1208 wrote to memory of 3332	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	110
PID 1208 wrote to memory of 4064	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	111
PID 1208 wrote to memory of 4064	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	111
PID 1208 wrote to memory of 836	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	112
PID 1208 wrote to memory of 836	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	112
PID 1208 wrote to memory of 4836	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	113
PID 1208 wrote to memory of 4836	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	113
PID 1208 wrote to memory of 1292	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	114
PID 1208 wrote to memory of 1292	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	114
PID 1208 wrote to memory of 2356	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	115
PID 1208 wrote to memory of 2356	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	115
PID 1208 wrote to memory of 1388	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	116
PID 1208 wrote to memory of 1388	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	116
PID 1208 wrote to memory of 3224	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	117
PID 1208 wrote to memory of 3224	1208	93b2c0de0e2dd21beed2be603d6529f0N.exe	117

C:\Users\Admin\AppData\Local\Temp\93b2c0de0e2dd21beed2be603d6529f0N.exe
"C:\Users\Admin\AppData\Local\Temp\93b2c0de0e2dd21beed2be603d6529f0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3128
- C:\Windows\System\XcSKpqC.exe
  C:\Windows\System\XcSKpqC.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\mYSbRpO.exe
  C:\Windows\System\mYSbRpO.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\HGZhYtQ.exe
  C:\Windows\System\HGZhYtQ.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\MNJUygA.exe
  C:\Windows\System\MNJUygA.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\IXsBTLB.exe
  C:\Windows\System\IXsBTLB.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\FpZdtsO.exe
  C:\Windows\System\FpZdtsO.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\sQXRMDO.exe
  C:\Windows\System\sQXRMDO.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\DqTunnA.exe
  C:\Windows\System\DqTunnA.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\ebCQETQ.exe
  C:\Windows\System\ebCQETQ.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\hVduzOD.exe
  C:\Windows\System\hVduzOD.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\BLfEXro.exe
  C:\Windows\System\BLfEXro.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\gOGOvuK.exe
  C:\Windows\System\gOGOvuK.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\QJbvXYk.exe
  C:\Windows\System\QJbvXYk.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\WYOtYUc.exe
  C:\Windows\System\WYOtYUc.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\juczWxM.exe
  C:\Windows\System\juczWxM.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\JGfXvjS.exe
  C:\Windows\System\JGfXvjS.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\iaxMtAp.exe
  C:\Windows\System\iaxMtAp.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\puvPxWj.exe
  C:\Windows\System\puvPxWj.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\fcKfjut.exe
  C:\Windows\System\fcKfjut.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\mhVNxvG.exe
  C:\Windows\System\mhVNxvG.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\hflGfbN.exe
  C:\Windows\System\hflGfbN.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\OgXTuEH.exe
  C:\Windows\System\OgXTuEH.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\naWPEmR.exe
  C:\Windows\System\naWPEmR.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\yunLgSB.exe
  C:\Windows\System\yunLgSB.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\GiEnMvt.exe
  C:\Windows\System\GiEnMvt.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\kBJEYTl.exe
  C:\Windows\System\kBJEYTl.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\CdHAaja.exe
  C:\Windows\System\CdHAaja.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\CshoEtN.exe
  C:\Windows\System\CshoEtN.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\PwxYvqF.exe
  C:\Windows\System\PwxYvqF.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\GEriySW.exe
  C:\Windows\System\GEriySW.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\kbyvfoY.exe
  C:\Windows\System\kbyvfoY.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\dSrNsxH.exe
  C:\Windows\System\dSrNsxH.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\DHJJoVA.exe
  C:\Windows\System\DHJJoVA.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\UDRvAfO.exe
  C:\Windows\System\UDRvAfO.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\TgZgMNu.exe
  C:\Windows\System\TgZgMNu.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\OAqgsfM.exe
  C:\Windows\System\OAqgsfM.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\kApTvcB.exe
  C:\Windows\System\kApTvcB.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\aFxbylH.exe
  C:\Windows\System\aFxbylH.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\JZxMYNq.exe
  C:\Windows\System\JZxMYNq.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\LAImfYf.exe
  C:\Windows\System\LAImfYf.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\zzOqnYL.exe
  C:\Windows\System\zzOqnYL.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\fuBrkOW.exe
  C:\Windows\System\fuBrkOW.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\eqfYvWN.exe
  C:\Windows\System\eqfYvWN.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\ocyfWtr.exe
  C:\Windows\System\ocyfWtr.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\jaHpMNB.exe
  C:\Windows\System\jaHpMNB.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\UyqrxhK.exe
  C:\Windows\System\UyqrxhK.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\wKtbYvQ.exe
  C:\Windows\System\wKtbYvQ.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\vIZYToJ.exe
  C:\Windows\System\vIZYToJ.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ICjVhfE.exe
  C:\Windows\System\ICjVhfE.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\TFntkbJ.exe
  C:\Windows\System\TFntkbJ.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\VAPSVES.exe
  C:\Windows\System\VAPSVES.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\vCzfyrg.exe
  C:\Windows\System\vCzfyrg.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\KJvnynb.exe
  C:\Windows\System\KJvnynb.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\xpyzkhA.exe
  C:\Windows\System\xpyzkhA.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\MrRLOeH.exe
  C:\Windows\System\MrRLOeH.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\LPVVdFq.exe
  C:\Windows\System\LPVVdFq.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\kgaHTZk.exe
  C:\Windows\System\kgaHTZk.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\heUsIOF.exe
  C:\Windows\System\heUsIOF.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\DVySFYb.exe
  C:\Windows\System\DVySFYb.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\egrYPsQ.exe
  C:\Windows\System\egrYPsQ.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\jNNZFNk.exe
  C:\Windows\System\jNNZFNk.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\uDScdJl.exe
  C:\Windows\System\uDScdJl.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\rReVTtE.exe
  C:\Windows\System\rReVTtE.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\kuMyUeP.exe
  C:\Windows\System\kuMyUeP.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\RxYyTgF.exe
  C:\Windows\System\RxYyTgF.exe
  2⤵
  PID:1920
- C:\Windows\System\ljWklfm.exe
  C:\Windows\System\ljWklfm.exe
  2⤵
  PID:552
- C:\Windows\System\CAbpbVw.exe
  C:\Windows\System\CAbpbVw.exe
  2⤵
  PID:3784
- C:\Windows\System\JDroKzH.exe
  C:\Windows\System\JDroKzH.exe
  2⤵
  PID:4312
- C:\Windows\System\yYoJTVJ.exe
  C:\Windows\System\yYoJTVJ.exe
  2⤵
  PID:2992
- C:\Windows\System\ENEqOjq.exe
  C:\Windows\System\ENEqOjq.exe
  2⤵
  PID:2868
- C:\Windows\System\ztSEeqk.exe
  C:\Windows\System\ztSEeqk.exe
  2⤵
  PID:2524
- C:\Windows\System\VcJinsN.exe
  C:\Windows\System\VcJinsN.exe
  2⤵
  PID:556
- C:\Windows\System\zfumQze.exe
  C:\Windows\System\zfumQze.exe
  2⤵
  PID:3024
- C:\Windows\System\ZVcaUIb.exe
  C:\Windows\System\ZVcaUIb.exe
  2⤵
  PID:4544
- C:\Windows\System\pkoordR.exe
  C:\Windows\System\pkoordR.exe
  2⤵
  PID:2124
- C:\Windows\System\INVJkYA.exe
  C:\Windows\System\INVJkYA.exe
  2⤵
  PID:4908
- C:\Windows\System\qohWYaj.exe
  C:\Windows\System\qohWYaj.exe
  2⤵
  PID:232
- C:\Windows\System\XOGPKHD.exe
  C:\Windows\System\XOGPKHD.exe
  2⤵
  PID:3000
- C:\Windows\System\rkbvhzH.exe
  C:\Windows\System\rkbvhzH.exe
  2⤵
  PID:1168
- C:\Windows\System\RxixaDx.exe
  C:\Windows\System\RxixaDx.exe
  2⤵
  PID:624
- C:\Windows\System\WITivwT.exe
  C:\Windows\System\WITivwT.exe
  2⤵
  PID:2152
- C:\Windows\System\ouibYzd.exe
  C:\Windows\System\ouibYzd.exe
  2⤵
  PID:2580
- C:\Windows\System\VKVkfyh.exe
  C:\Windows\System\VKVkfyh.exe
  2⤵
  PID:5128
- C:\Windows\System\UWuFsRO.exe
  C:\Windows\System\UWuFsRO.exe
  2⤵
  PID:5144
- C:\Windows\System\zwzMtBi.exe
  C:\Windows\System\zwzMtBi.exe
  2⤵
  PID:5168
- C:\Windows\System\shGmgsa.exe
  C:\Windows\System\shGmgsa.exe
  2⤵
  PID:5192
- C:\Windows\System\KNIasPH.exe
  C:\Windows\System\KNIasPH.exe
  2⤵
  PID:5212
- C:\Windows\System\YmkpIhH.exe
  C:\Windows\System\YmkpIhH.exe
  2⤵
  PID:5232
- C:\Windows\System\ygWsBdj.exe
  C:\Windows\System\ygWsBdj.exe
  2⤵
  PID:5256
- C:\Windows\System\agEQxQE.exe
  C:\Windows\System\agEQxQE.exe
  2⤵
  PID:5276
- C:\Windows\System\cpcwLkV.exe
  C:\Windows\System\cpcwLkV.exe
  2⤵
  PID:5296
- C:\Windows\System\tlmjXKq.exe
  C:\Windows\System\tlmjXKq.exe
  2⤵
  PID:5328
- C:\Windows\System\aMJZrqG.exe
  C:\Windows\System\aMJZrqG.exe
  2⤵
  PID:5344
- C:\Windows\System\uxczKfx.exe
  C:\Windows\System\uxczKfx.exe
  2⤵
  PID:5360
- C:\Windows\System\TeKoHTu.exe
  C:\Windows\System\TeKoHTu.exe
  2⤵
  PID:5384
- C:\Windows\System\FlDoBTn.exe
  C:\Windows\System\FlDoBTn.exe
  2⤵
  PID:5404
- C:\Windows\System\IECLxgn.exe
  C:\Windows\System\IECLxgn.exe
  2⤵
  PID:5424
- C:\Windows\System\tXZUcsK.exe
  C:\Windows\System\tXZUcsK.exe
  2⤵
  PID:5444
- C:\Windows\System\VULoNzL.exe
  C:\Windows\System\VULoNzL.exe
  2⤵
  PID:5460
- C:\Windows\System\WuHuTrn.exe
  C:\Windows\System\WuHuTrn.exe
  2⤵
  PID:5484
- C:\Windows\System\XrrwCug.exe
  C:\Windows\System\XrrwCug.exe
  2⤵
  PID:5516
- C:\Windows\System\PtnHSNv.exe
  C:\Windows\System\PtnHSNv.exe
  2⤵
  PID:5540
- C:\Windows\System\pzOQImy.exe
  C:\Windows\System\pzOQImy.exe
  2⤵
  PID:5556
- C:\Windows\System\UjiaATZ.exe
  C:\Windows\System\UjiaATZ.exe
  2⤵
  PID:5588
- C:\Windows\System\RVLElzA.exe
  C:\Windows\System\RVLElzA.exe
  2⤵
  PID:5648
- C:\Windows\System\dJjEgtR.exe
  C:\Windows\System\dJjEgtR.exe
  2⤵
  PID:5688
- C:\Windows\System\YiOKyck.exe
  C:\Windows\System\YiOKyck.exe
  2⤵
  PID:5724
- C:\Windows\System\ARabdyj.exe
  C:\Windows\System\ARabdyj.exe
  2⤵
  PID:5752
- C:\Windows\System\VmIUFtV.exe
  C:\Windows\System\VmIUFtV.exe
  2⤵
  PID:5776
- C:\Windows\System\xznVIrW.exe
  C:\Windows\System\xznVIrW.exe
  2⤵
  PID:5800
- C:\Windows\System\aAANnOu.exe
  C:\Windows\System\aAANnOu.exe
  2⤵
  PID:5836
- C:\Windows\System\BTyYwAH.exe
  C:\Windows\System\BTyYwAH.exe
  2⤵
  PID:5868
- C:\Windows\System\LYByHbK.exe
  C:\Windows\System\LYByHbK.exe
  2⤵
  PID:5888
- C:\Windows\System\WuONkKX.exe
  C:\Windows\System\WuONkKX.exe
  2⤵
  PID:5912
- C:\Windows\System\CrejGbT.exe
  C:\Windows\System\CrejGbT.exe
  2⤵
  PID:5932
- C:\Windows\System\HkWqfzd.exe
  C:\Windows\System\HkWqfzd.exe
  2⤵
  PID:5968
- C:\Windows\System\lJSvXOG.exe
  C:\Windows\System\lJSvXOG.exe
  2⤵
  PID:6024
- C:\Windows\System\dHgFJiY.exe
  C:\Windows\System\dHgFJiY.exe
  2⤵
  PID:6040
- C:\Windows\System\vADjkae.exe
  C:\Windows\System\vADjkae.exe
  2⤵
  PID:6056
- C:\Windows\System\Jcebpeh.exe
  C:\Windows\System\Jcebpeh.exe
  2⤵
  PID:6072
- C:\Windows\System\kIhJCaI.exe
  C:\Windows\System\kIhJCaI.exe
  2⤵
  PID:6092
- C:\Windows\System\dcphoDj.exe
  C:\Windows\System\dcphoDj.exe
  2⤵
  PID:6108
- C:\Windows\System\PwNwsNR.exe
  C:\Windows\System\PwNwsNR.exe
  2⤵
  PID:6136
- C:\Windows\System\ivxgHog.exe
  C:\Windows\System\ivxgHog.exe
  2⤵
  PID:4900
- C:\Windows\System\CWxuhbq.exe
  C:\Windows\System\CWxuhbq.exe
  2⤵
  PID:3308
- C:\Windows\System\XWBOLGK.exe
  C:\Windows\System\XWBOLGK.exe
  2⤵
  PID:2216
- C:\Windows\System\Ekadyqm.exe
  C:\Windows\System\Ekadyqm.exe
  2⤵
  PID:4076
- C:\Windows\System\ipbXkUu.exe
  C:\Windows\System\ipbXkUu.exe
  2⤵
  PID:4328
- C:\Windows\System\gPEjUos.exe
  C:\Windows\System\gPEjUos.exe
  2⤵
  PID:5164
- C:\Windows\System\iYyNqqE.exe
  C:\Windows\System\iYyNqqE.exe
  2⤵
  PID:5228
- C:\Windows\System\stdBcKD.exe
  C:\Windows\System\stdBcKD.exe
  2⤵
  PID:5268
- C:\Windows\System\wBfiEAu.exe
  C:\Windows\System\wBfiEAu.exe
  2⤵
  PID:4972
- C:\Windows\System\TrDFlLT.exe
  C:\Windows\System\TrDFlLT.exe
  2⤵
  PID:4620
- C:\Windows\System\kuJhaoi.exe
  C:\Windows\System\kuJhaoi.exe
  2⤵
  PID:3324
- C:\Windows\System\oRsxsGa.exe
  C:\Windows\System\oRsxsGa.exe
  2⤵
  PID:1724
- C:\Windows\System\llfVdRg.exe
  C:\Windows\System\llfVdRg.exe
  2⤵
  PID:2424
- C:\Windows\System\NwshWNU.exe
  C:\Windows\System\NwshWNU.exe
  2⤵
  PID:1020
- C:\Windows\System\pzYxPXF.exe
  C:\Windows\System\pzYxPXF.exe
  2⤵
  PID:5572
- C:\Windows\System\JctoVHn.exe
  C:\Windows\System\JctoVHn.exe
  2⤵
  PID:3016
- C:\Windows\System\RAKedtS.exe
  C:\Windows\System\RAKedtS.exe
  2⤵
  PID:2836
- C:\Windows\System\MVWsRFX.exe
  C:\Windows\System\MVWsRFX.exe
  2⤵
  PID:6156
- C:\Windows\System\mdgWXtR.exe
  C:\Windows\System\mdgWXtR.exe
  2⤵
  PID:6188
- C:\Windows\System\tyZXvDK.exe
  C:\Windows\System\tyZXvDK.exe
  2⤵
  PID:6212
- C:\Windows\System\hqZqmAy.exe
  C:\Windows\System\hqZqmAy.exe
  2⤵
  PID:6260
- C:\Windows\System\HKopAOF.exe
  C:\Windows\System\HKopAOF.exe
  2⤵
  PID:6276
- C:\Windows\System\eNqLIMc.exe
  C:\Windows\System\eNqLIMc.exe
  2⤵
  PID:6304
- C:\Windows\System\tqUlZTP.exe
  C:\Windows\System\tqUlZTP.exe
  2⤵
  PID:6328
- C:\Windows\System\awgvZHL.exe
  C:\Windows\System\awgvZHL.exe
  2⤵
  PID:6352
- C:\Windows\System\YERmBlU.exe
  C:\Windows\System\YERmBlU.exe
  2⤵
  PID:6452
- C:\Windows\System\CngrFbe.exe
  C:\Windows\System\CngrFbe.exe
  2⤵
  PID:6476
- C:\Windows\System\aYTiAvF.exe
  C:\Windows\System\aYTiAvF.exe
  2⤵
  PID:6504
- C:\Windows\System\BMlgURI.exe
  C:\Windows\System\BMlgURI.exe
  2⤵
  PID:6528
- C:\Windows\System\jLGiyea.exe
  C:\Windows\System\jLGiyea.exe
  2⤵
  PID:6556
- C:\Windows\System\zFjrgvZ.exe
  C:\Windows\System\zFjrgvZ.exe
  2⤵
  PID:6584
- C:\Windows\System\yQNzcFi.exe
  C:\Windows\System\yQNzcFi.exe
  2⤵
  PID:6604
- C:\Windows\System\tqBDlVp.exe
  C:\Windows\System\tqBDlVp.exe
  2⤵
  PID:6644
- C:\Windows\System\tPVvrDg.exe
  C:\Windows\System\tPVvrDg.exe
  2⤵
  PID:6664
- C:\Windows\System\kykyqAn.exe
  C:\Windows\System\kykyqAn.exe
  2⤵
  PID:6692
- C:\Windows\System\WBYAGhw.exe
  C:\Windows\System\WBYAGhw.exe
  2⤵
  PID:6716
- C:\Windows\System\dAYfIVU.exe
  C:\Windows\System\dAYfIVU.exe
  2⤵
  PID:6736
- C:\Windows\System\lRiASqH.exe
  C:\Windows\System\lRiASqH.exe
  2⤵
  PID:6756
- C:\Windows\System\ypBkCmd.exe
  C:\Windows\System\ypBkCmd.exe
  2⤵
  PID:6784
- C:\Windows\System\GCOIumz.exe
  C:\Windows\System\GCOIumz.exe
  2⤵
  PID:6800
- C:\Windows\System\vNmPxCb.exe
  C:\Windows\System\vNmPxCb.exe
  2⤵
  PID:6824
- C:\Windows\System\OxNCukt.exe
  C:\Windows\System\OxNCukt.exe
  2⤵
  PID:6872
- C:\Windows\System\KuPMezQ.exe
  C:\Windows\System\KuPMezQ.exe
  2⤵
  PID:6888
- C:\Windows\System\XbRevqG.exe
  C:\Windows\System\XbRevqG.exe
  2⤵
  PID:6904
- C:\Windows\System\MhclCzF.exe
  C:\Windows\System\MhclCzF.exe
  2⤵
  PID:6920
- C:\Windows\System\jMyEVEY.exe
  C:\Windows\System\jMyEVEY.exe
  2⤵
  PID:6936
- C:\Windows\System\WDAxpAb.exe
  C:\Windows\System\WDAxpAb.exe
  2⤵
  PID:6952
- C:\Windows\System\JFtzKeu.exe
  C:\Windows\System\JFtzKeu.exe
  2⤵
  PID:6976
- C:\Windows\System\azVxjuP.exe
  C:\Windows\System\azVxjuP.exe
  2⤵
  PID:6992
- C:\Windows\System\TQaSfWr.exe
  C:\Windows\System\TQaSfWr.exe
  2⤵
  PID:7016
- C:\Windows\System\EFulTcn.exe
  C:\Windows\System\EFulTcn.exe
  2⤵
  PID:7040
- C:\Windows\System\CGltssW.exe
  C:\Windows\System\CGltssW.exe
  2⤵
  PID:7056
- C:\Windows\System\LYPTfqv.exe
  C:\Windows\System\LYPTfqv.exe
  2⤵
  PID:7080
- C:\Windows\System\vnBkkfI.exe
  C:\Windows\System\vnBkkfI.exe
  2⤵
  PID:7104
- C:\Windows\System\oHZxMyg.exe
  C:\Windows\System\oHZxMyg.exe
  2⤵
  PID:7124
- C:\Windows\System\udqbhqC.exe
  C:\Windows\System\udqbhqC.exe
  2⤵
  PID:7144
- C:\Windows\System\NGkjANd.exe
  C:\Windows\System\NGkjANd.exe
  2⤵
  PID:5312
- C:\Windows\System\cISTyKg.exe
  C:\Windows\System\cISTyKg.exe
  2⤵
  PID:5372
- C:\Windows\System\OVhMyuv.exe
  C:\Windows\System\OVhMyuv.exe
  2⤵
  PID:5400
- C:\Windows\System\nRkslZu.exe
  C:\Windows\System\nRkslZu.exe
  2⤵
  PID:5492
- C:\Windows\System\KUziSUb.exe
  C:\Windows\System\KUziSUb.exe
  2⤵
  PID:5580
- C:\Windows\System\iluAcmg.exe
  C:\Windows\System\iluAcmg.exe
  2⤵
  PID:5600
- C:\Windows\System\sNfKleL.exe
  C:\Windows\System\sNfKleL.exe
  2⤵
  PID:5612
- C:\Windows\System\SioVQHp.exe
  C:\Windows\System\SioVQHp.exe
  2⤵
  PID:5676
- C:\Windows\System\WXdpjDM.exe
  C:\Windows\System\WXdpjDM.exe
  2⤵
  PID:6180
- C:\Windows\System\JWiLGCp.exe
  C:\Windows\System\JWiLGCp.exe
  2⤵
  PID:5784
- C:\Windows\System\NSRaPNa.exe
  C:\Windows\System\NSRaPNa.exe
  2⤵
  PID:5824
- C:\Windows\System\SPvrZpM.exe
  C:\Windows\System\SPvrZpM.exe
  2⤵
  PID:5880
- C:\Windows\System\XaaEtuy.exe
  C:\Windows\System\XaaEtuy.exe
  2⤵
  PID:5928
- C:\Windows\System\YQbanUT.exe
  C:\Windows\System\YQbanUT.exe
  2⤵
  PID:6268
- C:\Windows\System\fzKSUyI.exe
  C:\Windows\System\fzKSUyI.exe
  2⤵
  PID:3004
- C:\Windows\System\lMgJujn.exe
  C:\Windows\System\lMgJujn.exe
  2⤵
  PID:6064
- C:\Windows\System\johtGBN.exe
  C:\Windows\System\johtGBN.exe
  2⤵
  PID:6128
- C:\Windows\System\UMbgPKb.exe
  C:\Windows\System\UMbgPKb.exe
  2⤵
  PID:2188
- C:\Windows\System\BjQNOLf.exe
  C:\Windows\System\BjQNOLf.exe
  2⤵
  PID:4776
- C:\Windows\System\ZHUrVyv.exe
  C:\Windows\System\ZHUrVyv.exe
  2⤵
  PID:5152
- C:\Windows\System\YgdRHkh.exe
  C:\Windows\System\YgdRHkh.exe
  2⤵
  PID:5264
- C:\Windows\System\MhdWUOH.exe
  C:\Windows\System\MhdWUOH.exe
  2⤵
  PID:4624
- C:\Windows\System\jZrgGzG.exe
  C:\Windows\System\jZrgGzG.exe
  2⤵
  PID:6524
- C:\Windows\System\vyyjAZM.exe
  C:\Windows\System\vyyjAZM.exe
  2⤵
  PID:3020
- C:\Windows\System\HQKlQEU.exe
  C:\Windows\System\HQKlQEU.exe
  2⤵
  PID:7208
- C:\Windows\System\RgPuzYL.exe
  C:\Windows\System\RgPuzYL.exe
  2⤵
  PID:7232
- C:\Windows\System\RdcHIZo.exe
  C:\Windows\System\RdcHIZo.exe
  2⤵
  PID:7256
- C:\Windows\System\HtRWsap.exe
  C:\Windows\System\HtRWsap.exe
  2⤵
  PID:7272
- C:\Windows\System\oboGXhx.exe
  C:\Windows\System\oboGXhx.exe
  2⤵
  PID:7304
- C:\Windows\System\qhXfZSc.exe
  C:\Windows\System\qhXfZSc.exe
  2⤵
  PID:7324
- C:\Windows\System\HPVKlqC.exe
  C:\Windows\System\HPVKlqC.exe
  2⤵
  PID:7344
- C:\Windows\System\pmLlUsL.exe
  C:\Windows\System\pmLlUsL.exe
  2⤵
  PID:7360
- C:\Windows\System\iKpnSOP.exe
  C:\Windows\System\iKpnSOP.exe
  2⤵
  PID:7376
- C:\Windows\System\UOSPWZh.exe
  C:\Windows\System\UOSPWZh.exe
  2⤵
  PID:7416
- C:\Windows\System\CVHBJsB.exe
  C:\Windows\System\CVHBJsB.exe
  2⤵
  PID:7436
- C:\Windows\System\nsVQjFj.exe
  C:\Windows\System\nsVQjFj.exe
  2⤵
  PID:7460
- C:\Windows\System\qgGROBK.exe
  C:\Windows\System\qgGROBK.exe
  2⤵
  PID:7480
- C:\Windows\System\JjkneZI.exe
  C:\Windows\System\JjkneZI.exe
  2⤵
  PID:7508
- C:\Windows\System\AxfRfdE.exe
  C:\Windows\System\AxfRfdE.exe
  2⤵
  PID:7532
- C:\Windows\System\KpOGfTV.exe
  C:\Windows\System\KpOGfTV.exe
  2⤵
  PID:7560
- C:\Windows\System\iAaRKqn.exe
  C:\Windows\System\iAaRKqn.exe
  2⤵
  PID:7576
- C:\Windows\System\qsOUNcB.exe
  C:\Windows\System\qsOUNcB.exe
  2⤵
  PID:7596
- C:\Windows\System\SAlSQPy.exe
  C:\Windows\System\SAlSQPy.exe
  2⤵
  PID:7624
- C:\Windows\System\XVxgAmK.exe
  C:\Windows\System\XVxgAmK.exe
  2⤵
  PID:7644
- C:\Windows\System\EANavXs.exe
  C:\Windows\System\EANavXs.exe
  2⤵
  PID:7668
- C:\Windows\System\MczRheS.exe
  C:\Windows\System\MczRheS.exe
  2⤵
  PID:7688
- C:\Windows\System\TSOhIoL.exe
  C:\Windows\System\TSOhIoL.exe
  2⤵
  PID:7768
- C:\Windows\System\Tvcbsik.exe
  C:\Windows\System\Tvcbsik.exe
  2⤵
  PID:7792
- C:\Windows\System\xAHBXYa.exe
  C:\Windows\System\xAHBXYa.exe
  2⤵
  PID:7832
- C:\Windows\System\smKzPnc.exe
  C:\Windows\System\smKzPnc.exe
  2⤵
  PID:7856
- C:\Windows\System\msxzdQc.exe
  C:\Windows\System\msxzdQc.exe
  2⤵
  PID:7876
- C:\Windows\System\huKheFK.exe
  C:\Windows\System\huKheFK.exe
  2⤵
  PID:7904
- C:\Windows\System\jFnkhHg.exe
  C:\Windows\System\jFnkhHg.exe
  2⤵
  PID:7924
- C:\Windows\System\rQEeNsB.exe
  C:\Windows\System\rQEeNsB.exe
  2⤵
  PID:7956
- C:\Windows\System\qkmBaga.exe
  C:\Windows\System\qkmBaga.exe
  2⤵
  PID:7980
- C:\Windows\System\VngAPNB.exe
  C:\Windows\System\VngAPNB.exe
  2⤵
  PID:8004
- C:\Windows\System\AhStwxL.exe
  C:\Windows\System\AhStwxL.exe
  2⤵
  PID:8020
- C:\Windows\System\nVbAujb.exe
  C:\Windows\System\nVbAujb.exe
  2⤵
  PID:8048
- C:\Windows\System\ornvpLM.exe
  C:\Windows\System\ornvpLM.exe
  2⤵
  PID:8064
- C:\Windows\System\UhgaxMR.exe
  C:\Windows\System\UhgaxMR.exe
  2⤵
  PID:8084
- C:\Windows\System\jDERTDV.exe
  C:\Windows\System\jDERTDV.exe
  2⤵
  PID:8108
- C:\Windows\System\wKDEMRr.exe
  C:\Windows\System\wKDEMRr.exe
  2⤵
  PID:8132
- C:\Windows\System\RttMSWS.exe
  C:\Windows\System\RttMSWS.exe
  2⤵
  PID:8156
- C:\Windows\System\yVFAgeL.exe
  C:\Windows\System\yVFAgeL.exe
  2⤵
  PID:8176
- C:\Windows\System\nknxlux.exe
  C:\Windows\System\nknxlux.exe
  2⤵
  PID:548
- C:\Windows\System\huCKBmX.exe
  C:\Windows\System\huCKBmX.exe
  2⤵
  PID:6488
- C:\Windows\System\EQouxdT.exe
  C:\Windows\System\EQouxdT.exe
  2⤵
  PID:6592
- C:\Windows\System\NHGypyS.exe
  C:\Windows\System\NHGypyS.exe
  2⤵
  PID:5976
- C:\Windows\System\lqontzy.exe
  C:\Windows\System\lqontzy.exe
  2⤵
  PID:5248
- C:\Windows\System\VvVpWdR.exe
  C:\Windows\System\VvVpWdR.exe
  2⤵
  PID:6316
- C:\Windows\System\GAMOzVp.exe
  C:\Windows\System\GAMOzVp.exe
  2⤵
  PID:6368
- C:\Windows\System\gyTGWJP.exe
  C:\Windows\System\gyTGWJP.exe
  2⤵
  PID:6464
- C:\Windows\System\gXYAKgA.exe
  C:\Windows\System\gXYAKgA.exe
  2⤵
  PID:6676
- C:\Windows\System\yZqcERz.exe
  C:\Windows\System\yZqcERz.exe
  2⤵
  PID:2352
- C:\Windows\System\UyUzzEH.exe
  C:\Windows\System\UyUzzEH.exe
  2⤵
  PID:7052
- C:\Windows\System\GczLmPS.exe
  C:\Windows\System\GczLmPS.exe
  2⤵
  PID:7088
- C:\Windows\System\IuhIfxJ.exe
  C:\Windows\System\IuhIfxJ.exe
  2⤵
  PID:7152
- C:\Windows\System\ZjQWWFD.exe
  C:\Windows\System\ZjQWWFD.exe
  2⤵
  PID:5356
- C:\Windows\System\mWrSnHO.exe
  C:\Windows\System\mWrSnHO.exe
  2⤵
  PID:5452
- C:\Windows\System\JCqYJte.exe
  C:\Windows\System\JCqYJte.exe
  2⤵
  PID:5548
- C:\Windows\System\cUtiDHt.exe
  C:\Windows\System\cUtiDHt.exe
  2⤵
  PID:5632
- C:\Windows\System\vovPvdV.exe
  C:\Windows\System\vovPvdV.exe
  2⤵
  PID:5796
- C:\Windows\System\wdNCUCg.exe
  C:\Windows\System\wdNCUCg.exe
  2⤵
  PID:5904
- C:\Windows\System\gNyTVQV.exe
  C:\Windows\System\gNyTVQV.exe
  2⤵
  PID:6048
- C:\Windows\System\LyUrPec.exe
  C:\Windows\System\LyUrPec.exe
  2⤵
  PID:6088
- C:\Windows\System\YjAIVxm.exe
  C:\Windows\System\YjAIVxm.exe
  2⤵
  PID:4692
- C:\Windows\System\VdjSufl.exe
  C:\Windows\System\VdjSufl.exe
  2⤵
  PID:7544
- C:\Windows\System\hXfCzhK.exe
  C:\Windows\System\hXfCzhK.exe
  2⤵
  PID:8204
- C:\Windows\System\qdsZzlv.exe
  C:\Windows\System\qdsZzlv.exe
  2⤵
  PID:8224
- C:\Windows\System\hbhUfUw.exe
  C:\Windows\System\hbhUfUw.exe
  2⤵
  PID:8244
- C:\Windows\System\hOeCrkH.exe
  C:\Windows\System\hOeCrkH.exe
  2⤵
  PID:8264
- C:\Windows\System\bkbSMcc.exe
  C:\Windows\System\bkbSMcc.exe
  2⤵
  PID:8284
- C:\Windows\System\bJDjeki.exe
  C:\Windows\System\bJDjeki.exe
  2⤵
  PID:8300
- C:\Windows\System\Vpdltay.exe
  C:\Windows\System\Vpdltay.exe
  2⤵
  PID:8320
- C:\Windows\System\EHZdLhC.exe
  C:\Windows\System\EHZdLhC.exe
  2⤵
  PID:8336
- C:\Windows\System\kDHmgKt.exe
  C:\Windows\System\kDHmgKt.exe
  2⤵
  PID:8356
- C:\Windows\System\bFfUtdA.exe
  C:\Windows\System\bFfUtdA.exe
  2⤵
  PID:8380
- C:\Windows\System\zzAowtk.exe
  C:\Windows\System\zzAowtk.exe
  2⤵
  PID:8432
- C:\Windows\System\qldVkkh.exe
  C:\Windows\System\qldVkkh.exe
  2⤵
  PID:8476
- C:\Windows\System\pIoToed.exe
  C:\Windows\System\pIoToed.exe
  2⤵
  PID:8516
- C:\Windows\System\BkwzFuX.exe
  C:\Windows\System\BkwzFuX.exe
  2⤵
  PID:8688
- C:\Windows\System\xzotUzf.exe
  C:\Windows\System\xzotUzf.exe
  2⤵
  PID:8708
- C:\Windows\System\ofzsQlR.exe
  C:\Windows\System\ofzsQlR.exe
  2⤵
  PID:8728
- C:\Windows\System\WZXRHFX.exe
  C:\Windows\System\WZXRHFX.exe
  2⤵
  PID:8748
- C:\Windows\System\sXWFabh.exe
  C:\Windows\System\sXWFabh.exe
  2⤵
  PID:8768
- C:\Windows\System\nIqYAuU.exe
  C:\Windows\System\nIqYAuU.exe
  2⤵
  PID:8788
- C:\Windows\System\irRwlgV.exe
  C:\Windows\System\irRwlgV.exe
  2⤵
  PID:8808
- C:\Windows\System\JyQftOx.exe
  C:\Windows\System\JyQftOx.exe
  2⤵
  PID:8828
- C:\Windows\System\WQecoHe.exe
  C:\Windows\System\WQecoHe.exe
  2⤵
  PID:8848
- C:\Windows\System\AnHpzNV.exe
  C:\Windows\System\AnHpzNV.exe
  2⤵
  PID:8864
- C:\Windows\System\quyBcnu.exe
  C:\Windows\System\quyBcnu.exe
  2⤵
  PID:8884
- C:\Windows\System\LOeejuE.exe
  C:\Windows\System\LOeejuE.exe
  2⤵
  PID:8904
- C:\Windows\System\QEqBLwy.exe
  C:\Windows\System\QEqBLwy.exe
  2⤵
  PID:8928
- C:\Windows\System\hqEIBnN.exe
  C:\Windows\System\hqEIBnN.exe
  2⤵
  PID:8944
- C:\Windows\System\nLJzLsV.exe
  C:\Windows\System\nLJzLsV.exe
  2⤵
  PID:8960
- C:\Windows\System\EXRyYzK.exe
  C:\Windows\System\EXRyYzK.exe
  2⤵
  PID:8980
- C:\Windows\System\VUlCVUQ.exe
  C:\Windows\System\VUlCVUQ.exe
  2⤵
  PID:9008
- C:\Windows\System\UYMFrjh.exe
  C:\Windows\System\UYMFrjh.exe
  2⤵
  PID:9036
- C:\Windows\System\tDImZZs.exe
  C:\Windows\System\tDImZZs.exe
  2⤵
  PID:9056
- C:\Windows\System\MjLhtwr.exe
  C:\Windows\System\MjLhtwr.exe
  2⤵
  PID:9072
- C:\Windows\System\IYcakWn.exe
  C:\Windows\System\IYcakWn.exe
  2⤵
  PID:9108
- C:\Windows\System\fVhRaxl.exe
  C:\Windows\System\fVhRaxl.exe
  2⤵
  PID:9124
- C:\Windows\System\hiizyqZ.exe
  C:\Windows\System\hiizyqZ.exe
  2⤵
  PID:9184
- C:\Windows\System\KVlBtzs.exe
  C:\Windows\System\KVlBtzs.exe
  2⤵
  PID:9212
- C:\Windows\System\nlFboyl.exe
  C:\Windows\System\nlFboyl.exe
  2⤵
  PID:7220
- C:\Windows\System\GOAiLWN.exe
  C:\Windows\System\GOAiLWN.exe
  2⤵
  PID:7264
- C:\Windows\System\dvQrBbb.exe
  C:\Windows\System\dvQrBbb.exe
  2⤵
  PID:7320
- C:\Windows\System\wYNkRWK.exe
  C:\Windows\System\wYNkRWK.exe
  2⤵
  PID:7368
- C:\Windows\System\uHxyEea.exe
  C:\Windows\System\uHxyEea.exe
  2⤵
  PID:7444
- C:\Windows\System\aiaYyjh.exe
  C:\Windows\System\aiaYyjh.exe
  2⤵
  PID:7584
- C:\Windows\System\gokRUyT.exe
  C:\Windows\System\gokRUyT.exe
  2⤵
  PID:7612
- C:\Windows\System\PqrHdbS.exe
  C:\Windows\System\PqrHdbS.exe
  2⤵
  PID:8256
- C:\Windows\System\gDhlsmw.exe
  C:\Windows\System\gDhlsmw.exe
  2⤵
  PID:6124
- C:\Windows\System\hqiECqu.exe
  C:\Windows\System\hqiECqu.exe
  2⤵
  PID:7072
- C:\Windows\System\EWaeKhN.exe
  C:\Windows\System\EWaeKhN.exe
  2⤵
  PID:8312
- C:\Windows\System\JFSPYMk.exe
  C:\Windows\System\JFSPYMk.exe
  2⤵
  PID:8344
- C:\Windows\System\nQQZIcV.exe
  C:\Windows\System\nQQZIcV.exe
  2⤵
  PID:8528
- C:\Windows\System\WujssmT.exe
  C:\Windows\System\WujssmT.exe
  2⤵
  PID:9240
- C:\Windows\System\cbRaGwE.exe
  C:\Windows\System\cbRaGwE.exe
  2⤵
  PID:9260
- C:\Windows\System\qtEkDUV.exe
  C:\Windows\System\qtEkDUV.exe
  2⤵
  PID:9284
- C:\Windows\System\TJcsGpy.exe
  C:\Windows\System\TJcsGpy.exe
  2⤵
  PID:9308
- C:\Windows\System\smmUASi.exe
  C:\Windows\System\smmUASi.exe
  2⤵
  PID:9336
- C:\Windows\System\lnjWfkS.exe
  C:\Windows\System\lnjWfkS.exe
  2⤵
  PID:9356
- C:\Windows\System\QjpDVoj.exe
  C:\Windows\System\QjpDVoj.exe
  2⤵
  PID:9372
- C:\Windows\System\GMHILYU.exe
  C:\Windows\System\GMHILYU.exe
  2⤵
  PID:9416
- C:\Windows\System\xvzeYZx.exe
  C:\Windows\System\xvzeYZx.exe
  2⤵
  PID:9432
- C:\Windows\System\TsZWSzw.exe
  C:\Windows\System\TsZWSzw.exe
  2⤵
  PID:9452
- C:\Windows\System\coTJZpk.exe
  C:\Windows\System\coTJZpk.exe
  2⤵
  PID:9480
- C:\Windows\System\xGiVjiO.exe
  C:\Windows\System\xGiVjiO.exe
  2⤵
  PID:9500
- C:\Windows\System\pGYQGrc.exe
  C:\Windows\System\pGYQGrc.exe
  2⤵
  PID:9520
- C:\Windows\System\mTXwIIF.exe
  C:\Windows\System\mTXwIIF.exe
  2⤵
  PID:9540
- C:\Windows\System\uDgZkQf.exe
  C:\Windows\System\uDgZkQf.exe
  2⤵
  PID:9564
- C:\Windows\System\KyMfMGB.exe
  C:\Windows\System\KyMfMGB.exe
  2⤵
  PID:9584
- C:\Windows\System\wMbxYkv.exe
  C:\Windows\System\wMbxYkv.exe
  2⤵
  PID:9608
- C:\Windows\System\DfPqKFm.exe
  C:\Windows\System\DfPqKFm.exe
  2⤵
  PID:9660
- C:\Windows\System\Qsgkgtg.exe
  C:\Windows\System\Qsgkgtg.exe
  2⤵
  PID:9692
- C:\Windows\System\EDCzZSC.exe
  C:\Windows\System\EDCzZSC.exe
  2⤵
  PID:9720
- C:\Windows\System\amwuAow.exe
  C:\Windows\System\amwuAow.exe
  2⤵
  PID:9736
- C:\Windows\System\chAIHIr.exe
  C:\Windows\System\chAIHIr.exe
  2⤵
  PID:9760
- C:\Windows\System\OAyJCtl.exe
  C:\Windows\System\OAyJCtl.exe
  2⤵
  PID:9784
- C:\Windows\System\JgwTcdc.exe
  C:\Windows\System\JgwTcdc.exe
  2⤵
  PID:9804
- C:\Windows\System\WumofWs.exe
  C:\Windows\System\WumofWs.exe
  2⤵
  PID:9852
- C:\Windows\System\AxlbOjd.exe
  C:\Windows\System\AxlbOjd.exe
  2⤵
  PID:9872
- C:\Windows\System\wNeFNdH.exe
  C:\Windows\System\wNeFNdH.exe
  2⤵
  PID:9892
- C:\Windows\System\bOxshHK.exe
  C:\Windows\System\bOxshHK.exe
  2⤵
  PID:9908
- C:\Windows\System\lXXQaES.exe
  C:\Windows\System\lXXQaES.exe
  2⤵
  PID:9924
- C:\Windows\System\edLWiRR.exe
  C:\Windows\System\edLWiRR.exe
  2⤵
  PID:9940
- C:\Windows\System\YfNMkQS.exe
  C:\Windows\System\YfNMkQS.exe
  2⤵
  PID:9956
- C:\Windows\System\wvvCqun.exe
  C:\Windows\System\wvvCqun.exe
  2⤵
  PID:9972
- C:\Windows\System\HnjAElY.exe
  C:\Windows\System\HnjAElY.exe
  2⤵
  PID:10004
- C:\Windows\System\DyvQZog.exe
  C:\Windows\System\DyvQZog.exe
  2⤵
  PID:10036
- C:\Windows\System\UvYjVoT.exe
  C:\Windows\System\UvYjVoT.exe
  2⤵
  PID:10052
- C:\Windows\System\XybWyzC.exe
  C:\Windows\System\XybWyzC.exe
  2⤵
  PID:10080
- C:\Windows\System\RSZGpDd.exe
  C:\Windows\System\RSZGpDd.exe
  2⤵
  PID:10096
- C:\Windows\System\ooTIoCL.exe
  C:\Windows\System\ooTIoCL.exe
  2⤵
  PID:10120
- C:\Windows\System\WIFhAPG.exe
  C:\Windows\System\WIFhAPG.exe
  2⤵
  PID:10144
- C:\Windows\System\wRAWbyB.exe
  C:\Windows\System\wRAWbyB.exe
  2⤵
  PID:10164
- C:\Windows\System\tgWwgfp.exe
  C:\Windows\System\tgWwgfp.exe
  2⤵
  PID:10188
- C:\Windows\System\VKAFUym.exe
  C:\Windows\System\VKAFUym.exe
  2⤵
  PID:10212
- C:\Windows\System\xcXRAPq.exe
  C:\Windows\System\xcXRAPq.exe
  2⤵
  PID:10236
- C:\Windows\System\KifcOKC.exe
  C:\Windows\System\KifcOKC.exe
  2⤵
  PID:7776
- C:\Windows\System\FtiexwO.exe
  C:\Windows\System\FtiexwO.exe
  2⤵
  PID:7820
- C:\Windows\System\sBlZxSc.exe
  C:\Windows\System\sBlZxSc.exe
  2⤵
  PID:7884
- C:\Windows\System\HLzVUBP.exe
  C:\Windows\System\HLzVUBP.exe
  2⤵
  PID:7936
- C:\Windows\System\MTdxHVI.exe
  C:\Windows\System\MTdxHVI.exe
  2⤵
  PID:7992
- C:\Windows\System\yTvHPwJ.exe
  C:\Windows\System\yTvHPwJ.exe
  2⤵
  PID:8036
- C:\Windows\System\XpwMvmC.exe
  C:\Windows\System\XpwMvmC.exe
  2⤵
  PID:8080
- C:\Windows\System\FRUGMVg.exe
  C:\Windows\System\FRUGMVg.exe
  2⤵
  PID:8140
- C:\Windows\System\uyiliZo.exe
  C:\Windows\System\uyiliZo.exe
  2⤵
  PID:8184
- C:\Windows\System\JDCpWts.exe
  C:\Windows\System\JDCpWts.exe
  2⤵
  PID:6204
- C:\Windows\System\AeElRUm.exe
  C:\Windows\System\AeElRUm.exe
  2⤵
  PID:5124
- C:\Windows\System\CyIjLbv.exe
  C:\Windows\System\CyIjLbv.exe
  2⤵
  PID:5188
- C:\Windows\System\LvFLSgD.exe
  C:\Windows\System\LvFLSgD.exe
  2⤵
  PID:8296
- C:\Windows\System\qlmfPkZ.exe
  C:\Windows\System\qlmfPkZ.exe
  2⤵
  PID:8876
- C:\Windows\System\gIzVyKq.exe
  C:\Windows\System\gIzVyKq.exe
  2⤵
  PID:8940
- C:\Windows\System\HJaNLdr.exe
  C:\Windows\System\HJaNLdr.exe
  2⤵
  PID:9024
- C:\Windows\System\KCnWguY.exe
  C:\Windows\System\KCnWguY.exe
  2⤵
  PID:9068
- C:\Windows\System\upaoqGT.exe
  C:\Windows\System\upaoqGT.exe
  2⤵
  PID:7488
- C:\Windows\System\MjgmHlo.exe
  C:\Windows\System\MjgmHlo.exe
  2⤵
  PID:7312
- C:\Windows\System\JHSDsLy.exe
  C:\Windows\System\JHSDsLy.exe
  2⤵
  PID:7428
- C:\Windows\System\DuOjdSF.exe
  C:\Windows\System\DuOjdSF.exe
  2⤵
  PID:7632
- C:\Windows\System\KSUYwbx.exe
  C:\Windows\System\KSUYwbx.exe
  2⤵
  PID:5396
- C:\Windows\System\mIQSgIN.exe
  C:\Windows\System\mIQSgIN.exe
  2⤵
  PID:6420
- C:\Windows\System\UCszvUD.exe
  C:\Windows\System\UCszvUD.exe
  2⤵
  PID:9256
- C:\Windows\System\CqkEzlZ.exe
  C:\Windows\System\CqkEzlZ.exe
  2⤵
  PID:9320
- C:\Windows\System\jKDsGlW.exe
  C:\Windows\System\jKDsGlW.exe
  2⤵
  PID:9384
- C:\Windows\System\ryMZsNJ.exe
  C:\Windows\System\ryMZsNJ.exe
  2⤵
  PID:7120
- C:\Windows\System\fCndyTK.exe
  C:\Windows\System\fCndyTK.exe
  2⤵
  PID:5564
- C:\Windows\System\QBElmoY.exe
  C:\Windows\System\QBElmoY.exe
  2⤵
  PID:5788
- C:\Windows\System\HZnEGGY.exe
  C:\Windows\System\HZnEGGY.exe
  2⤵
  PID:4100
- C:\Windows\System\kzaPmuZ.exe
  C:\Windows\System\kzaPmuZ.exe
  2⤵
  PID:8200
- C:\Windows\System\RTZVLEy.exe
  C:\Windows\System\RTZVLEy.exe
  2⤵
  PID:8836
- C:\Windows\System\BVdXpal.exe
  C:\Windows\System\BVdXpal.exe
  2⤵
  PID:8956
- C:\Windows\System\ghbeNnv.exe
  C:\Windows\System\ghbeNnv.exe
  2⤵
  PID:8988
- C:\Windows\System\qgvKqKE.exe
  C:\Windows\System\qgvKqKE.exe
  2⤵
  PID:9556
- C:\Windows\System\CGKLyli.exe
  C:\Windows\System\CGKLyli.exe
  2⤵
  PID:8468
- C:\Windows\System\bsqvxpE.exe
  C:\Windows\System\bsqvxpE.exe
  2⤵
  PID:9952
- C:\Windows\System\nPJaFps.exe
  C:\Windows\System\nPJaFps.exe
  2⤵
  PID:9252
- C:\Windows\System\tUNgcNx.exe
  C:\Windows\System\tUNgcNx.exe
  2⤵
  PID:9280
- C:\Windows\System\qpiTaUb.exe
  C:\Windows\System\qpiTaUb.exe
  2⤵
  PID:9352
- C:\Windows\System\NTxuqqz.exe
  C:\Windows\System\NTxuqqz.exe
  2⤵
  PID:8672
- C:\Windows\System\gbtsNUH.exe
  C:\Windows\System\gbtsNUH.exe
  2⤵
  PID:8676
- C:\Windows\System\uiIePsD.exe
  C:\Windows\System\uiIePsD.exe
  2⤵
  PID:10264
- C:\Windows\System\HSmxAAk.exe
  C:\Windows\System\HSmxAAk.exe
  2⤵
  PID:10288
- C:\Windows\System\AwzLilN.exe
  C:\Windows\System\AwzLilN.exe
  2⤵
  PID:10304
- C:\Windows\System\PFswzgz.exe
  C:\Windows\System\PFswzgz.exe
  2⤵
  PID:10320
- C:\Windows\System\jtTykIQ.exe
  C:\Windows\System\jtTykIQ.exe
  2⤵
  PID:10336
- C:\Windows\System\YeGLanl.exe
  C:\Windows\System\YeGLanl.exe
  2⤵
  PID:10352
- C:\Windows\System\NvnleVz.exe
  C:\Windows\System\NvnleVz.exe
  2⤵
  PID:10372
- C:\Windows\System\zlzhQLI.exe
  C:\Windows\System\zlzhQLI.exe
  2⤵
  PID:10392
- C:\Windows\System\opTvZqO.exe
  C:\Windows\System\opTvZqO.exe
  2⤵
  PID:10416
- C:\Windows\System\GEWSrgr.exe
  C:\Windows\System\GEWSrgr.exe
  2⤵
  PID:10440
- C:\Windows\System\IPedEYu.exe
  C:\Windows\System\IPedEYu.exe
  2⤵
  PID:10460
- C:\Windows\System\uoQgxUb.exe
  C:\Windows\System\uoQgxUb.exe
  2⤵
  PID:10480
- C:\Windows\System\pCvhdXj.exe
  C:\Windows\System\pCvhdXj.exe
  2⤵
  PID:10504
- C:\Windows\System\BBDpIIq.exe
  C:\Windows\System\BBDpIIq.exe
  2⤵
  PID:10524
- C:\Windows\System\frhrFTc.exe
  C:\Windows\System\frhrFTc.exe
  2⤵
  PID:10552
- C:\Windows\System\DSpQmLR.exe
  C:\Windows\System\DSpQmLR.exe
  2⤵
  PID:10572
- C:\Windows\System\yZsoWef.exe
  C:\Windows\System\yZsoWef.exe
  2⤵
  PID:10604
- C:\Windows\System\IVcvikW.exe
  C:\Windows\System\IVcvikW.exe
  2⤵
  PID:10620
- C:\Windows\System\eerFmTZ.exe
  C:\Windows\System\eerFmTZ.exe
  2⤵
  PID:10640
- C:\Windows\System\kdpIlwe.exe
  C:\Windows\System\kdpIlwe.exe
  2⤵
  PID:10668
- C:\Windows\System\YFghojL.exe
  C:\Windows\System\YFghojL.exe
  2⤵
  PID:10684
- C:\Windows\System\qaClYOq.exe
  C:\Windows\System\qaClYOq.exe
  2⤵
  PID:10700
- C:\Windows\System\nymmNkr.exe
  C:\Windows\System\nymmNkr.exe
  2⤵
  PID:10716
- C:\Windows\System\IeCpaov.exe
  C:\Windows\System\IeCpaov.exe
  2⤵
  PID:10736
- C:\Windows\System\aFbNbcK.exe
  C:\Windows\System\aFbNbcK.exe
  2⤵
  PID:10752
- C:\Windows\System\wMuNNdB.exe
  C:\Windows\System\wMuNNdB.exe
  2⤵
  PID:10768
- C:\Windows\System\mQIBiIk.exe
  C:\Windows\System\mQIBiIk.exe
  2⤵
  PID:10784
- C:\Windows\System\rgNPSjs.exe
  C:\Windows\System\rgNPSjs.exe
  2⤵
  PID:10808
- C:\Windows\System\mdnSuaX.exe
  C:\Windows\System\mdnSuaX.exe
  2⤵
  PID:10844
- C:\Windows\System\uOWoGtD.exe
  C:\Windows\System\uOWoGtD.exe
  2⤵
  PID:10868
- C:\Windows\System\UFDjNkI.exe
  C:\Windows\System\UFDjNkI.exe
  2⤵
  PID:10892
- C:\Windows\System\iwuyXPS.exe
  C:\Windows\System\iwuyXPS.exe
  2⤵
  PID:10916
- C:\Windows\System\eNkPCjv.exe
  C:\Windows\System\eNkPCjv.exe
  2⤵
  PID:10948
- C:\Windows\System\PawyGZH.exe
  C:\Windows\System\PawyGZH.exe
  2⤵
  PID:10964
- C:\Windows\System\hQLboJE.exe
  C:\Windows\System\hQLboJE.exe
  2⤵
  PID:10988
- C:\Windows\System\lGqlSSj.exe
  C:\Windows\System\lGqlSSj.exe
  2⤵
  PID:11012
- C:\Windows\System\KFFXrwu.exe
  C:\Windows\System\KFFXrwu.exe
  2⤵
  PID:11036
- C:\Windows\System\oZLEZTv.exe
  C:\Windows\System\oZLEZTv.exe
  2⤵
  PID:11068
- C:\Windows\System\sogaOeS.exe
  C:\Windows\System\sogaOeS.exe
  2⤵
  PID:11092
- C:\Windows\System\UcbSggf.exe
  C:\Windows\System\UcbSggf.exe
  2⤵
  PID:11116
- C:\Windows\System\vuGpgGw.exe
  C:\Windows\System\vuGpgGw.exe
  2⤵
  PID:11140
- C:\Windows\System\QHVThTu.exe
  C:\Windows\System\QHVThTu.exe
  2⤵
  PID:11164
- C:\Windows\System\wQDfVvO.exe
  C:\Windows\System\wQDfVvO.exe
  2⤵
  PID:11188
- C:\Windows\System\wMdAaoV.exe
  C:\Windows\System\wMdAaoV.exe
  2⤵
  PID:11212
- C:\Windows\System\UidAFqP.exe
  C:\Windows\System\UidAFqP.exe
  2⤵
  PID:11228
- C:\Windows\System\TMWoRRO.exe
  C:\Windows\System\TMWoRRO.exe
  2⤵
  PID:11260
- C:\Windows\System\QqTfMCC.exe
  C:\Windows\System\QqTfMCC.exe
  2⤵
  PID:1456
- C:\Windows\System\IvGiSah.exe
  C:\Windows\System\IvGiSah.exe
  2⤵
  PID:8740
- C:\Windows\System\IpFUzwN.exe
  C:\Windows\System\IpFUzwN.exe
  2⤵
  PID:8780
- C:\Windows\System\UwGzYbn.exe
  C:\Windows\System\UwGzYbn.exe
  2⤵
  PID:8820
- C:\Windows\System\gDKSFDI.exe
  C:\Windows\System\gDKSFDI.exe
  2⤵
  PID:8912
- C:\Windows\System\AlzmhTM.exe
  C:\Windows\System\AlzmhTM.exe
  2⤵
  PID:5664
- C:\Windows\System\qjOdycG.exe
  C:\Windows\System\qjOdycG.exe
  2⤵
  PID:9052
- C:\Windows\System\rruStas.exe
  C:\Windows\System\rruStas.exe
  2⤵
  PID:9164
- C:\Windows\System\RGLZIir.exe
  C:\Windows\System\RGLZIir.exe
  2⤵
  PID:7172
- C:\Windows\System\XxYJPCC.exe
  C:\Windows\System\XxYJPCC.exe
  2⤵
  PID:9688
- C:\Windows\System\usHnmEh.exe
  C:\Windows\System\usHnmEh.exe
  2⤵
  PID:7528
- C:\Windows\System\VSvVRyv.exe
  C:\Windows\System\VSvVRyv.exe
  2⤵
  PID:9548
- C:\Windows\System\tKSARqC.exe
  C:\Windows\System\tKSARqC.exe
  2⤵
  PID:9904
- C:\Windows\System\MxTyIXg.exe
  C:\Windows\System\MxTyIXg.exe
  2⤵
  PID:9348
- C:\Windows\System\lHaPRYs.exe
  C:\Windows\System\lHaPRYs.exe
  2⤵
  PID:10028
- C:\Windows\System\NeXAMxL.exe
  C:\Windows\System\NeXAMxL.exe
  2⤵
  PID:9020
- C:\Windows\System\wGJeMuH.exe
  C:\Windows\System\wGJeMuH.exe
  2⤵
  PID:10300
- C:\Windows\System\XsZoTwq.exe
  C:\Windows\System\XsZoTwq.exe
  2⤵
  PID:9404
- C:\Windows\System\oCAcxIh.exe
  C:\Windows\System\oCAcxIh.exe
  2⤵
  PID:9412
- C:\Windows\System\IAKIAEB.exe
  C:\Windows\System\IAKIAEB.exe
  2⤵
  PID:9492
- C:\Windows\System\EpQVDrS.exe
  C:\Windows\System\EpQVDrS.exe
  2⤵
  PID:4832
- C:\Windows\System\oZrQAfw.exe
  C:\Windows\System\oZrQAfw.exe
  2⤵
  PID:9292
- C:\Windows\System\LiHHIgA.exe
  C:\Windows\System\LiHHIgA.exe
  2⤵
  PID:9596
- C:\Windows\System\KUMUBwQ.exe
  C:\Windows\System\KUMUBwQ.exe
  2⤵
  PID:11284
- C:\Windows\System\uSIhkAq.exe
  C:\Windows\System\uSIhkAq.exe
  2⤵
  PID:11300
- C:\Windows\System\CbKwsRY.exe
  C:\Windows\System\CbKwsRY.exe
  2⤵
  PID:11320
- C:\Windows\System\NfPUZbC.exe
  C:\Windows\System\NfPUZbC.exe
  2⤵
  PID:11340
- C:\Windows\System\rIMHGkf.exe
  C:\Windows\System\rIMHGkf.exe
  2⤵
  PID:11368
- C:\Windows\System\mHYWaMl.exe
  C:\Windows\System\mHYWaMl.exe
  2⤵
  PID:11384
- C:\Windows\System\QUBwfQJ.exe
  C:\Windows\System\QUBwfQJ.exe
  2⤵
  PID:11400
- C:\Windows\System\cOJMkUf.exe
  C:\Windows\System\cOJMkUf.exe
  2⤵
  PID:11420
- C:\Windows\System\ukoUOjg.exe
  C:\Windows\System\ukoUOjg.exe
  2⤵
  PID:11444
- C:\Windows\System\PmOUxEE.exe
  C:\Windows\System\PmOUxEE.exe
  2⤵
  PID:11472
- C:\Windows\System\KfnMCmY.exe
  C:\Windows\System\KfnMCmY.exe
  2⤵
  PID:11500
- C:\Windows\System\XxcGlzk.exe
  C:\Windows\System\XxcGlzk.exe
  2⤵
  PID:11520
- C:\Windows\System\hsbtQzw.exe
  C:\Windows\System\hsbtQzw.exe
  2⤵
  PID:11540
- C:\Windows\System\kINhnnJ.exe
  C:\Windows\System\kINhnnJ.exe
  2⤵
  PID:11556
- C:\Windows\System\DcDIaey.exe
  C:\Windows\System\DcDIaey.exe
  2⤵
  PID:11572
- C:\Windows\System\lCzPsKQ.exe
  C:\Windows\System\lCzPsKQ.exe
  2⤵
  PID:11596
- C:\Windows\System\hcgnvvT.exe
  C:\Windows\System\hcgnvvT.exe
  2⤵
  PID:11616
- C:\Windows\System\aFFPMPJ.exe
  C:\Windows\System\aFFPMPJ.exe
  2⤵
  PID:11640
- C:\Windows\System\BUQFirI.exe
  C:\Windows\System\BUQFirI.exe
  2⤵
  PID:11664
- C:\Windows\System\GBiIliW.exe
  C:\Windows\System\GBiIliW.exe
  2⤵
  PID:11684
- C:\Windows\System\dwuBbjh.exe
  C:\Windows\System\dwuBbjh.exe
  2⤵
  PID:11708
- C:\Windows\System\hEeXfRZ.exe
  C:\Windows\System\hEeXfRZ.exe
  2⤵
  PID:11732
- C:\Windows\System\AzfUZbR.exe
  C:\Windows\System\AzfUZbR.exe
  2⤵
  PID:11760
- C:\Windows\System\uCxLsMA.exe
  C:\Windows\System\uCxLsMA.exe
  2⤵
  PID:11780
- C:\Windows\System\XkxMfUn.exe
  C:\Windows\System\XkxMfUn.exe
  2⤵
  PID:11804
- C:\Windows\System\dHZEGpb.exe
  C:\Windows\System\dHZEGpb.exe
  2⤵
  PID:11828
- C:\Windows\System\vuRtgXB.exe
  C:\Windows\System\vuRtgXB.exe
  2⤵
  PID:11852
- C:\Windows\System\EyQdkhG.exe
  C:\Windows\System\EyQdkhG.exe
  2⤵
  PID:11872
- C:\Windows\System\jBcZWXl.exe
  C:\Windows\System\jBcZWXl.exe
  2⤵
  PID:11896
- C:\Windows\System\TNjQdQN.exe
  C:\Windows\System\TNjQdQN.exe
  2⤵
  PID:11920
- C:\Windows\System\fCyyuND.exe
  C:\Windows\System\fCyyuND.exe
  2⤵
  PID:11944
- C:\Windows\System\AiAHHxX.exe
  C:\Windows\System\AiAHHxX.exe
  2⤵
  PID:11964
- C:\Windows\System\uNOWSDH.exe
  C:\Windows\System\uNOWSDH.exe
  2⤵
  PID:11988
- C:\Windows\System\UoqaxrK.exe
  C:\Windows\System\UoqaxrK.exe
  2⤵
  PID:12012
- C:\Windows\System\kcPKmll.exe
  C:\Windows\System\kcPKmll.exe
  2⤵
  PID:12036
- C:\Windows\System\GEsMfQT.exe
  C:\Windows\System\GEsMfQT.exe
  2⤵
  PID:12056
- C:\Windows\System\jCpTzoF.exe
  C:\Windows\System\jCpTzoF.exe
  2⤵
  PID:12088
- C:\Windows\System\eTagsaP.exe
  C:\Windows\System\eTagsaP.exe
  2⤵
  PID:12108
- C:\Windows\System\yCiLZeX.exe
  C:\Windows\System\yCiLZeX.exe
  2⤵
  PID:12132
- C:\Windows\System\AtUYFvI.exe
  C:\Windows\System\AtUYFvI.exe
  2⤵
  PID:12160
- C:\Windows\System\PLSenqR.exe
  C:\Windows\System\PLSenqR.exe
  2⤵
  PID:12176
- C:\Windows\System\xNmOHrp.exe
  C:\Windows\System\xNmOHrp.exe
  2⤵
  PID:12192
- C:\Windows\System\qIHBtqV.exe
  C:\Windows\System\qIHBtqV.exe
  2⤵
  PID:12208
- C:\Windows\System\hlKDiXY.exe
  C:\Windows\System\hlKDiXY.exe
  2⤵
  PID:12224
- C:\Windows\System\xEdxLfm.exe
  C:\Windows\System\xEdxLfm.exe
  2⤵
  PID:12240
- C:\Windows\System\phHuyAo.exe
  C:\Windows\System\phHuyAo.exe
  2⤵
  PID:12256
- C:\Windows\System\ITkLJBv.exe
  C:\Windows\System\ITkLJBv.exe
  2⤵
  PID:12272
- C:\Windows\System\pkUJVJb.exe
  C:\Windows\System\pkUJVJb.exe
  2⤵
  PID:988
- C:\Windows\System\LkMYpfT.exe
  C:\Windows\System\LkMYpfT.exe
  2⤵
  PID:2536
- C:\Windows\System\xTiSwcS.exe
  C:\Windows\System\xTiSwcS.exe
  2⤵
  PID:9772
- C:\Windows\System\MZMeBIN.exe
  C:\Windows\System\MZMeBIN.exe
  2⤵
  PID:9864
- C:\Windows\System\AfbAvKh.exe
  C:\Windows\System\AfbAvKh.exe
  2⤵
  PID:3260
- C:\Windows\System\AqtWVwb.exe
  C:\Windows\System\AqtWVwb.exe
  2⤵
  PID:10076
- C:\Windows\System\ZxALwLN.exe
  C:\Windows\System\ZxALwLN.exe
  2⤵
  PID:10092
- C:\Windows\System\hStDApu.exe
  C:\Windows\System\hStDApu.exe
  2⤵
  PID:10116
- C:\Windows\System\CaVVRxY.exe
  C:\Windows\System\CaVVRxY.exe
  2⤵
  PID:10156
- C:\Windows\System\lURDEBj.exe
  C:\Windows\System\lURDEBj.exe
  2⤵
  PID:10204
- C:\Windows\System\PHogfqE.exe
  C:\Windows\System\PHogfqE.exe
  2⤵
  PID:7752
- C:\Windows\System\LWLRTqp.exe
  C:\Windows\System\LWLRTqp.exe
  2⤵
  PID:7852
- C:\Windows\System\ZZoSsxG.exe
  C:\Windows\System\ZZoSsxG.exe
  2⤵
  PID:7932
- C:\Windows\System\zoGaIxT.exe
  C:\Windows\System\zoGaIxT.exe
  2⤵
  PID:8016
- C:\Windows\System\SXkFwgT.exe
  C:\Windows\System\SXkFwgT.exe
  2⤵
  PID:13156
- C:\Windows\System\XppPvmk.exe
  C:\Windows\System\XppPvmk.exe
  2⤵
  PID:13184
- C:\Windows\System\ZweaUGp.exe
  C:\Windows\System\ZweaUGp.exe
  2⤵
  PID:13216
- C:\Windows\System\gPsKPXO.exe
  C:\Windows\System\gPsKPXO.exe
  2⤵
  PID:13252
- C:\Windows\System\ComRUAL.exe
  C:\Windows\System\ComRUAL.exe
  2⤵
  PID:13280
- C:\Windows\System\uVCYvZb.exe
  C:\Windows\System\uVCYvZb.exe
  2⤵
  PID:13304
- C:\Windows\System\xAHVetY.exe
  C:\Windows\System\xAHVetY.exe
  2⤵
  PID:9380
- C:\Windows\System\HORJPBZ.exe
  C:\Windows\System\HORJPBZ.exe
  2⤵
  PID:10584
- C:\Windows\System\pQIofzI.exe
  C:\Windows\System\pQIofzI.exe
  2⤵
  PID:5392
- C:\Windows\System\SiOPTos.exe
  C:\Windows\System\SiOPTos.exe
  2⤵
  PID:5852
- C:\Windows\System\IzydmkC.exe
  C:\Windows\System\IzydmkC.exe
  2⤵
  PID:8976
- C:\Windows\System\kLsFkhT.exe
  C:\Windows\System\kLsFkhT.exe
  2⤵
  PID:6052
- C:\Windows\System\FgMVqqi.exe
  C:\Windows\System\FgMVqqi.exe
  2⤵
  PID:10632
- C:\Windows\System\ntTaFXk.exe
  C:\Windows\System\ntTaFXk.exe
  2⤵
  PID:11580
- C:\Windows\System\ifZJxAM.exe
  C:\Windows\System\ifZJxAM.exe
  2⤵
  PID:780
- C:\Windows\System\pKqPghs.exe
  C:\Windows\System\pKqPghs.exe
  2⤵
  PID:11824
- C:\Windows\System\grFrcCt.exe
  C:\Windows\System\grFrcCt.exe
  2⤵
  PID:12044
- C:\Windows\System\EupLZwE.exe
  C:\Windows\System\EupLZwE.exe
  2⤵
  PID:12128
- C:\Windows\System\aGwmKdZ.exe
  C:\Windows\System\aGwmKdZ.exe
  2⤵
  PID:10744
- C:\Windows\System\xbzGKrI.exe
  C:\Windows\System\xbzGKrI.exe
  2⤵
  PID:10312
- C:\Windows\System\dvsMxnG.exe
  C:\Windows\System\dvsMxnG.exe
  2⤵
  PID:9668
- C:\Windows\System\yzAKBkV.exe
  C:\Windows\System\yzAKBkV.exe
  2⤵
  PID:10804
- C:\Windows\System\GGEHEBR.exe
  C:\Windows\System\GGEHEBR.exe
  2⤵
  PID:10384
- C:\Windows\System\FfJAiNb.exe
  C:\Windows\System\FfJAiNb.exe
  2⤵
  PID:7788
- C:\Windows\System\xOVHUoC.exe
  C:\Windows\System\xOVHUoC.exe
  2⤵
  PID:10412
- C:\Windows\System\tWtwaYT.exe
  C:\Windows\System\tWtwaYT.exe
  2⤵
  PID:10496
- C:\Windows\System\wDhRmVu.exe
  C:\Windows\System\wDhRmVu.exe
  2⤵
  PID:11048
- C:\Windows\System\aOTRUJP.exe
  C:\Windows\System\aOTRUJP.exe
  2⤵
  PID:11104
- C:\Windows\System\NYLQHuY.exe
  C:\Windows\System\NYLQHuY.exe
  2⤵
  PID:11132
- C:\Windows\System\KhmtEnI.exe
  C:\Windows\System\KhmtEnI.exe
  2⤵
  PID:3816
- C:\Windows\System\ICEOrRE.exe
  C:\Windows\System\ICEOrRE.exe
  2⤵
  PID:10020
- C:\Windows\System\OGsvvOI.exe
  C:\Windows\System\OGsvvOI.exe
  2⤵
  PID:9948
- C:\Windows\System\LHaOQGm.exe
  C:\Windows\System\LHaOQGm.exe
  2⤵
  PID:8524
- C:\Windows\System\gRPHDdi.exe
  C:\Windows\System\gRPHDdi.exe
  2⤵
  PID:11376
- C:\Windows\System\oIVIyNL.exe
  C:\Windows\System\oIVIyNL.exe
  2⤵
  PID:12532
- C:\Windows\System\xebsydg.exe
  C:\Windows\System\xebsydg.exe
  2⤵
  PID:1640
- C:\Windows\System\Tssydlx.exe
  C:\Windows\System\Tssydlx.exe
  2⤵
  PID:11880
- C:\Windows\System\kNpbnpa.exe
  C:\Windows\System\kNpbnpa.exe
  2⤵
  PID:11860
- C:\Windows\System\UMzPzWg.exe
  C:\Windows\System\UMzPzWg.exe
  2⤵
  PID:11984
- C:\Windows\System\dYJamZy.exe
  C:\Windows\System\dYJamZy.exe
  2⤵
  PID:12100
- C:\Windows\System\przbfhQ.exe
  C:\Windows\System\przbfhQ.exe
  2⤵
  PID:12188
- C:\Windows\System\XbbjyuL.exe
  C:\Windows\System\XbbjyuL.exe
  2⤵
  PID:13956
- C:\Windows\System\ePBVGEF.exe
  C:\Windows\System\ePBVGEF.exe
  2⤵
  PID:14016
- C:\Windows\System\UsEakrz.exe
  C:\Windows\System\UsEakrz.exe
  2⤵
  PID:14036
- C:\Windows\System\aGwCigg.exe
  C:\Windows\System\aGwCigg.exe
  2⤵
  PID:14060
- C:\Windows\System\Sfjakdk.exe
  C:\Windows\System\Sfjakdk.exe
  2⤵
  PID:14328
- C:\Windows\System\vvHOjSb.exe
  C:\Windows\System\vvHOjSb.exe
  2⤵
  PID:9980
- C:\Windows\System\TAfmlIL.exe
  C:\Windows\System\TAfmlIL.exe
  2⤵
  PID:13024
- C:\Windows\System\SUNfZLS.exe
  C:\Windows\System\SUNfZLS.exe
  2⤵
  PID:10436
- C:\Windows\System\GivioNw.exe
  C:\Windows\System\GivioNw.exe
  2⤵
  PID:9476
- C:\Windows\System\zDXNRqb.exe
  C:\Windows\System\zDXNRqb.exe
  2⤵
  PID:12184
- C:\Windows\System\TqbJALD.exe
  C:\Windows\System\TqbJALD.exe
  2⤵
  PID:12488
- C:\Windows\System\bWzvdzx.exe
  C:\Windows\System\bWzvdzx.exe
  2⤵
  PID:13608
- C:\Windows\System\qKZFWPG.exe
  C:\Windows\System\qKZFWPG.exe
  2⤵
  PID:13432
- C:\Windows\System\XdYPLmi.exe
  C:\Windows\System\XdYPLmi.exe
  2⤵
  PID:12780
- C:\Windows\System\RuurbZv.exe
  C:\Windows\System\RuurbZv.exe
  2⤵
  PID:12948
- C:\Windows\System\ADaGXlo.exe
  C:\Windows\System\ADaGXlo.exe
  2⤵
  PID:13080
- C:\Windows\System\SWoOwEW.exe
  C:\Windows\System\SWoOwEW.exe
  2⤵
  PID:13672
- C:\Windows\System\UTDDQwo.exe
  C:\Windows\System\UTDDQwo.exe
  2⤵
  PID:13196
- C:\Windows\System\sXfnYta.exe
  C:\Windows\System\sXfnYta.exe
  2⤵
  PID:4748
- C:\Windows\System\GPZJTzm.exe
  C:\Windows\System\GPZJTzm.exe
  2⤵
  PID:5476
- C:\Windows\System\vmDXgpq.exe
  C:\Windows\System\vmDXgpq.exe
  2⤵
  PID:11456
- C:\Windows\System\pEJsLHl.exe
  C:\Windows\System\pEJsLHl.exe
  2⤵
  PID:11532
- C:\Windows\System\owWvJYJ.exe
  C:\Windows\System\owWvJYJ.exe
  2⤵
  PID:11820
- C:\Windows\System\uKbqbbW.exe
  C:\Windows\System\uKbqbbW.exe
  2⤵
  PID:10280
- C:\Windows\System\BVkMhdK.exe
  C:\Windows\System\BVkMhdK.exe
  2⤵
  PID:10332
- C:\Windows\System\eZNgoRZ.exe
  C:\Windows\System\eZNgoRZ.exe
  2⤵
  PID:13716
- C:\Windows\System\qrbXdUd.exe
  C:\Windows\System\qrbXdUd.exe
  2⤵
  PID:14140
- C:\Windows\System\tzeHtko.exe
  C:\Windows\System\tzeHtko.exe
  2⤵
  PID:13772
- C:\Windows\System\RLXOsCo.exe
  C:\Windows\System\RLXOsCo.exe
  2⤵
  PID:14052
- C:\Windows\System\SPXRnGE.exe
  C:\Windows\System\SPXRnGE.exe
  2⤵
  PID:13408
- C:\Windows\System\cmaHUNN.exe
  C:\Windows\System\cmaHUNN.exe
  2⤵
  PID:13816
- C:\Windows\System\Yrbhmja.exe
  C:\Windows\System\Yrbhmja.exe
  2⤵
  PID:13920
- C:\Windows\System\yUesJQK.exe
  C:\Windows\System\yUesJQK.exe
  2⤵
  PID:10976
- C:\Windows\System\aTKCqXC.exe
  C:\Windows\System\aTKCqXC.exe
  2⤵
  PID:2592
- C:\Windows\System\DwcQIAn.exe
  C:\Windows\System\DwcQIAn.exe
  2⤵
  PID:13968
- C:\Windows\System\LTKUbgE.exe
  C:\Windows\System\LTKUbgE.exe
  2⤵
  PID:8796
- C:\Windows\System\wGVCvxo.exe
  C:\Windows\System\wGVCvxo.exe
  2⤵
  PID:7352
- C:\Windows\System\mnPbvIW.exe
  C:\Windows\System\mnPbvIW.exe
  2⤵
  PID:14116
- C:\Windows\System\yuzltVv.exe
  C:\Windows\System\yuzltVv.exe
  2⤵
  PID:14172
- C:\Windows\System\VtXgGvv.exe
  C:\Windows\System\VtXgGvv.exe
  2⤵
  PID:14236
- C:\Windows\System\TUOLctC.exe
  C:\Windows\System\TUOLctC.exe
  2⤵
  PID:14212
- C:\Windows\System\UFMwvdC.exe
  C:\Windows\System\UFMwvdC.exe
  2⤵
  PID:14280
- C:\Windows\System\tmIvBLD.exe
  C:\Windows\System\tmIvBLD.exe
  2⤵
  PID:14304
- C:\Windows\System\jZmefou.exe
  C:\Windows\System\jZmefou.exe
  2⤵
  PID:14320
- C:\Windows\System\IKqPZnj.exe
  C:\Windows\System\IKqPZnj.exe
  2⤵
  PID:13952
- C:\Windows\System\CXHldZc.exe
  C:\Windows\System\CXHldZc.exe
  2⤵
  PID:8720
- C:\Windows\System\XIWIJtm.exe
  C:\Windows\System\XIWIJtm.exe
  2⤵
  PID:11336
- C:\Windows\System\HsuvrBI.exe
  C:\Windows\System\HsuvrBI.exe
  2⤵
  PID:9120
- C:\Windows\System\GYYVekl.exe
  C:\Windows\System\GYYVekl.exe
  2⤵
  PID:9744
- C:\Windows\System\cRBFbhx.exe
  C:\Windows\System\cRBFbhx.exe
  2⤵
  PID:816
- C:\Windows\System\VvGTgne.exe
  C:\Windows\System\VvGTgne.exe
  2⤵
  PID:13016
- C:\Windows\System\UrmErjL.exe
  C:\Windows\System\UrmErjL.exe
  2⤵
  PID:11592
- C:\Windows\System\EZpaGJH.exe
  C:\Windows\System\EZpaGJH.exe
  2⤵
  PID:3896
- C:\Windows\System\CxOeqvu.exe
  C:\Windows\System\CxOeqvu.exe
  2⤵
  PID:13404
- C:\Windows\System\zmTuQEQ.exe
  C:\Windows\System\zmTuQEQ.exe
  2⤵
  PID:4800
- C:\Windows\System\OQTYpUk.exe
  C:\Windows\System\OQTYpUk.exe
  2⤵
  PID:12324
- C:\Windows\System\fXOzBfv.exe
  C:\Windows\System\fXOzBfv.exe
  2⤵
  PID:10048
- C:\Windows\System\prSwiVv.exe
  C:\Windows\System\prSwiVv.exe
  2⤵
  PID:13676
- C:\Windows\System\xyZEYVU.exe
  C:\Windows\System\xyZEYVU.exe
  2⤵
  PID:396
- C:\Windows\System\MfZZclK.exe
  C:\Windows\System\MfZZclK.exe
  2⤵
  PID:14072
- C:\Windows\System\JmyjKll.exe
  C:\Windows\System\JmyjKll.exe
  2⤵
  PID:13788
- C:\Windows\System\onBHrzV.exe
  C:\Windows\System\onBHrzV.exe
  2⤵
  PID:9592
- C:\Windows\System\oylVFxe.exe
  C:\Windows\System\oylVFxe.exe
  2⤵
  PID:14252
- C:\Windows\System\lLdtpOx.exe
  C:\Windows\System\lLdtpOx.exe
  2⤵
  PID:8668
- C:\Windows\System\AlCizsZ.exe
  C:\Windows\System\AlCizsZ.exe
  2⤵
  PID:14220
- C:\Windows\System\xwqdiDC.exe
  C:\Windows\System\xwqdiDC.exe
  2⤵
  PID:2720
- C:\Windows\System\CJNlmQj.exe
  C:\Windows\System\CJNlmQj.exe
  2⤵
  PID:13180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yss5ohfa.qbg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BLfEXro.exe

Filesize
2.0MB

MD5
b27059c168d65560240830f13258be43

SHA1
d4cc6bed5e6b78d39e4c1d64a9c6344d55ac4895

SHA256
88328cf42da120ebe036eea4b82d85c43edfaf1829a349ca22b6c206518e78fa

SHA512
1bbb7a482dd98f11c33c15956b036b88f2edff4e83590a6b4796cff5f1103f536868549b1b26dc4fb349420b905950e3197f55afcc19a69cab682c0a3c7d8efe

Download Submit
C:\Windows\System\CdHAaja.exe

Filesize
2.0MB

MD5
429e06a4344ebedce02b0477b410854c

SHA1
2310178edc46280a7e8cbbd4d763854980ecc1f8

SHA256
28296cde02c6d8fce04575365a2e4c604c86d3c070f966b6030f577995d42c16

SHA512
dc274c09cb2db7a2b0a9006fc34d26c43af4d908f3d853a847bbaa4f85d742d08066ad1ad46ff1c5d247e4c1fadfe7a5f7aba7303dbacf6447f842bbf3aaeca6

Download Submit
C:\Windows\System\CshoEtN.exe

Filesize
2.0MB

MD5
6ba1bea76c46350491f71a1b652e140d

SHA1
ec737cb4c6c4fe3922e79d8a6d53a0dde6c459b9

SHA256
b00d95f8200cbc437ed347ae509866ab17beaae512bf2c1f20380cb9e62bae02

SHA512
37120e680ce3f57016bc332fc6f7f58426505de53678a22cfd8fc5c8b95da707a13da2fade5e0be922905f443b7f3a9a6b61bb276fed659c84cfd639aa84af33

Download Submit
C:\Windows\System\DHJJoVA.exe

Filesize
2.0MB

MD5
68132c5cde65722c03cdb9fe78f9af88

SHA1
976d86b2fa54719dd180ce58d32310fc9e8e3963

SHA256
cf9d553ff46947b2721c0caa07eed32ff1665811b0d788837c3a7468e35a8d97

SHA512
ab55f6beb282ef78764e19ee0a55f5ac63056472a6045ec6fc152f6870c36da097652495b63a13c469d3417d1d6667db0ceab2076db693fd749a978876f83587

Download Submit
C:\Windows\System\DqTunnA.exe

Filesize
2.0MB

MD5
feff58aea787714e28eced1ef55930c1

SHA1
8a83cc2c90ac7c897a012ea1fda3776eb103f876

SHA256
f01dc3774f1760fa06d8781a56ec9e3e0f7339fbd2845ba3aee99add8c3a99fa

SHA512
a335b97b929d27d8d59374607081c418b31774fd44854429400bf34be253438b659f39ff4dadff20dddc99e0d7d9eeae377d0e40283f9f076ec4167c2460a407

Download Submit
C:\Windows\System\FpZdtsO.exe

Filesize
2.0MB

MD5
b9e34197acd42405c3249726fb91c9a2

SHA1
f32ae6193113deb9dd1177565d5b35be03fd3394

SHA256
502564d0dca9b1cd5864b28bb43f301a6de6fb421f15fac02121f1b8521a05ea

SHA512
aec63a2ca490cb074e1195af8db3b0bd335660688577630c4b13b75cb24e0f24d0311cc08a48629a62ed95867c55ac90b2cba36709d1dab5abddbd56fbd8166d

Download Submit
C:\Windows\System\GEriySW.exe

Filesize
2.0MB

MD5
5664222de5c81e6fe09cf71974d43248

SHA1
26ae2a1fc4c9efee5106f33db087104724d964e3

SHA256
ae95e66d3c861057d6df069fd3378cd261e8378c1dae0b15e7db2857fc23e77c

SHA512
cf1e79e74060f72fb932486ead0e9ea3b7ab19159724113445338d1d725b7748ebc474d6a0894cad4963d0fcf84818cb7bee33103407e4aadb265be2c80f55fb

Download Submit
C:\Windows\System\GiEnMvt.exe

Filesize
2.0MB

MD5
d0ce1856f46003de9514bd6b44d8696d

SHA1
0d8a73e4ef4f064061cfe8c2ccf74fc92f0f810a

SHA256
1020ea0642f4b3bc166083fc67a2b689cb880757a50a0020c7ca5191f3367384

SHA512
7a81e4acfcaf89adec12a5309c43b55796c3bcf7bb42e69b37c5046f13d3a9b21b10fed7904f32dad4b51de39f772fc35b0d82da9298f3b29cf6772a77027b78

Download Submit
C:\Windows\System\HGZhYtQ.exe

Filesize
2.0MB

MD5
59bafc4f03ce37e2ff04f7fe4e44c9b6

SHA1
133447bf17c967160386c15b42ccbed1f6ecb231

SHA256
5021be782573791e09d391946ec1a0161b086baa6e0f8fef9a4117f845d1d761

SHA512
fab7d6c1ad8d7724e962e449000d2e0a77991d89ecaeb2bcc4ff663e00e214d81e142ade92c49b5c799aa5b46852935f3a63817ab99034079d92315981dc9fff

Download Submit
C:\Windows\System\IXsBTLB.exe

Filesize
2.0MB

MD5
177b86d192eecdaf482253fdb87fe5be

SHA1
6e5e10b2a926e62871c959e16171f17bc8c4eecd

SHA256
19bde22035a2b38c7f2ac3e3c029b4833226f21142d598dce245b54173ac3d66

SHA512
f106760c1d5ebc557b7501986e6211870ef776d8056a7174bf938958ef47398321255c80d231b7691146e885e604b6653996ce3f623421ea90c404db62d09acb

Download Submit
C:\Windows\System\JGfXvjS.exe

Filesize
2.0MB

MD5
eafe411c45012465d3a30f2d6bf5135d

SHA1
8cfb19acba60fdbf8e100a9db9c94042afd8ae99

SHA256
689200e6ab1d65f8654a4199ebeab1db3adf6428d9bcc1922b901fcfd50b745d

SHA512
0eabc8b95ab35ef99fa6b7f068ae435fae0fb7ab9ae164f7755c207634b47318644b3fd563f586f6efbe2284663ea45a7fdbbc913780984266d2460db3dfda6c

Download Submit
C:\Windows\System\JZxMYNq.exe

Filesize
2.0MB

MD5
278d12537eb71805727b30d3573be19b

SHA1
343fb6f36450eb9df7f3d71b276cdb9afcafce1c

SHA256
9d08f801dfa50bd2e90753195c183de0aaef434f9fd0cb227faba3c27bbceabc

SHA512
30f62556c2b1e54d65f49944af7f84bdb27372a5c2f71b9c57052f921c02022d52c6ddec3edf632335e2bdd9f6457d80bb543494df1cd2142f9c6fabc82f0297

Download Submit
C:\Windows\System\LAImfYf.exe

Filesize
2.0MB

MD5
b51e8738f2350f6e021fd1a86c96cebd

SHA1
b20c07c732b91af8d808c7f3adc8f47495ebbdf6

SHA256
e669e4e2e323b4d68569804cb5eadd5270d549cd8ac279e57af71ffe8aa42c54

SHA512
acb9d8a9481cf72120193596703faa541af0a49c9a4f536908b2cc153c6e6c57b6205787e7cabe33d4ab949d5a72403b65cd1883536a4633e8dba772498ece5b

Download Submit
C:\Windows\System\MNJUygA.exe

Filesize
2.0MB

MD5
c9765df06c5fc003b07ae6c17b9eb1d0

SHA1
8d444d5672680f834439799791036e090630cfe9

SHA256
6e476b3eed7b4de7335db41d9b0bfa92b73fb4efb2145f09dba5dd494f860c4a

SHA512
f7df2505d2052047f46a603e1b42a3a4a5c805ed7d46141de922f3cfabc85d9d38f7fc04a94ddcc1b236e816364b9838d5f71f59c18dd9a1e1ce101ef50f09f7

Download Submit
C:\Windows\System\OAqgsfM.exe

Filesize
2.0MB

MD5
b74055923dfea4896d13c08094264f2b

SHA1
39374614e3d167e68cde51e0cc5ab9edf708599a

SHA256
0565f46de2b465f2dc5615dc2925f9ca8a6e015bc9057b9723367d1788498783

SHA512
4927208cd4766020578b523b5656e19e45cea1de927ba118254e83134722fef31c30c9ad479d0a62f00e920d64c3d2da9a87c2dd09f30e4427bc3b4cb11aab24

Download Submit
C:\Windows\System\OgXTuEH.exe

Filesize
2.0MB

MD5
8b2a6a4c56509524f63182e05b8cbf2a

SHA1
5a3c71542b850082fab921542c21066a98debdf2

SHA256
52f3bd4283877e3826183882f7516b0faac5323bc3393e4b45dc26cb06f806e3

SHA512
e1035a0b90ef924306fc2b84cd67f424d810212ae26a1811e1e60db9deae93b20c4f0c1a204f6006a158c51ebd1c1fff79cd69dace10eca3cf06f3202dcf0704

Download Submit
C:\Windows\System\PwxYvqF.exe

Filesize
2.0MB

MD5
6af7e2b8a31d3b423d3cbeeb4ff78b17

SHA1
e0f6aa9f40c2b0d0a2c7b783f92505e76f291f44

SHA256
495076ebbafedf67478a498cd6f0d08d0a7960112a39800ca72a350cd3976099

SHA512
4ff309aeb8687b28027b3340c029a4a990d2b9f283bdd6e3d28b6b48d13639c99d73d3ab59a13a9c050f2c71d3e302608cc5cef20838f13c994ed349b5f78185

Download Submit
C:\Windows\System\QJbvXYk.exe

Filesize
2.0MB

MD5
5f2289083c1cb9925567f601882621cc

SHA1
15ac0cd777bdad55e525a68678cde46955f3689c

SHA256
751e3fcea7ea29f9b060963481ff178e6efdabde1cfff4a4ca6049ad93b70c49

SHA512
b155dcb0a3d6307ddf1308a642e4280f87d9b4acf01029122208a31c6cffc99660b90710aa2850bc7ac265cd741e4f3b02c2574a93f2664127776a4b9ccf82ec

Download Submit
C:\Windows\System\TgZgMNu.exe

Filesize
2.0MB

MD5
c09b85a44fd1ecb535075097b5387123

SHA1
adeec55c3a93dd44125ebf83bd2a56ba5380b962

SHA256
89ee4978d5b953c31a89d59391a2a6d4f3278cee919bc386a28d153d40a1ad45

SHA512
c083c7ff25e8e4934afcd41397e926dc7f4ce54e4358b8c651b03b56737f27670adf12d33413fb90102dfe9353abdd00ff6ae231b9e04cff4eee848dc49d4b23

Download Submit
C:\Windows\System\UDRvAfO.exe

Filesize
2.0MB

MD5
061bf35fb0456751b2fe6cc6cbc11248

SHA1
065d16cd43916a0ed7614ad7aed94f8513e3ee8c

SHA256
1192a9af91cd5d7c5f499b66a90fcbb034d89bdd050119d6c98c61981c3acf7b

SHA512
b536df3b7813269bf711a8961f3866024ac0dae65fb7bd7e844afd1f300e6f417e91fef7c7bc9ffaf394b0c3b3cd64e706b4e55740441d734eb8c71c1ced8a2d

Download Submit
C:\Windows\System\WYOtYUc.exe

Filesize
2.0MB

MD5
eaeab92458b5377f3f5ab2e66ba09091

SHA1
75cd38404571b6b31478175f30b8f98006f6661b

SHA256
9776a3b97f52f5c4e2a4dccf6cf971ed7e33aa59226368b5be6ace6d4e893277

SHA512
e96ae00f50e5db8be010fdf58f0412f95b99e8b1b67780255ca28d3d702fee2540c280b793aab3fe87bd3609aa93f794b01282be99f453e3d0d7c2090f9642c8

Download Submit
C:\Windows\System\XcSKpqC.exe

Filesize
2.0MB

MD5
4fa652c304c01a3123025fffc406a332

SHA1
c98329490cc32622ae6b0eb2504c6d13c7e345b0

SHA256
4bdd2d20e0624470d1d72c2ce9e58ac3471a45a477595e827aef841c92c3dea6

SHA512
c6a981030b5c13b3f6c23081cbb6434a672e297267f1f995a501e03e3861413cfac23fcb483fd7644f5b93a8dabc010c601168ec1f44110ea9624d9646e19342

Download Submit
C:\Windows\System\aFxbylH.exe

Filesize
2.0MB

MD5
edb030084e4e8996fe07637c9880189b

SHA1
24f51842a081486a8bd36765fafc97018f8b7bf4

SHA256
4377dca62d6734dc8565cef3cd8c869b32d9efdf59a03b2fd7c70a3d333aae99

SHA512
d710e722095e1e60d09a3b7ae28ea01469d0b2b01e9b280dc5430e73cebc29bee09602627d26c821171f3c2f2c0bebd4cb822a3b5c5d5ef83a4b775cb97ff909

Download Submit
C:\Windows\System\dSrNsxH.exe

Filesize
2.0MB

MD5
48579be45fac9bbcd1cf1888858a3979

SHA1
ca9359d1a717900a4a223600c6a4bdb317406543

SHA256
5ebd67e26f7f5476f4b44f8d2269471403b4cbc60c2413fe83189e2b1e258caf

SHA512
1fa12c8289ea76016bedba830f2c6aa5352dbbc82635513b1f11b5150381c84ef7729d7eeefb7f5bd70b82f614b22320dc29d192e659a187d1fb8f45c824bce9

Download Submit
C:\Windows\System\ebCQETQ.exe

Filesize
2.0MB

MD5
b4a85f83c19bd72b0fb26309a0ee063c

SHA1
66043089d3a13b49b5873b761340f985be3f773b

SHA256
9771691ed6ef06a519b32ef80773b6377d4d3ef507adac0ebef32a9e032a6bed

SHA512
aabbf10b6f07c4c8b5e73647e3d63d6e7a683de86d7ff025f68ec3d3e7f7d1494a50cb64add13d9a3e1d083f82ac63dff6f20947bc0f48ae374a0fdd81125d10

Download Submit
C:\Windows\System\fcKfjut.exe

Filesize
2.0MB

MD5
86a4bd10564415f903830a2c47942ea1

SHA1
3f4608b7cba27efcc1dd7b362744614b290127b7

SHA256
7e541f5191df1846ae0e0a9c5615a4c104b2743b403fa683ac04e8e08536921d

SHA512
8fb4ce130b19dbd321a16e98639c17d914fdb5febed632bb9f0418a58766cab71cb5f609b5258d279bccbeab595d0cf809b83595a6e3d05aa0da7a4ef571a552

Download Submit
C:\Windows\System\gOGOvuK.exe

Filesize
2.0MB

MD5
1b9fd53d3f924fdaaaa67ec7ab69829c

SHA1
17a08d100225418a58eb2639651f9d6bdcc53d16

SHA256
552c7fbd0082bc421d1c11e24d6a7b164cdf719e106f05c677a3b521fc3ef2f5

SHA512
6c2742f7c2e8c79f90d69831d7abc8dae6b6dfeddc10addb67bd6f36c56b61733cb8d66658d2d1f452e83f61e27ba7fee79c6d32d248a50808294f5fb8e03098

Download Submit
C:\Windows\System\hVduzOD.exe

Filesize
2.0MB

MD5
a8e387b2414c103cad16ccf2b792e90c

SHA1
aa9db0d3440afcfb59eeb12c35e99c6208cd8166

SHA256
4464d2295e767e43aadb66d91f8babf8c9cdc68d952c8076a5b88e4448fe0560

SHA512
a67f661daef4d611ad31f92926198ee480a6f12191b43f82e724ff55d3a06dadb3209bbe6647e23c3124547aa033c3886946b2249b7fa5a18b75f1fd2b185704

Download Submit
C:\Windows\System\hflGfbN.exe

Filesize
2.0MB

MD5
35927febd2a4e4bb983f568915d3fa92

SHA1
f28a4b945e09cce916bce694d1b77376c4901886

SHA256
6bf402bdc88f3d5f94c398887537d14ed0113141815d5ae3328dcdacfed2125d

SHA512
f94a4fc6fc4e3c2229d6b317c68e1fe2be9bb54ef6f677b9c41c4c3acb2b7c6a8eaad1d45be0cf27ab0787e5e80e92914c5812558c893228a8b36164742ba84e

Download Submit
C:\Windows\System\iaxMtAp.exe

Filesize
2.0MB

MD5
a9885efa71c990e8430a6e42e06649d3

SHA1
e8f9302523bee8daf64c9b3ba3f6eb115d1db6b8

SHA256
de40ee0b5c0c7f80aead8a15e00c256adf6e571708146f1c27e5779333d9bd2c

SHA512
24ad809109ef0761e6aa85138820b066bb59ec468f704c8892ad283252f9a9dd25333e4b55ac1e2214e3b6280beef7f379700bc09c6634ffa650f6083861058b

Download Submit
C:\Windows\System\juczWxM.exe

Filesize
2.0MB

MD5
a6c41ae22759bab644aa3b513f7de0e4

SHA1
f9d02388e6ac9f9d88d192b8c62c51f7ceabd8a3

SHA256
d9bca56c4675478d37fbf0f7f391a0b503b6bb059aa02cc32ee258565fbaf719

SHA512
3ec779e6d7d9b0a15fce7da25db69aaf901968c565c406b49e799ce5e113ae5362d91f98c2a1d0a0d044f53e568a8643c6bd81c5f05db9a49fd6409ee461abea

Download Submit
C:\Windows\System\kApTvcB.exe

Filesize
2.0MB

MD5
8ac347f38152a73b3a2d67d60e590d6d

SHA1
eecc72c68a6077d890dc12bf0a0d1ef731f1b09d

SHA256
6b7e35dad5440060f295e0157dd1fae3b72bbaba81c02964525278b8186d3cf0

SHA512
46ad4ae43a9462697a98521c4b382f2e0df4f9f1a480ca4722a3957bb64b3912b528882a6bf023193e83f9adbee97ae01343830ae05406edeca88c418cdf39d5

Download Submit
C:\Windows\System\kBJEYTl.exe

Filesize
2.0MB

MD5
1a1f10d739d27717e014af76c8ad515a

SHA1
4eabbdd6744c19baf590943da3fe28de6707dd92

SHA256
c96e0acc34018f82f5d1932fe4bbe2ae18adc849831510a576dfe1ec698b5e1d

SHA512
ab904e4772a1230810337a92c3197a006a9a5a43b6ff913490513aa8fd00cc70b6b4aeb596987ec96956a91aadcbf6b4543ec40f3fd2fda74915af77326707a7

Download Submit
C:\Windows\System\kbyvfoY.exe

Filesize
2.0MB

MD5
22deb1d584d84d0ad9ad0ae33fe98401

SHA1
84f85b505bef36c1258c03e305b64dd4ebaef46d

SHA256
5561d6b177a1a0cd71cd9f736c85475a59861504edf7ce2e1337b1da30decbe4

SHA512
e1e3ce2eac94350cf30581ff63f131420f70dc15ff127a6285fadb8be9a5506c2b247a71133478596ec8d97ef9439e334ea1b87ea1e0a78dec953a460aa7a930

Download Submit
C:\Windows\System\mYSbRpO.exe

Filesize
2.0MB

MD5
bdc8aff5456439b5606e73506766e887

SHA1
3f57ab63fa6b54203450e625fd39935463ff03aa

SHA256
72985e4653003a1811efc2c26c65bc48b0ba970a034389976110f8b7a5ac06f7

SHA512
645a1687c52be47cbc6dec35e084f4ff95c4a0e89bea7257894327015851355526bdf0ce67778dc844824647e127e24988b6d20f5e7f3b414d70f35492132be5

Download Submit
C:\Windows\System\mhVNxvG.exe

Filesize
2.0MB

MD5
8c7e26d88960e588bb6c431ca495b93f

SHA1
2d82d5931d4918ef5b11025ff89cb39784daefa9

SHA256
f511fca4eae2164f337e9c092bfe2ad5a133ab8ad1a24d05e7a460dcefca122e

SHA512
ba728aba20e01823ce29856fa91b9985dbc267d58bd37c2cba2a282c2217f941ce98a2b4cde913d0d9e7db5e2c883871cd340568304b386626f86f9a288cf397

Download Submit
C:\Windows\System\naWPEmR.exe

Filesize
2.0MB

MD5
5ae2cf731d57268360d8b0022e9c0127

SHA1
0b49c4cf2d318fd8dc755b4d608a666a518b1bdb

SHA256
53a47bb19efe17711fec82b07f00687589bdb26093cdcb5d36f74ada6c6b1147

SHA512
840da895fbaa22aaceaf0bf02428de9896b9f274f7374ab8790f540184adfb40e4de9f5fc333c1ac958311e7de9f8551b4894c15267015be0d2d52d1d4850f12

Download Submit
C:\Windows\System\puvPxWj.exe

Filesize
2.0MB

MD5
68f3274a4fe051a3eb4def57b8320235

SHA1
199d759dfd10be108925bf675612ea5a4a220021

SHA256
83d4b71c9455a96394d5cd66c4d41ce37ba6e34ec93849853a99e52375f950da

SHA512
de7824f4877dac81d9b3ea82021c87d8ebbb1a557e0eaf58fab14c64aa2ea08e5ecd8f01f646b56d33ccb1eb4212acd1550b68f3d64222cc3540f3d41fc4b8fd

Download Submit
C:\Windows\System\sQXRMDO.exe

Filesize
2.0MB

MD5
83f4edbe572e78afd2217282642211e6

SHA1
686af0dda21344e8ca4da3ef55172ab7ac85e66b

SHA256
bc261612a132848218b89f945bb6f2d0b2374070a71d7bcd756598f9d507f63b

SHA512
dce44435814e7cfdba1720e0eda207b721fbd6d229b5cddf6aba92777bf0f083249883f5b2fc67c0f42279c992162321fbb0ea54f24f4feb3606b34a5d3671d6

Download Submit
C:\Windows\System\yunLgSB.exe

Filesize
2.0MB

MD5
b6c4e457cf39a72319c86ab7334422a1

SHA1
71f6ab37bdfec6f54133f9fc2348c4b683b1fe90

SHA256
8f475400176ba3be9d29ef81328253be9949160056be96adb243d32a5a15fc06

SHA512
5e3370155887f2d836512001d7dc35b942b31d5cb5ba604aa3f93fc15c02855543921d5160c47e8f75d0e7b34364f4533285ee6300ab057f2010311107c0c0eb

Download Submit
memory/684-2653-0x00007FF732790000-0x00007FF732B82000-memory.dmp

Filesize
3.9MB

Download
memory/684-185-0x00007FF732790000-0x00007FF732B82000-memory.dmp

Filesize
3.9MB

Download
memory/716-2646-0x00007FF657E70000-0x00007FF658262000-memory.dmp

Filesize
3.9MB

Download
memory/716-181-0x00007FF657E70000-0x00007FF658262000-memory.dmp

Filesize
3.9MB

Download
memory/968-2650-0x00007FF636B90000-0x00007FF636F82000-memory.dmp

Filesize
3.9MB

Download
memory/968-184-0x00007FF636B90000-0x00007FF636F82000-memory.dmp

Filesize
3.9MB

Download
memory/1124-102-0x00007FF7C3740000-0x00007FF7C3B32000-memory.dmp

Filesize
3.9MB

Download
memory/1124-2640-0x00007FF7C3740000-0x00007FF7C3B32000-memory.dmp

Filesize
3.9MB

Download
memory/1124-2595-0x00007FF7C3740000-0x00007FF7C3B32000-memory.dmp

Filesize
3.9MB

Download
memory/1208-0-0x00007FF7433F0000-0x00007FF7437E2000-memory.dmp

Filesize
3.9MB

Download
memory/1208-1-0x000001E40EC70000-0x000001E40EC80000-memory.dmp

Filesize
64KB

Download
memory/1992-193-0x00007FF65FD10000-0x00007FF660102000-memory.dmp

Filesize
3.9MB

Download
memory/1992-2637-0x00007FF65FD10000-0x00007FF660102000-memory.dmp

Filesize
3.9MB

Download
memory/2060-2651-0x00007FF72BCE0000-0x00007FF72C0D2000-memory.dmp

Filesize
3.9MB

Download
memory/2060-144-0x00007FF72BCE0000-0x00007FF72C0D2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-2657-0x00007FF6648D0000-0x00007FF664CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-190-0x00007FF6648D0000-0x00007FF664CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-264-0x00007FF7DEC40000-0x00007FF7DF032000-memory.dmp

Filesize
3.9MB

Download
memory/2348-2643-0x00007FF7DEC40000-0x00007FF7DF032000-memory.dmp

Filesize
3.9MB

Download
memory/2384-2593-0x00007FF75FFE0000-0x00007FF7603D2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-51-0x00007FF75FFE0000-0x00007FF7603D2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-2641-0x00007FF75FFE0000-0x00007FF7603D2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-194-0x00007FF656510000-0x00007FF656902000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2674-0x00007FF656510000-0x00007FF656902000-memory.dmp

Filesize
3.9MB

Download
memory/2860-2628-0x00007FF7D5BA0000-0x00007FF7D5F92000-memory.dmp

Filesize
3.9MB

Download
memory/2860-186-0x00007FF7D5BA0000-0x00007FF7D5F92000-memory.dmp

Filesize
3.9MB

Download
memory/2860-2676-0x00007FF7D5BA0000-0x00007FF7D5F92000-memory.dmp

Filesize
3.9MB

Download
memory/3128-862-0x0000021B75220000-0x0000021B75242000-memory.dmp

Filesize
136KB

Download
memory/3184-2635-0x00007FF65DBF0000-0x00007FF65DFE2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-42-0x00007FF65DBF0000-0x00007FF65DFE2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-2592-0x00007FF65DBF0000-0x00007FF65DFE2000-memory.dmp

Filesize
3.9MB

Download
memory/3328-182-0x00007FF6555C0000-0x00007FF6559B2000-memory.dmp

Filesize
3.9MB

Download
memory/3328-2668-0x00007FF6555C0000-0x00007FF6559B2000-memory.dmp

Filesize
3.9MB

Download
memory/3332-283-0x00007FF646E80000-0x00007FF647272000-memory.dmp

Filesize
3.9MB

Download
memory/3332-2679-0x00007FF646E80000-0x00007FF647272000-memory.dmp

Filesize
3.9MB

Download
memory/3356-2663-0x00007FF734410000-0x00007FF734802000-memory.dmp

Filesize
3.9MB

Download
memory/3356-189-0x00007FF734410000-0x00007FF734802000-memory.dmp

Filesize
3.9MB

Download
memory/3952-2629-0x00007FF6C8630000-0x00007FF6C8A22000-memory.dmp

Filesize
3.9MB

Download
memory/3952-188-0x00007FF6C8630000-0x00007FF6C8A22000-memory.dmp

Filesize
3.9MB

Download
memory/3952-2682-0x00007FF6C8630000-0x00007FF6C8A22000-memory.dmp

Filesize
3.9MB

Download
memory/4048-2666-0x00007FF606820000-0x00007FF606C12000-memory.dmp

Filesize
3.9MB

Download
memory/4048-187-0x00007FF606820000-0x00007FF606C12000-memory.dmp

Filesize
3.9MB

Download
memory/4172-27-0x00007FF7C2400000-0x00007FF7C27F2000-memory.dmp

Filesize
3.9MB

Download
memory/4172-2591-0x00007FF7C2400000-0x00007FF7C27F2000-memory.dmp

Filesize
3.9MB

Download
memory/4172-2633-0x00007FF7C2400000-0x00007FF7C27F2000-memory.dmp

Filesize
3.9MB

Download
memory/4472-192-0x00007FF753250000-0x00007FF753642000-memory.dmp

Filesize
3.9MB

Download
memory/4472-2631-0x00007FF753250000-0x00007FF753642000-memory.dmp

Filesize
3.9MB

Download
memory/4488-2655-0x00007FF6BAE80000-0x00007FF6BB272000-memory.dmp

Filesize
3.9MB

Download
memory/4488-191-0x00007FF6BAE80000-0x00007FF6BB272000-memory.dmp

Filesize
3.9MB

Download
memory/4584-273-0x00007FF71E200000-0x00007FF71E5F2000-memory.dmp

Filesize
3.9MB

Download
memory/4584-2648-0x00007FF71E200000-0x00007FF71E5F2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-2594-0x00007FF7E3D80000-0x00007FF7E4172000-memory.dmp

Filesize
3.9MB

Download
memory/4860-72-0x00007FF7E3D80000-0x00007FF7E4172000-memory.dmp

Filesize
3.9MB

Download
memory/4860-2678-0x00007FF7E3D80000-0x00007FF7E4172000-memory.dmp

Filesize
3.9MB

Download
memory/4868-2659-0x00007FF7A8CD0000-0x00007FF7A90C2000-memory.dmp

Filesize
3.9MB

Download
memory/4868-180-0x00007FF7A8CD0000-0x00007FF7A90C2000-memory.dmp

Filesize
3.9MB

Download
memory/4924-2662-0x00007FF6D4780000-0x00007FF6D4B72000-memory.dmp

Filesize
3.9MB

Download
memory/4924-183-0x00007FF6D4780000-0x00007FF6D4B72000-memory.dmp

Filesize
3.9MB

Download