xmrig | 7b718f37848a5eb12747846f9532e1c4d62f0a7071b6408fdee1d1cf0cfccffd

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81ae840bcd3f9a123da17ac3532501a0N.exe
Size

1.8MB
MD5

81ae840bcd3f9a123da17ac3532501a0
SHA1

b585c069f12f52729747125e7de68db0bc0aae26
SHA256

7b718f37848a5eb12747846f9532e1c4d62f0a7071b6408fdee1d1cf0cfccffd
SHA512

4bc34db7aa987fbf8b52fe921c963b325de674887c2bbfd18523c4ce3f855cac2583630d982c045bfea2fbc4a40a5e574f800df5112c5e29334b8882a54d44da
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82S5k7hzDv:NABP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3324-399-0x00007FF6E83B0000-0x00007FF6E87A2000-memory.dmp	xmrig
behavioral2/memory/2444-503-0x00007FF6CCF60000-0x00007FF6CD352000-memory.dmp	xmrig
behavioral2/memory/5056-630-0x00007FF711540000-0x00007FF711932000-memory.dmp	xmrig
behavioral2/memory/1936-637-0x00007FF68BEF0000-0x00007FF68C2E2000-memory.dmp	xmrig
behavioral2/memory/2056-641-0x00007FF7EE400000-0x00007FF7EE7F2000-memory.dmp	xmrig
behavioral2/memory/2484-729-0x00007FF6472E0000-0x00007FF6476D2000-memory.dmp	xmrig
behavioral2/memory/1404-640-0x00007FF7881A0000-0x00007FF788592000-memory.dmp	xmrig
behavioral2/memory/4476-639-0x00007FF6F8860000-0x00007FF6F8C52000-memory.dmp	xmrig
behavioral2/memory/2348-638-0x00007FF74D710000-0x00007FF74DB02000-memory.dmp	xmrig
behavioral2/memory/2952-636-0x00007FF733140000-0x00007FF733532000-memory.dmp	xmrig
behavioral2/memory/4900-635-0x00007FF7DA360000-0x00007FF7DA752000-memory.dmp	xmrig
behavioral2/memory/2116-634-0x00007FF701D40000-0x00007FF702132000-memory.dmp	xmrig
behavioral2/memory/2924-633-0x00007FF7C37C0000-0x00007FF7C3BB2000-memory.dmp	xmrig
behavioral2/memory/3948-632-0x00007FF77CC40000-0x00007FF77D032000-memory.dmp	xmrig
behavioral2/memory/768-631-0x00007FF7CE440000-0x00007FF7CE832000-memory.dmp	xmrig
behavioral2/memory/844-629-0x00007FF7A5030000-0x00007FF7A5422000-memory.dmp	xmrig
behavioral2/memory/4180-628-0x00007FF72B6A0000-0x00007FF72BA92000-memory.dmp	xmrig
behavioral2/memory/3908-627-0x00007FF66C210000-0x00007FF66C602000-memory.dmp	xmrig
behavioral2/memory/3540-626-0x00007FF708930000-0x00007FF708D22000-memory.dmp	xmrig
behavioral2/memory/2260-625-0x00007FF6B6400000-0x00007FF6B67F2000-memory.dmp	xmrig
behavioral2/memory/436-306-0x00007FF667290000-0x00007FF667682000-memory.dmp	xmrig
behavioral2/memory/1916-305-0x00007FF6A0170000-0x00007FF6A0562000-memory.dmp	xmrig
behavioral2/memory/3288-27-0x00007FF60F360000-0x00007FF60F752000-memory.dmp	xmrig
behavioral2/memory/3932-21-0x00007FF7B7490000-0x00007FF7B7882000-memory.dmp	xmrig
behavioral2/memory/540-2588-0x00007FF7F7EC0000-0x00007FF7F82B2000-memory.dmp	xmrig
behavioral2/memory/3288-2656-0x00007FF60F360000-0x00007FF60F752000-memory.dmp	xmrig
behavioral2/memory/3932-2662-0x00007FF7B7490000-0x00007FF7B7882000-memory.dmp	xmrig
behavioral2/memory/436-2668-0x00007FF667290000-0x00007FF667682000-memory.dmp	xmrig
behavioral2/memory/2444-2670-0x00007FF6CCF60000-0x00007FF6CD352000-memory.dmp	xmrig
behavioral2/memory/2056-2676-0x00007FF7EE400000-0x00007FF7EE7F2000-memory.dmp	xmrig
behavioral2/memory/2260-2675-0x00007FF6B6400000-0x00007FF6B67F2000-memory.dmp	xmrig
behavioral2/memory/1916-2673-0x00007FF6A0170000-0x00007FF6A0562000-memory.dmp	xmrig
behavioral2/memory/3324-2678-0x00007FF6E83B0000-0x00007FF6E87A2000-memory.dmp	xmrig
behavioral2/memory/1404-2680-0x00007FF7881A0000-0x00007FF788592000-memory.dmp	xmrig
behavioral2/memory/2116-2687-0x00007FF701D40000-0x00007FF702132000-memory.dmp	xmrig
behavioral2/memory/3540-2689-0x00007FF708930000-0x00007FF708D22000-memory.dmp	xmrig
behavioral2/memory/3948-2690-0x00007FF77CC40000-0x00007FF77D032000-memory.dmp	xmrig
behavioral2/memory/4180-2685-0x00007FF72B6A0000-0x00007FF72BA92000-memory.dmp	xmrig
behavioral2/memory/3908-2683-0x00007FF66C210000-0x00007FF66C602000-memory.dmp	xmrig
behavioral2/memory/2924-2698-0x00007FF7C37C0000-0x00007FF7C3BB2000-memory.dmp	xmrig
behavioral2/memory/2484-2700-0x00007FF6472E0000-0x00007FF6476D2000-memory.dmp	xmrig
behavioral2/memory/844-2696-0x00007FF7A5030000-0x00007FF7A5422000-memory.dmp	xmrig
behavioral2/memory/5056-2695-0x00007FF711540000-0x00007FF711932000-memory.dmp	xmrig
behavioral2/memory/768-2693-0x00007FF7CE440000-0x00007FF7CE832000-memory.dmp	xmrig
behavioral2/memory/1936-2705-0x00007FF68BEF0000-0x00007FF68C2E2000-memory.dmp	xmrig
behavioral2/memory/4476-2710-0x00007FF6F8860000-0x00007FF6F8C52000-memory.dmp	xmrig
behavioral2/memory/4900-2707-0x00007FF7DA360000-0x00007FF7DA752000-memory.dmp	xmrig
behavioral2/memory/2952-2714-0x00007FF733140000-0x00007FF733532000-memory.dmp	xmrig
behavioral2/memory/2348-2712-0x00007FF74D710000-0x00007FF74DB02000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4968	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3932	nZRIBNQ.exe
3288	qbdUmTT.exe
1404	LhFoWPI.exe
2056	SywuxJU.exe
1916	QXvJRwl.exe
436	yqRNdUZ.exe
3324	KYQElcl.exe
2444	GLhWNkC.exe
2260	jMeRoXt.exe
3540	KfULpwQ.exe
3908	vAqJMdr.exe
4180	NSzROcb.exe
844	KqYruss.exe
5056	kphayMX.exe
768	fsxvrwv.exe
3948	lmVwhPj.exe
2924	LbcihnS.exe
2116	zzmUVlx.exe
2484	StFLxMU.exe
4900	iPuSOtV.exe
2952	ztQAuUp.exe
1936	tvYnGCC.exe
2348	shdFXhF.exe
4476	vNwDeal.exe
2832	hgcIYBh.exe
668	nRjOMAw.exe
4836	HSBPlrQ.exe
2060	wUcCnHs.exe
720	JBGpAxV.exe
2480	UriDbyl.exe
2600	MHnVnEB.exe
2356	ToAVQli.exe
5092	wiWOfjN.exe
1512	HRibTQp.exe
4488	OZulPBq.exe
1668	yKHnbmp.exe
4888	VQAYAGD.exe
1836	ijNehSL.exe
1748	xryMbPy.exe
4964	alyOqkk.exe
4044	mJzJeVY.exe
4292	UuzNQyM.exe
3060	cHHYXVc.exe
4976	VtbqVPu.exe
5088	DMPexzh.exe
4132	lAAZoxd.exe
2508	SPauPCF.exe
3940	ZQmHEfI.exe
3640	kzIyJee.exe
3132	bExvzDX.exe
4928	JttUlWn.exe
2672	UqXkDBA.exe
4528	QPYKeQN.exe
4684	vTheNJo.exe
468	rKTinpY.exe
2404	JYKpTLX.exe
548	ugJYsxJ.exe
4060	XAbopvZ.exe
3316	AEeVFWU.exe
2824	rZFnKxG.exe
3552	XJDMyCm.exe
2768	JohmGRR.exe
4816	VnFmLKb.exe
2180	ZJPJgiq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/540-0-0x00007FF7F7EC0000-0x00007FF7F82B2000-memory.dmp	upx
behavioral2/files/0x00080000000234d6-8.dat	upx
behavioral2/files/0x00070000000234d8-29.dat	upx
behavioral2/files/0x00070000000234de-64.dat	upx
behavioral2/memory/3324-399-0x00007FF6E83B0000-0x00007FF6E87A2000-memory.dmp	upx
behavioral2/memory/2444-503-0x00007FF6CCF60000-0x00007FF6CD352000-memory.dmp	upx
behavioral2/memory/5056-630-0x00007FF711540000-0x00007FF711932000-memory.dmp	upx
behavioral2/memory/1936-637-0x00007FF68BEF0000-0x00007FF68C2E2000-memory.dmp	upx
behavioral2/memory/2056-641-0x00007FF7EE400000-0x00007FF7EE7F2000-memory.dmp	upx
behavioral2/memory/2484-729-0x00007FF6472E0000-0x00007FF6476D2000-memory.dmp	upx
behavioral2/memory/1404-640-0x00007FF7881A0000-0x00007FF788592000-memory.dmp	upx
behavioral2/memory/4476-639-0x00007FF6F8860000-0x00007FF6F8C52000-memory.dmp	upx
behavioral2/memory/2348-638-0x00007FF74D710000-0x00007FF74DB02000-memory.dmp	upx
behavioral2/memory/2952-636-0x00007FF733140000-0x00007FF733532000-memory.dmp	upx
behavioral2/memory/4900-635-0x00007FF7DA360000-0x00007FF7DA752000-memory.dmp	upx
behavioral2/memory/2116-634-0x00007FF701D40000-0x00007FF702132000-memory.dmp	upx
behavioral2/memory/2924-633-0x00007FF7C37C0000-0x00007FF7C3BB2000-memory.dmp	upx
behavioral2/memory/3948-632-0x00007FF77CC40000-0x00007FF77D032000-memory.dmp	upx
behavioral2/memory/768-631-0x00007FF7CE440000-0x00007FF7CE832000-memory.dmp	upx
behavioral2/memory/844-629-0x00007FF7A5030000-0x00007FF7A5422000-memory.dmp	upx
behavioral2/memory/4180-628-0x00007FF72B6A0000-0x00007FF72BA92000-memory.dmp	upx
behavioral2/memory/3908-627-0x00007FF66C210000-0x00007FF66C602000-memory.dmp	upx
behavioral2/memory/3540-626-0x00007FF708930000-0x00007FF708D22000-memory.dmp	upx
behavioral2/memory/2260-625-0x00007FF6B6400000-0x00007FF6B67F2000-memory.dmp	upx
behavioral2/memory/436-306-0x00007FF667290000-0x00007FF667682000-memory.dmp	upx
behavioral2/memory/1916-305-0x00007FF6A0170000-0x00007FF6A0562000-memory.dmp	upx
behavioral2/files/0x00070000000234fe-216.dat	upx
behavioral2/files/0x00070000000234ea-213.dat	upx
behavioral2/files/0x00070000000234e9-206.dat	upx
behavioral2/files/0x00070000000234f2-200.dat	upx
behavioral2/files/0x00070000000234fd-197.dat	upx
behavioral2/files/0x00070000000234fc-190.dat	upx
behavioral2/files/0x00070000000234fb-182.dat	upx
behavioral2/files/0x00070000000234e7-176.dat	upx
behavioral2/files/0x00070000000234fa-175.dat	upx
behavioral2/files/0x00070000000234f9-174.dat	upx
behavioral2/files/0x00070000000234f6-169.dat	upx
behavioral2/files/0x00070000000234f5-166.dat	upx
behavioral2/files/0x00070000000234e5-159.dat	upx
behavioral2/files/0x00070000000234e3-156.dat	upx
behavioral2/files/0x00070000000234e1-145.dat	upx
behavioral2/files/0x00070000000234f1-144.dat	upx
behavioral2/files/0x00070000000234f0-143.dat	upx
behavioral2/files/0x00070000000234ed-126.dat	upx
behavioral2/files/0x00070000000234ec-124.dat	upx
behavioral2/files/0x00070000000234f7-171.dat	upx
behavioral2/files/0x00070000000234f4-163.dat	upx
behavioral2/files/0x00070000000234e4-115.dat	upx
behavioral2/files/0x00070000000234e2-112.dat	upx
behavioral2/files/0x00070000000234f3-150.dat	upx
behavioral2/files/0x00070000000234e0-101.dat	upx
behavioral2/files/0x00070000000234e8-142.dat	upx
behavioral2/files/0x00070000000234ef-141.dat	upx
behavioral2/files/0x00070000000234df-98.dat	upx
behavioral2/files/0x00070000000234ee-136.dat	upx
behavioral2/files/0x00070000000234e6-88.dat	upx
behavioral2/files/0x00070000000234eb-121.dat	upx
behavioral2/files/0x00070000000234dd-66.dat	upx
behavioral2/files/0x00070000000234dc-49.dat	upx
behavioral2/files/0x00070000000234db-45.dat	upx
behavioral2/files/0x00070000000234da-44.dat	upx
behavioral2/files/0x00070000000234d9-41.dat	upx
behavioral2/files/0x00070000000234d7-52.dat	upx
behavioral2/memory/3288-27-0x00007FF60F360000-0x00007FF60F752000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FbEGrHz.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\EgHmSLd.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\wtxifeS.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\dBVJRMc.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\qOyyKMG.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\JuSSnxg.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\fyGbrlQ.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\eiCqLem.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\UollTSl.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\OJyxOeV.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\IcqYPCH.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\llrAnVB.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\tLuJnkj.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\opEQIWS.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\tHifTLg.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\VZEfKwI.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\BpXfdfd.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\udIFGwN.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\PmsrmDY.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\YVDxWFW.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\jeaUtjo.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\bTbkQcU.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\yGHVPmT.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\epRQhYd.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\GZkDjBt.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\PcSnPzu.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\ZdbgFTO.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\bfdpyQp.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\qkgzgtw.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\RoNfyIw.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\OfTdNTb.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\ATPqUfF.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\jhDucGr.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\zAWQZKi.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\KXNokfN.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\arJdJBd.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\msOEfOM.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\CWxnoRL.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\DlcDmgi.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\ZmzWAXI.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\shdFXhF.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\MTkRDLR.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\BqvRHpt.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\galvKtY.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\mzdbPxB.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\GlBokiN.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\miyBDtb.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\EVuZOWw.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\MukdZNm.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\SiLeYPZ.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\HxYpBNn.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\jqmGdsu.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\lIwqZQm.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\ZhAsdZs.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\JWREBXy.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\AHTfePY.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\MOUrWXQ.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\ICJyVPR.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\niZBgPV.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\mNGKsIZ.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\lAuWgfB.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\NnseCmQ.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\yMHUUDH.exe	81ae840bcd3f9a123da17ac3532501a0N.exe
File created	C:\Windows\System\PqHrFqi.exe	81ae840bcd3f9a123da17ac3532501a0N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeLockMemoryPrivilege	540	81ae840bcd3f9a123da17ac3532501a0N.exe
Token: SeLockMemoryPrivilege	540	81ae840bcd3f9a123da17ac3532501a0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4968	540	81ae840bcd3f9a123da17ac3532501a0N.exe	84
PID 540 wrote to memory of 4968	540	81ae840bcd3f9a123da17ac3532501a0N.exe	84
PID 540 wrote to memory of 3932	540	81ae840bcd3f9a123da17ac3532501a0N.exe	85
PID 540 wrote to memory of 3932	540	81ae840bcd3f9a123da17ac3532501a0N.exe	85
PID 540 wrote to memory of 3288	540	81ae840bcd3f9a123da17ac3532501a0N.exe	86
PID 540 wrote to memory of 3288	540	81ae840bcd3f9a123da17ac3532501a0N.exe	86
PID 540 wrote to memory of 1404	540	81ae840bcd3f9a123da17ac3532501a0N.exe	87
PID 540 wrote to memory of 1404	540	81ae840bcd3f9a123da17ac3532501a0N.exe	87
PID 540 wrote to memory of 2056	540	81ae840bcd3f9a123da17ac3532501a0N.exe	88
PID 540 wrote to memory of 2056	540	81ae840bcd3f9a123da17ac3532501a0N.exe	88
PID 540 wrote to memory of 1916	540	81ae840bcd3f9a123da17ac3532501a0N.exe	89
PID 540 wrote to memory of 1916	540	81ae840bcd3f9a123da17ac3532501a0N.exe	89
PID 540 wrote to memory of 436	540	81ae840bcd3f9a123da17ac3532501a0N.exe	90
PID 540 wrote to memory of 436	540	81ae840bcd3f9a123da17ac3532501a0N.exe	90
PID 540 wrote to memory of 3324	540	81ae840bcd3f9a123da17ac3532501a0N.exe	91
PID 540 wrote to memory of 3324	540	81ae840bcd3f9a123da17ac3532501a0N.exe	91
PID 540 wrote to memory of 2444	540	81ae840bcd3f9a123da17ac3532501a0N.exe	92
PID 540 wrote to memory of 2444	540	81ae840bcd3f9a123da17ac3532501a0N.exe	92
PID 540 wrote to memory of 2260	540	81ae840bcd3f9a123da17ac3532501a0N.exe	93
PID 540 wrote to memory of 2260	540	81ae840bcd3f9a123da17ac3532501a0N.exe	93
PID 540 wrote to memory of 3540	540	81ae840bcd3f9a123da17ac3532501a0N.exe	94
PID 540 wrote to memory of 3540	540	81ae840bcd3f9a123da17ac3532501a0N.exe	94
PID 540 wrote to memory of 3908	540	81ae840bcd3f9a123da17ac3532501a0N.exe	95
PID 540 wrote to memory of 3908	540	81ae840bcd3f9a123da17ac3532501a0N.exe	95
PID 540 wrote to memory of 4180	540	81ae840bcd3f9a123da17ac3532501a0N.exe	96
PID 540 wrote to memory of 4180	540	81ae840bcd3f9a123da17ac3532501a0N.exe	96
PID 540 wrote to memory of 844	540	81ae840bcd3f9a123da17ac3532501a0N.exe	97
PID 540 wrote to memory of 844	540	81ae840bcd3f9a123da17ac3532501a0N.exe	97
PID 540 wrote to memory of 5056	540	81ae840bcd3f9a123da17ac3532501a0N.exe	98
PID 540 wrote to memory of 5056	540	81ae840bcd3f9a123da17ac3532501a0N.exe	98
PID 540 wrote to memory of 768	540	81ae840bcd3f9a123da17ac3532501a0N.exe	99
PID 540 wrote to memory of 768	540	81ae840bcd3f9a123da17ac3532501a0N.exe	99
PID 540 wrote to memory of 3948	540	81ae840bcd3f9a123da17ac3532501a0N.exe	100
PID 540 wrote to memory of 3948	540	81ae840bcd3f9a123da17ac3532501a0N.exe	100
PID 540 wrote to memory of 2924	540	81ae840bcd3f9a123da17ac3532501a0N.exe	101
PID 540 wrote to memory of 2924	540	81ae840bcd3f9a123da17ac3532501a0N.exe	101
PID 540 wrote to memory of 2116	540	81ae840bcd3f9a123da17ac3532501a0N.exe	102
PID 540 wrote to memory of 2116	540	81ae840bcd3f9a123da17ac3532501a0N.exe	102
PID 540 wrote to memory of 2484	540	81ae840bcd3f9a123da17ac3532501a0N.exe	103
PID 540 wrote to memory of 2484	540	81ae840bcd3f9a123da17ac3532501a0N.exe	103
PID 540 wrote to memory of 4836	540	81ae840bcd3f9a123da17ac3532501a0N.exe	104
PID 540 wrote to memory of 4836	540	81ae840bcd3f9a123da17ac3532501a0N.exe	104
PID 540 wrote to memory of 4900	540	81ae840bcd3f9a123da17ac3532501a0N.exe	105
PID 540 wrote to memory of 4900	540	81ae840bcd3f9a123da17ac3532501a0N.exe	105
PID 540 wrote to memory of 2952	540	81ae840bcd3f9a123da17ac3532501a0N.exe	106
PID 540 wrote to memory of 2952	540	81ae840bcd3f9a123da17ac3532501a0N.exe	106
PID 540 wrote to memory of 1936	540	81ae840bcd3f9a123da17ac3532501a0N.exe	107
PID 540 wrote to memory of 1936	540	81ae840bcd3f9a123da17ac3532501a0N.exe	107
PID 540 wrote to memory of 2348	540	81ae840bcd3f9a123da17ac3532501a0N.exe	108
PID 540 wrote to memory of 2348	540	81ae840bcd3f9a123da17ac3532501a0N.exe	108
PID 540 wrote to memory of 4476	540	81ae840bcd3f9a123da17ac3532501a0N.exe	109
PID 540 wrote to memory of 4476	540	81ae840bcd3f9a123da17ac3532501a0N.exe	109
PID 540 wrote to memory of 2832	540	81ae840bcd3f9a123da17ac3532501a0N.exe	110
PID 540 wrote to memory of 2832	540	81ae840bcd3f9a123da17ac3532501a0N.exe	110
PID 540 wrote to memory of 668	540	81ae840bcd3f9a123da17ac3532501a0N.exe	111
PID 540 wrote to memory of 668	540	81ae840bcd3f9a123da17ac3532501a0N.exe	111
PID 540 wrote to memory of 2060	540	81ae840bcd3f9a123da17ac3532501a0N.exe	112
PID 540 wrote to memory of 2060	540	81ae840bcd3f9a123da17ac3532501a0N.exe	112
PID 540 wrote to memory of 720	540	81ae840bcd3f9a123da17ac3532501a0N.exe	113
PID 540 wrote to memory of 720	540	81ae840bcd3f9a123da17ac3532501a0N.exe	113
PID 540 wrote to memory of 2480	540	81ae840bcd3f9a123da17ac3532501a0N.exe	114
PID 540 wrote to memory of 2480	540	81ae840bcd3f9a123da17ac3532501a0N.exe	114
PID 540 wrote to memory of 2600	540	81ae840bcd3f9a123da17ac3532501a0N.exe	115
PID 540 wrote to memory of 2600	540	81ae840bcd3f9a123da17ac3532501a0N.exe	115

C:\Users\Admin\AppData\Local\Temp\81ae840bcd3f9a123da17ac3532501a0N.exe
"C:\Users\Admin\AppData\Local\Temp\81ae840bcd3f9a123da17ac3532501a0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\System\nZRIBNQ.exe
  C:\Windows\System\nZRIBNQ.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\qbdUmTT.exe
  C:\Windows\System\qbdUmTT.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\LhFoWPI.exe
  C:\Windows\System\LhFoWPI.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\SywuxJU.exe
  C:\Windows\System\SywuxJU.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\QXvJRwl.exe
  C:\Windows\System\QXvJRwl.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\yqRNdUZ.exe
  C:\Windows\System\yqRNdUZ.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\KYQElcl.exe
  C:\Windows\System\KYQElcl.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\GLhWNkC.exe
  C:\Windows\System\GLhWNkC.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\jMeRoXt.exe
  C:\Windows\System\jMeRoXt.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\KfULpwQ.exe
  C:\Windows\System\KfULpwQ.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\vAqJMdr.exe
  C:\Windows\System\vAqJMdr.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\NSzROcb.exe
  C:\Windows\System\NSzROcb.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\KqYruss.exe
  C:\Windows\System\KqYruss.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\kphayMX.exe
  C:\Windows\System\kphayMX.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\fsxvrwv.exe
  C:\Windows\System\fsxvrwv.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\lmVwhPj.exe
  C:\Windows\System\lmVwhPj.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\LbcihnS.exe
  C:\Windows\System\LbcihnS.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\zzmUVlx.exe
  C:\Windows\System\zzmUVlx.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\StFLxMU.exe
  C:\Windows\System\StFLxMU.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\HSBPlrQ.exe
  C:\Windows\System\HSBPlrQ.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\iPuSOtV.exe
  C:\Windows\System\iPuSOtV.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\ztQAuUp.exe
  C:\Windows\System\ztQAuUp.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\tvYnGCC.exe
  C:\Windows\System\tvYnGCC.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\shdFXhF.exe
  C:\Windows\System\shdFXhF.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\vNwDeal.exe
  C:\Windows\System\vNwDeal.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\hgcIYBh.exe
  C:\Windows\System\hgcIYBh.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\nRjOMAw.exe
  C:\Windows\System\nRjOMAw.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\wUcCnHs.exe
  C:\Windows\System\wUcCnHs.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\JBGpAxV.exe
  C:\Windows\System\JBGpAxV.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\UriDbyl.exe
  C:\Windows\System\UriDbyl.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\MHnVnEB.exe
  C:\Windows\System\MHnVnEB.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\ToAVQli.exe
  C:\Windows\System\ToAVQli.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\wiWOfjN.exe
  C:\Windows\System\wiWOfjN.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\HRibTQp.exe
  C:\Windows\System\HRibTQp.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\OZulPBq.exe
  C:\Windows\System\OZulPBq.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\SPauPCF.exe
  C:\Windows\System\SPauPCF.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\yKHnbmp.exe
  C:\Windows\System\yKHnbmp.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\VQAYAGD.exe
  C:\Windows\System\VQAYAGD.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\ijNehSL.exe
  C:\Windows\System\ijNehSL.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\xryMbPy.exe
  C:\Windows\System\xryMbPy.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\alyOqkk.exe
  C:\Windows\System\alyOqkk.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\mJzJeVY.exe
  C:\Windows\System\mJzJeVY.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\XJDMyCm.exe
  C:\Windows\System\XJDMyCm.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\UuzNQyM.exe
  C:\Windows\System\UuzNQyM.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\cHHYXVc.exe
  C:\Windows\System\cHHYXVc.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\VtbqVPu.exe
  C:\Windows\System\VtbqVPu.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\DMPexzh.exe
  C:\Windows\System\DMPexzh.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\lAAZoxd.exe
  C:\Windows\System\lAAZoxd.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\ZQmHEfI.exe
  C:\Windows\System\ZQmHEfI.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\kzIyJee.exe
  C:\Windows\System\kzIyJee.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\bExvzDX.exe
  C:\Windows\System\bExvzDX.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\JttUlWn.exe
  C:\Windows\System\JttUlWn.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\UqXkDBA.exe
  C:\Windows\System\UqXkDBA.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\QPYKeQN.exe
  C:\Windows\System\QPYKeQN.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\HoWCbFi.exe
  C:\Windows\System\HoWCbFi.exe
  2⤵
  PID:4664
- C:\Windows\System\vTheNJo.exe
  C:\Windows\System\vTheNJo.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\rKTinpY.exe
  C:\Windows\System\rKTinpY.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\JYKpTLX.exe
  C:\Windows\System\JYKpTLX.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\ugJYsxJ.exe
  C:\Windows\System\ugJYsxJ.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\XAbopvZ.exe
  C:\Windows\System\XAbopvZ.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\AEeVFWU.exe
  C:\Windows\System\AEeVFWU.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\rZFnKxG.exe
  C:\Windows\System\rZFnKxG.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\JohmGRR.exe
  C:\Windows\System\JohmGRR.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\gGMzvav.exe
  C:\Windows\System\gGMzvav.exe
  2⤵
  PID:1536
- C:\Windows\System\VnFmLKb.exe
  C:\Windows\System\VnFmLKb.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\ZJPJgiq.exe
  C:\Windows\System\ZJPJgiq.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\kyYUllP.exe
  C:\Windows\System\kyYUllP.exe
  2⤵
  PID:4572
- C:\Windows\System\ZBXdmHa.exe
  C:\Windows\System\ZBXdmHa.exe
  2⤵
  PID:3844
- C:\Windows\System\eCeXZkU.exe
  C:\Windows\System\eCeXZkU.exe
  2⤵
  PID:4872
- C:\Windows\System\IulyGVG.exe
  C:\Windows\System\IulyGVG.exe
  2⤵
  PID:3300
- C:\Windows\System\wZStGNJ.exe
  C:\Windows\System\wZStGNJ.exe
  2⤵
  PID:3308
- C:\Windows\System\gSmKfqv.exe
  C:\Windows\System\gSmKfqv.exe
  2⤵
  PID:2008
- C:\Windows\System\inFOXcs.exe
  C:\Windows\System\inFOXcs.exe
  2⤵
  PID:2744
- C:\Windows\System\qBPagZY.exe
  C:\Windows\System\qBPagZY.exe
  2⤵
  PID:4352
- C:\Windows\System\orEoTjP.exe
  C:\Windows\System\orEoTjP.exe
  2⤵
  PID:4324
- C:\Windows\System\qxQtgYo.exe
  C:\Windows\System\qxQtgYo.exe
  2⤵
  PID:3500
- C:\Windows\System\whekpvP.exe
  C:\Windows\System\whekpvP.exe
  2⤵
  PID:5112
- C:\Windows\System\zinwnwH.exe
  C:\Windows\System\zinwnwH.exe
  2⤵
  PID:2856
- C:\Windows\System\RUcpDqm.exe
  C:\Windows\System\RUcpDqm.exe
  2⤵
  PID:3824
- C:\Windows\System\uhNmFKT.exe
  C:\Windows\System\uhNmFKT.exe
  2⤵
  PID:1980
- C:\Windows\System\lysTqaq.exe
  C:\Windows\System\lysTqaq.exe
  2⤵
  PID:1576
- C:\Windows\System\dftEZqM.exe
  C:\Windows\System\dftEZqM.exe
  2⤵
  PID:2808
- C:\Windows\System\UyfwQym.exe
  C:\Windows\System\UyfwQym.exe
  2⤵
  PID:3064
- C:\Windows\System\lRQsQtp.exe
  C:\Windows\System\lRQsQtp.exe
  2⤵
  PID:888
- C:\Windows\System\KHWCigH.exe
  C:\Windows\System\KHWCigH.exe
  2⤵
  PID:4668
- C:\Windows\System\SnvIubk.exe
  C:\Windows\System\SnvIubk.exe
  2⤵
  PID:2584
- C:\Windows\System\NiagHpJ.exe
  C:\Windows\System\NiagHpJ.exe
  2⤵
  PID:2088
- C:\Windows\System\pGZxYKC.exe
  C:\Windows\System\pGZxYKC.exe
  2⤵
  PID:4436
- C:\Windows\System\FrcrSlO.exe
  C:\Windows\System\FrcrSlO.exe
  2⤵
  PID:3224
- C:\Windows\System\SVYzZpu.exe
  C:\Windows\System\SVYzZpu.exe
  2⤵
  PID:732
- C:\Windows\System\hawBGly.exe
  C:\Windows\System\hawBGly.exe
  2⤵
  PID:3800
- C:\Windows\System\jNlZVhk.exe
  C:\Windows\System\jNlZVhk.exe
  2⤵
  PID:644
- C:\Windows\System\HndZdHQ.exe
  C:\Windows\System\HndZdHQ.exe
  2⤵
  PID:2884
- C:\Windows\System\gLhRUhw.exe
  C:\Windows\System\gLhRUhw.exe
  2⤵
  PID:3196
- C:\Windows\System\bFJFzEe.exe
  C:\Windows\System\bFJFzEe.exe
  2⤵
  PID:2352
- C:\Windows\System\jQMiVDR.exe
  C:\Windows\System\jQMiVDR.exe
  2⤵
  PID:1960
- C:\Windows\System\ZJOkeGN.exe
  C:\Windows\System\ZJOkeGN.exe
  2⤵
  PID:3808
- C:\Windows\System\illRDei.exe
  C:\Windows\System\illRDei.exe
  2⤵
  PID:516
- C:\Windows\System\jUKZgiL.exe
  C:\Windows\System\jUKZgiL.exe
  2⤵
  PID:836
- C:\Windows\System\VHROVyE.exe
  C:\Windows\System\VHROVyE.exe
  2⤵
  PID:5132
- C:\Windows\System\rmdAuDU.exe
  C:\Windows\System\rmdAuDU.exe
  2⤵
  PID:5156
- C:\Windows\System\jxchZFN.exe
  C:\Windows\System\jxchZFN.exe
  2⤵
  PID:5172
- C:\Windows\System\BPcFIDX.exe
  C:\Windows\System\BPcFIDX.exe
  2⤵
  PID:5196
- C:\Windows\System\cxJFPRJ.exe
  C:\Windows\System\cxJFPRJ.exe
  2⤵
  PID:5216
- C:\Windows\System\XbfcsVi.exe
  C:\Windows\System\XbfcsVi.exe
  2⤵
  PID:5240
- C:\Windows\System\BzcLEzh.exe
  C:\Windows\System\BzcLEzh.exe
  2⤵
  PID:5260
- C:\Windows\System\zollIYP.exe
  C:\Windows\System\zollIYP.exe
  2⤵
  PID:5280
- C:\Windows\System\rzOaVls.exe
  C:\Windows\System\rzOaVls.exe
  2⤵
  PID:5300
- C:\Windows\System\jZGGDfR.exe
  C:\Windows\System\jZGGDfR.exe
  2⤵
  PID:5324
- C:\Windows\System\SYLCojq.exe
  C:\Windows\System\SYLCojq.exe
  2⤵
  PID:5340
- C:\Windows\System\UOaTSTZ.exe
  C:\Windows\System\UOaTSTZ.exe
  2⤵
  PID:5364
- C:\Windows\System\NjjeQey.exe
  C:\Windows\System\NjjeQey.exe
  2⤵
  PID:5384
- C:\Windows\System\TUpwdsh.exe
  C:\Windows\System\TUpwdsh.exe
  2⤵
  PID:5404
- C:\Windows\System\rmhmvPz.exe
  C:\Windows\System\rmhmvPz.exe
  2⤵
  PID:5428
- C:\Windows\System\lHwFYBS.exe
  C:\Windows\System\lHwFYBS.exe
  2⤵
  PID:5444
- C:\Windows\System\fZQscbO.exe
  C:\Windows\System\fZQscbO.exe
  2⤵
  PID:5472
- C:\Windows\System\wyKPrVy.exe
  C:\Windows\System\wyKPrVy.exe
  2⤵
  PID:5488
- C:\Windows\System\ixnCeWh.exe
  C:\Windows\System\ixnCeWh.exe
  2⤵
  PID:5508
- C:\Windows\System\ErOlycA.exe
  C:\Windows\System\ErOlycA.exe
  2⤵
  PID:5528
- C:\Windows\System\dOJmbVX.exe
  C:\Windows\System\dOJmbVX.exe
  2⤵
  PID:5552
- C:\Windows\System\yrhYalU.exe
  C:\Windows\System\yrhYalU.exe
  2⤵
  PID:5596
- C:\Windows\System\cJCPYhI.exe
  C:\Windows\System\cJCPYhI.exe
  2⤵
  PID:5628
- C:\Windows\System\fuRuqvG.exe
  C:\Windows\System\fuRuqvG.exe
  2⤵
  PID:5656
- C:\Windows\System\UQqVFGt.exe
  C:\Windows\System\UQqVFGt.exe
  2⤵
  PID:5680
- C:\Windows\System\awzizfl.exe
  C:\Windows\System\awzizfl.exe
  2⤵
  PID:5700
- C:\Windows\System\RoNfyIw.exe
  C:\Windows\System\RoNfyIw.exe
  2⤵
  PID:5724
- C:\Windows\System\EbjSmov.exe
  C:\Windows\System\EbjSmov.exe
  2⤵
  PID:5744
- C:\Windows\System\OeUKrke.exe
  C:\Windows\System\OeUKrke.exe
  2⤵
  PID:5764
- C:\Windows\System\yjFkyrX.exe
  C:\Windows\System\yjFkyrX.exe
  2⤵
  PID:5788
- C:\Windows\System\pXTfCLV.exe
  C:\Windows\System\pXTfCLV.exe
  2⤵
  PID:5804
- C:\Windows\System\NrkILdW.exe
  C:\Windows\System\NrkILdW.exe
  2⤵
  PID:5824
- C:\Windows\System\sHJwtKW.exe
  C:\Windows\System\sHJwtKW.exe
  2⤵
  PID:5856
- C:\Windows\System\ayDOTLv.exe
  C:\Windows\System\ayDOTLv.exe
  2⤵
  PID:5880
- C:\Windows\System\lwdzTuJ.exe
  C:\Windows\System\lwdzTuJ.exe
  2⤵
  PID:5900
- C:\Windows\System\ltgSUJL.exe
  C:\Windows\System\ltgSUJL.exe
  2⤵
  PID:5924
- C:\Windows\System\jeaUtjo.exe
  C:\Windows\System\jeaUtjo.exe
  2⤵
  PID:5952
- C:\Windows\System\pNdSQZx.exe
  C:\Windows\System\pNdSQZx.exe
  2⤵
  PID:5972
- C:\Windows\System\HnDruMJ.exe
  C:\Windows\System\HnDruMJ.exe
  2⤵
  PID:5992
- C:\Windows\System\nRJVdHY.exe
  C:\Windows\System\nRJVdHY.exe
  2⤵
  PID:6012
- C:\Windows\System\mFsnPrA.exe
  C:\Windows\System\mFsnPrA.exe
  2⤵
  PID:6036
- C:\Windows\System\oayCORu.exe
  C:\Windows\System\oayCORu.exe
  2⤵
  PID:6052
- C:\Windows\System\VJemYgO.exe
  C:\Windows\System\VJemYgO.exe
  2⤵
  PID:6096
- C:\Windows\System\yHAWoYn.exe
  C:\Windows\System\yHAWoYn.exe
  2⤵
  PID:6120
- C:\Windows\System\wozKVxI.exe
  C:\Windows\System\wozKVxI.exe
  2⤵
  PID:6136
- C:\Windows\System\zkjEpxM.exe
  C:\Windows\System\zkjEpxM.exe
  2⤵
  PID:3344
- C:\Windows\System\IUXtkfX.exe
  C:\Windows\System\IUXtkfX.exe
  2⤵
  PID:952
- C:\Windows\System\HHLOWzT.exe
  C:\Windows\System\HHLOWzT.exe
  2⤵
  PID:2716
- C:\Windows\System\bTbkQcU.exe
  C:\Windows\System\bTbkQcU.exe
  2⤵
  PID:3924
- C:\Windows\System\kwXMxcZ.exe
  C:\Windows\System\kwXMxcZ.exe
  2⤵
  PID:3348
- C:\Windows\System\QPmkWzg.exe
  C:\Windows\System\QPmkWzg.exe
  2⤵
  PID:3228
- C:\Windows\System\LdotBda.exe
  C:\Windows\System\LdotBda.exe
  2⤵
  PID:1704
- C:\Windows\System\AkKSrmX.exe
  C:\Windows\System\AkKSrmX.exe
  2⤵
  PID:4944
- C:\Windows\System\aTPrzGu.exe
  C:\Windows\System\aTPrzGu.exe
  2⤵
  PID:1480
- C:\Windows\System\vajYyBc.exe
  C:\Windows\System\vajYyBc.exe
  2⤵
  PID:5424
- C:\Windows\System\wIbarIz.exe
  C:\Windows\System\wIbarIz.exe
  2⤵
  PID:1204
- C:\Windows\System\xRCbRUn.exe
  C:\Windows\System\xRCbRUn.exe
  2⤵
  PID:456
- C:\Windows\System\iRffEvD.exe
  C:\Windows\System\iRffEvD.exe
  2⤵
  PID:5640
- C:\Windows\System\UwfTGsR.exe
  C:\Windows\System\UwfTGsR.exe
  2⤵
  PID:6152
- C:\Windows\System\hqkBnEY.exe
  C:\Windows\System\hqkBnEY.exe
  2⤵
  PID:6172
- C:\Windows\System\zcfgCnp.exe
  C:\Windows\System\zcfgCnp.exe
  2⤵
  PID:6200
- C:\Windows\System\euqmBmv.exe
  C:\Windows\System\euqmBmv.exe
  2⤵
  PID:6220
- C:\Windows\System\euJQdbP.exe
  C:\Windows\System\euJQdbP.exe
  2⤵
  PID:6248
- C:\Windows\System\ucXSzWB.exe
  C:\Windows\System\ucXSzWB.exe
  2⤵
  PID:6264
- C:\Windows\System\bOjcDzt.exe
  C:\Windows\System\bOjcDzt.exe
  2⤵
  PID:6284
- C:\Windows\System\pWBKoQv.exe
  C:\Windows\System\pWBKoQv.exe
  2⤵
  PID:6304
- C:\Windows\System\nZZeTpF.exe
  C:\Windows\System\nZZeTpF.exe
  2⤵
  PID:6320
- C:\Windows\System\IeocQws.exe
  C:\Windows\System\IeocQws.exe
  2⤵
  PID:6344
- C:\Windows\System\XnecCxF.exe
  C:\Windows\System\XnecCxF.exe
  2⤵
  PID:6368
- C:\Windows\System\MARGbze.exe
  C:\Windows\System\MARGbze.exe
  2⤵
  PID:6388
- C:\Windows\System\wRzSuAi.exe
  C:\Windows\System\wRzSuAi.exe
  2⤵
  PID:6408
- C:\Windows\System\obAJeCY.exe
  C:\Windows\System\obAJeCY.exe
  2⤵
  PID:6444
- C:\Windows\System\ADACeqX.exe
  C:\Windows\System\ADACeqX.exe
  2⤵
  PID:6460
- C:\Windows\System\Hnjtqwu.exe
  C:\Windows\System\Hnjtqwu.exe
  2⤵
  PID:6488
- C:\Windows\System\hHsKIQj.exe
  C:\Windows\System\hHsKIQj.exe
  2⤵
  PID:6508
- C:\Windows\System\xjtMkMP.exe
  C:\Windows\System\xjtMkMP.exe
  2⤵
  PID:6532
- C:\Windows\System\SDcRnWu.exe
  C:\Windows\System\SDcRnWu.exe
  2⤵
  PID:6548
- C:\Windows\System\UDpgYaM.exe
  C:\Windows\System\UDpgYaM.exe
  2⤵
  PID:6568
- C:\Windows\System\uprRvGI.exe
  C:\Windows\System\uprRvGI.exe
  2⤵
  PID:6596
- C:\Windows\System\pLFYjZa.exe
  C:\Windows\System\pLFYjZa.exe
  2⤵
  PID:6612
- C:\Windows\System\sPngMEy.exe
  C:\Windows\System\sPngMEy.exe
  2⤵
  PID:6640
- C:\Windows\System\YIeEqPo.exe
  C:\Windows\System\YIeEqPo.exe
  2⤵
  PID:6656
- C:\Windows\System\fXKtTMy.exe
  C:\Windows\System\fXKtTMy.exe
  2⤵
  PID:6684
- C:\Windows\System\wIeYTUo.exe
  C:\Windows\System\wIeYTUo.exe
  2⤵
  PID:6704
- C:\Windows\System\QjUZEwm.exe
  C:\Windows\System\QjUZEwm.exe
  2⤵
  PID:6732
- C:\Windows\System\kvCuByT.exe
  C:\Windows\System\kvCuByT.exe
  2⤵
  PID:6748
- C:\Windows\System\Ynwjohu.exe
  C:\Windows\System\Ynwjohu.exe
  2⤵
  PID:6768
- C:\Windows\System\UcPOqgQ.exe
  C:\Windows\System\UcPOqgQ.exe
  2⤵
  PID:6784
- C:\Windows\System\njRhLRm.exe
  C:\Windows\System\njRhLRm.exe
  2⤵
  PID:6808
- C:\Windows\System\RJFwMPW.exe
  C:\Windows\System\RJFwMPW.exe
  2⤵
  PID:6824
- C:\Windows\System\SYOTmYV.exe
  C:\Windows\System\SYOTmYV.exe
  2⤵
  PID:6844
- C:\Windows\System\htyqXTW.exe
  C:\Windows\System\htyqXTW.exe
  2⤵
  PID:6872
- C:\Windows\System\pzBIYWh.exe
  C:\Windows\System\pzBIYWh.exe
  2⤵
  PID:6896
- C:\Windows\System\KmiGuZO.exe
  C:\Windows\System\KmiGuZO.exe
  2⤵
  PID:6924
- C:\Windows\System\BOBjeQA.exe
  C:\Windows\System\BOBjeQA.exe
  2⤵
  PID:6948
- C:\Windows\System\YtbDYAq.exe
  C:\Windows\System\YtbDYAq.exe
  2⤵
  PID:6964
- C:\Windows\System\anPvkxg.exe
  C:\Windows\System\anPvkxg.exe
  2⤵
  PID:6988
- C:\Windows\System\OOqPdNy.exe
  C:\Windows\System\OOqPdNy.exe
  2⤵
  PID:7008
- C:\Windows\System\VCCzFMG.exe
  C:\Windows\System\VCCzFMG.exe
  2⤵
  PID:7028
- C:\Windows\System\tHifTLg.exe
  C:\Windows\System\tHifTLg.exe
  2⤵
  PID:7052
- C:\Windows\System\ojYgiKm.exe
  C:\Windows\System\ojYgiKm.exe
  2⤵
  PID:7068
- C:\Windows\System\jBIdVet.exe
  C:\Windows\System\jBIdVet.exe
  2⤵
  PID:7096
- C:\Windows\System\pSFdnOG.exe
  C:\Windows\System\pSFdnOG.exe
  2⤵
  PID:7112
- C:\Windows\System\HYbLbRh.exe
  C:\Windows\System\HYbLbRh.exe
  2⤵
  PID:7140
- C:\Windows\System\ZZGiTcm.exe
  C:\Windows\System\ZZGiTcm.exe
  2⤵
  PID:7164
- C:\Windows\System\IGYyjpi.exe
  C:\Windows\System\IGYyjpi.exe
  2⤵
  PID:3404
- C:\Windows\System\eiRsHtD.exe
  C:\Windows\System\eiRsHtD.exe
  2⤵
  PID:1796
- C:\Windows\System\mtHXnPO.exe
  C:\Windows\System\mtHXnPO.exe
  2⤵
  PID:2312
- C:\Windows\System\XMXMgWk.exe
  C:\Windows\System\XMXMgWk.exe
  2⤵
  PID:2176
- C:\Windows\System\LxysYKo.exe
  C:\Windows\System\LxysYKo.exe
  2⤵
  PID:3944
- C:\Windows\System\shScGhi.exe
  C:\Windows\System\shScGhi.exe
  2⤵
  PID:5868
- C:\Windows\System\XxdKDXJ.exe
  C:\Windows\System\XxdKDXJ.exe
  2⤵
  PID:5940
- C:\Windows\System\nLzTgrO.exe
  C:\Windows\System\nLzTgrO.exe
  2⤵
  PID:5148
- C:\Windows\System\DhbTUYT.exe
  C:\Windows\System\DhbTUYT.exe
  2⤵
  PID:4320
- C:\Windows\System\xFuzADb.exe
  C:\Windows\System\xFuzADb.exe
  2⤵
  PID:4464
- C:\Windows\System\VNaVouN.exe
  C:\Windows\System\VNaVouN.exe
  2⤵
  PID:3788
- C:\Windows\System\rnSthQs.exe
  C:\Windows\System\rnSthQs.exe
  2⤵
  PID:5192
- C:\Windows\System\KqvelrE.exe
  C:\Windows\System\KqvelrE.exe
  2⤵
  PID:5396
- C:\Windows\System\tYAbGGy.exe
  C:\Windows\System\tYAbGGy.exe
  2⤵
  PID:5568
- C:\Windows\System\giFlPWd.exe
  C:\Windows\System\giFlPWd.exe
  2⤵
  PID:5584
- C:\Windows\System\abfutsT.exe
  C:\Windows\System\abfutsT.exe
  2⤵
  PID:5612
- C:\Windows\System\lkqyajf.exe
  C:\Windows\System\lkqyajf.exe
  2⤵
  PID:5664
- C:\Windows\System\foeERsE.exe
  C:\Windows\System\foeERsE.exe
  2⤵
  PID:5732
- C:\Windows\System\yBCJNCh.exe
  C:\Windows\System\yBCJNCh.exe
  2⤵
  PID:3472
- C:\Windows\System\QZPoRBg.exe
  C:\Windows\System\QZPoRBg.exe
  2⤵
  PID:5812
- C:\Windows\System\dSrTOeO.exe
  C:\Windows\System\dSrTOeO.exe
  2⤵
  PID:5852
- C:\Windows\System\PYosbWg.exe
  C:\Windows\System\PYosbWg.exe
  2⤵
  PID:5968
- C:\Windows\System\JAzyaci.exe
  C:\Windows\System\JAzyaci.exe
  2⤵
  PID:6020
- C:\Windows\System\ssZfTcQ.exe
  C:\Windows\System\ssZfTcQ.exe
  2⤵
  PID:6084
- C:\Windows\System\dOzFdXP.exe
  C:\Windows\System\dOzFdXP.exe
  2⤵
  PID:6132
- C:\Windows\System\HzdqCFD.exe
  C:\Windows\System\HzdqCFD.exe
  2⤵
  PID:3900
- C:\Windows\System\SfYSSxI.exe
  C:\Windows\System\SfYSSxI.exe
  2⤵
  PID:404
- C:\Windows\System\kWxwksg.exe
  C:\Windows\System\kWxwksg.exe
  2⤵
  PID:5460
- C:\Windows\System\gYvsrZZ.exe
  C:\Windows\System\gYvsrZZ.exe
  2⤵
  PID:6352
- C:\Windows\System\RdxPCwK.exe
  C:\Windows\System\RdxPCwK.exe
  2⤵
  PID:6556
- C:\Windows\System\rOqSTxs.exe
  C:\Windows\System\rOqSTxs.exe
  2⤵
  PID:6700
- C:\Windows\System\VmUmJuA.exe
  C:\Windows\System\VmUmJuA.exe
  2⤵
  PID:6912
- C:\Windows\System\EWOtJsM.exe
  C:\Windows\System\EWOtJsM.exe
  2⤵
  PID:7120
- C:\Windows\System\McslqtT.exe
  C:\Windows\System\McslqtT.exe
  2⤵
  PID:3396
- C:\Windows\System\BqshnGj.exe
  C:\Windows\System\BqshnGj.exe
  2⤵
  PID:1528
- C:\Windows\System\nTXpmEH.exe
  C:\Windows\System\nTXpmEH.exe
  2⤵
  PID:6364
- C:\Windows\System\ANEFUoq.exe
  C:\Windows\System\ANEFUoq.exe
  2⤵
  PID:6480
- C:\Windows\System\nhAAHgp.exe
  C:\Windows\System\nhAAHgp.exe
  2⤵
  PID:6636
- C:\Windows\System\RLMgxkp.exe
  C:\Windows\System\RLMgxkp.exe
  2⤵
  PID:7644
- C:\Windows\System\oJaPVWM.exe
  C:\Windows\System\oJaPVWM.exe
  2⤵
  PID:7668
- C:\Windows\System\pihaYYG.exe
  C:\Windows\System\pihaYYG.exe
  2⤵
  PID:7688
- C:\Windows\System\wbSxtOK.exe
  C:\Windows\System\wbSxtOK.exe
  2⤵
  PID:7708
- C:\Windows\System\YkGWVJW.exe
  C:\Windows\System\YkGWVJW.exe
  2⤵
  PID:7724
- C:\Windows\System\EIgcgNK.exe
  C:\Windows\System\EIgcgNK.exe
  2⤵
  PID:7752
- C:\Windows\System\WRcIZLc.exe
  C:\Windows\System\WRcIZLc.exe
  2⤵
  PID:7772
- C:\Windows\System\RigYYcA.exe
  C:\Windows\System\RigYYcA.exe
  2⤵
  PID:7788
- C:\Windows\System\TvvMGke.exe
  C:\Windows\System\TvvMGke.exe
  2⤵
  PID:7808
- C:\Windows\System\aQcdHNO.exe
  C:\Windows\System\aQcdHNO.exe
  2⤵
  PID:7828
- C:\Windows\System\WWaAEVs.exe
  C:\Windows\System\WWaAEVs.exe
  2⤵
  PID:7848
- C:\Windows\System\zgXKocH.exe
  C:\Windows\System\zgXKocH.exe
  2⤵
  PID:7868
- C:\Windows\System\SeIylWk.exe
  C:\Windows\System\SeIylWk.exe
  2⤵
  PID:7884
- C:\Windows\System\xglmXeZ.exe
  C:\Windows\System\xglmXeZ.exe
  2⤵
  PID:7904
- C:\Windows\System\FzifIcf.exe
  C:\Windows\System\FzifIcf.exe
  2⤵
  PID:7920
- C:\Windows\System\DWNAmWf.exe
  C:\Windows\System\DWNAmWf.exe
  2⤵
  PID:7936
- C:\Windows\System\cAwvxtO.exe
  C:\Windows\System\cAwvxtO.exe
  2⤵
  PID:7952
- C:\Windows\System\iqtxBJo.exe
  C:\Windows\System\iqtxBJo.exe
  2⤵
  PID:7968
- C:\Windows\System\gfIlhql.exe
  C:\Windows\System\gfIlhql.exe
  2⤵
  PID:8000
- C:\Windows\System\xNabtXN.exe
  C:\Windows\System\xNabtXN.exe
  2⤵
  PID:8024
- C:\Windows\System\BgMHrxj.exe
  C:\Windows\System\BgMHrxj.exe
  2⤵
  PID:8044
- C:\Windows\System\NgohuAb.exe
  C:\Windows\System\NgohuAb.exe
  2⤵
  PID:8096
- C:\Windows\System\pkwpQRS.exe
  C:\Windows\System\pkwpQRS.exe
  2⤵
  PID:6956
- C:\Windows\System\ASWdDDP.exe
  C:\Windows\System\ASWdDDP.exe
  2⤵
  PID:5960
- C:\Windows\System\YgEHzaG.exe
  C:\Windows\System\YgEHzaG.exe
  2⤵
  PID:4520
- C:\Windows\System\krfoFJW.exe
  C:\Windows\System\krfoFJW.exe
  2⤵
  PID:7124
- C:\Windows\System\ikoLfst.exe
  C:\Windows\System\ikoLfst.exe
  2⤵
  PID:3860
- C:\Windows\System\XSrZLzN.exe
  C:\Windows\System\XSrZLzN.exe
  2⤵
  PID:7296
- C:\Windows\System\CFKruTv.exe
  C:\Windows\System\CFKruTv.exe
  2⤵
  PID:6192
- C:\Windows\System\jItTWZd.exe
  C:\Windows\System\jItTWZd.exe
  2⤵
  PID:6256
- C:\Windows\System\zAWQZKi.exe
  C:\Windows\System\zAWQZKi.exe
  2⤵
  PID:6420
- C:\Windows\System\VjANTHh.exe
  C:\Windows\System\VjANTHh.exe
  2⤵
  PID:6544
- C:\Windows\System\UIxjLZj.exe
  C:\Windows\System\UIxjLZj.exe
  2⤵
  PID:6604
- C:\Windows\System\bxWHWLu.exe
  C:\Windows\System\bxWHWLu.exe
  2⤵
  PID:6984
- C:\Windows\System\jshEpie.exe
  C:\Windows\System\jshEpie.exe
  2⤵
  PID:7044
- C:\Windows\System\pHhqjAk.exe
  C:\Windows\System\pHhqjAk.exe
  2⤵
  PID:7104
- C:\Windows\System\uNAZBLS.exe
  C:\Windows\System\uNAZBLS.exe
  2⤵
  PID:5692
- C:\Windows\System\wWjaDES.exe
  C:\Windows\System\wWjaDES.exe
  2⤵
  PID:3696
- C:\Windows\System\NUaSngH.exe
  C:\Windows\System\NUaSngH.exe
  2⤵
  PID:8208
- C:\Windows\System\tjfrVPc.exe
  C:\Windows\System\tjfrVPc.exe
  2⤵
  PID:8228
- C:\Windows\System\RxkWuzz.exe
  C:\Windows\System\RxkWuzz.exe
  2⤵
  PID:8248
- C:\Windows\System\OcEQHYm.exe
  C:\Windows\System\OcEQHYm.exe
  2⤵
  PID:8272
- C:\Windows\System\aPIXcEC.exe
  C:\Windows\System\aPIXcEC.exe
  2⤵
  PID:8296
- C:\Windows\System\GHVtZpl.exe
  C:\Windows\System\GHVtZpl.exe
  2⤵
  PID:8320
- C:\Windows\System\uzUMUwj.exe
  C:\Windows\System\uzUMUwj.exe
  2⤵
  PID:8344
- C:\Windows\System\nnOuUTA.exe
  C:\Windows\System\nnOuUTA.exe
  2⤵
  PID:8364
- C:\Windows\System\ktjsYvs.exe
  C:\Windows\System\ktjsYvs.exe
  2⤵
  PID:8392
- C:\Windows\System\GCaqpol.exe
  C:\Windows\System\GCaqpol.exe
  2⤵
  PID:8408
- C:\Windows\System\VFhTQxU.exe
  C:\Windows\System\VFhTQxU.exe
  2⤵
  PID:8436
- C:\Windows\System\NdYJVeZ.exe
  C:\Windows\System\NdYJVeZ.exe
  2⤵
  PID:8460
- C:\Windows\System\xUYHVZe.exe
  C:\Windows\System\xUYHVZe.exe
  2⤵
  PID:8484
- C:\Windows\System\WYGmCGs.exe
  C:\Windows\System\WYGmCGs.exe
  2⤵
  PID:8504
- C:\Windows\System\SExcpcx.exe
  C:\Windows\System\SExcpcx.exe
  2⤵
  PID:8528
- C:\Windows\System\KpCmyFT.exe
  C:\Windows\System\KpCmyFT.exe
  2⤵
  PID:8552
- C:\Windows\System\misxEnd.exe
  C:\Windows\System\misxEnd.exe
  2⤵
  PID:8572
- C:\Windows\System\XpgaKSf.exe
  C:\Windows\System\XpgaKSf.exe
  2⤵
  PID:8592
- C:\Windows\System\aCORTIG.exe
  C:\Windows\System\aCORTIG.exe
  2⤵
  PID:8616
- C:\Windows\System\BEPqBco.exe
  C:\Windows\System\BEPqBco.exe
  2⤵
  PID:8640
- C:\Windows\System\GSrAaSa.exe
  C:\Windows\System\GSrAaSa.exe
  2⤵
  PID:8656
- C:\Windows\System\KXNokfN.exe
  C:\Windows\System\KXNokfN.exe
  2⤵
  PID:8684
- C:\Windows\System\MbYdvsC.exe
  C:\Windows\System\MbYdvsC.exe
  2⤵
  PID:8704
- C:\Windows\System\SkobfVz.exe
  C:\Windows\System\SkobfVz.exe
  2⤵
  PID:8724
- C:\Windows\System\cJsEGbh.exe
  C:\Windows\System\cJsEGbh.exe
  2⤵
  PID:8744
- C:\Windows\System\gFyCetS.exe
  C:\Windows\System\gFyCetS.exe
  2⤵
  PID:8768
- C:\Windows\System\vMFHzeZ.exe
  C:\Windows\System\vMFHzeZ.exe
  2⤵
  PID:8788
- C:\Windows\System\LNWmTIV.exe
  C:\Windows\System\LNWmTIV.exe
  2⤵
  PID:8808
- C:\Windows\System\wouSBDB.exe
  C:\Windows\System\wouSBDB.exe
  2⤵
  PID:8824
- C:\Windows\System\DtNHtRQ.exe
  C:\Windows\System\DtNHtRQ.exe
  2⤵
  PID:8840
- C:\Windows\System\CXeoQrb.exe
  C:\Windows\System\CXeoQrb.exe
  2⤵
  PID:8864
- C:\Windows\System\CtXKHhB.exe
  C:\Windows\System\CtXKHhB.exe
  2⤵
  PID:8888
- C:\Windows\System\miyBDtb.exe
  C:\Windows\System\miyBDtb.exe
  2⤵
  PID:8904
- C:\Windows\System\XJajmaK.exe
  C:\Windows\System\XJajmaK.exe
  2⤵
  PID:8928
- C:\Windows\System\OaarJCU.exe
  C:\Windows\System\OaarJCU.exe
  2⤵
  PID:8952
- C:\Windows\System\MMbpHev.exe
  C:\Windows\System\MMbpHev.exe
  2⤵
  PID:8980
- C:\Windows\System\nIBWbSe.exe
  C:\Windows\System\nIBWbSe.exe
  2⤵
  PID:8996
- C:\Windows\System\TGsNvuX.exe
  C:\Windows\System\TGsNvuX.exe
  2⤵
  PID:9020
- C:\Windows\System\pZnRpaj.exe
  C:\Windows\System\pZnRpaj.exe
  2⤵
  PID:9044
- C:\Windows\System\qSCDVYZ.exe
  C:\Windows\System\qSCDVYZ.exe
  2⤵
  PID:9072
- C:\Windows\System\zjXzKLW.exe
  C:\Windows\System\zjXzKLW.exe
  2⤵
  PID:9088
- C:\Windows\System\qbLjska.exe
  C:\Windows\System\qbLjska.exe
  2⤵
  PID:9116
- C:\Windows\System\xbTJoKV.exe
  C:\Windows\System\xbTJoKV.exe
  2⤵
  PID:9136
- C:\Windows\System\ykUXCFK.exe
  C:\Windows\System\ykUXCFK.exe
  2⤵
  PID:9156
- C:\Windows\System\HxLyZNt.exe
  C:\Windows\System\HxLyZNt.exe
  2⤵
  PID:9184
- C:\Windows\System\zLDzKOz.exe
  C:\Windows\System\zLDzKOz.exe
  2⤵
  PID:9200
- C:\Windows\System\vbqvcvf.exe
  C:\Windows\System\vbqvcvf.exe
  2⤵
  PID:8064
- C:\Windows\System\QGjAshF.exe
  C:\Windows\System\QGjAshF.exe
  2⤵
  PID:9228
- C:\Windows\System\VCwogYh.exe
  C:\Windows\System\VCwogYh.exe
  2⤵
  PID:9264
- C:\Windows\System\tqhCDLs.exe
  C:\Windows\System\tqhCDLs.exe
  2⤵
  PID:9364
- C:\Windows\System\qNLJPWz.exe
  C:\Windows\System\qNLJPWz.exe
  2⤵
  PID:9384
- C:\Windows\System\RcoRTbY.exe
  C:\Windows\System\RcoRTbY.exe
  2⤵
  PID:9412
- C:\Windows\System\xePTCGN.exe
  C:\Windows\System\xePTCGN.exe
  2⤵
  PID:9436
- C:\Windows\System\adGuYRm.exe
  C:\Windows\System\adGuYRm.exe
  2⤵
  PID:9452
- C:\Windows\System\kQqDDnu.exe
  C:\Windows\System\kQqDDnu.exe
  2⤵
  PID:9484
- C:\Windows\System\ZpFADAq.exe
  C:\Windows\System\ZpFADAq.exe
  2⤵
  PID:9504
- C:\Windows\System\SRxsvkf.exe
  C:\Windows\System\SRxsvkf.exe
  2⤵
  PID:9528
- C:\Windows\System\caTXQLF.exe
  C:\Windows\System\caTXQLF.exe
  2⤵
  PID:9548
- C:\Windows\System\zzgqGqY.exe
  C:\Windows\System\zzgqGqY.exe
  2⤵
  PID:9572
- C:\Windows\System\drulZQD.exe
  C:\Windows\System\drulZQD.exe
  2⤵
  PID:9600
- C:\Windows\System\AHRPqHk.exe
  C:\Windows\System\AHRPqHk.exe
  2⤵
  PID:9620
- C:\Windows\System\sjdMjyH.exe
  C:\Windows\System\sjdMjyH.exe
  2⤵
  PID:9640
- C:\Windows\System\LLjRjZV.exe
  C:\Windows\System\LLjRjZV.exe
  2⤵
  PID:9656
- C:\Windows\System\imrkcoP.exe
  C:\Windows\System\imrkcoP.exe
  2⤵
  PID:9696
- C:\Windows\System\PYaEEOJ.exe
  C:\Windows\System\PYaEEOJ.exe
  2⤵
  PID:9716
- C:\Windows\System\aDwBzSO.exe
  C:\Windows\System\aDwBzSO.exe
  2⤵
  PID:9740
- C:\Windows\System\jhdIBPV.exe
  C:\Windows\System\jhdIBPV.exe
  2⤵
  PID:9760
- C:\Windows\System\CvpNCBm.exe
  C:\Windows\System\CvpNCBm.exe
  2⤵
  PID:9784
- C:\Windows\System\lIwqZQm.exe
  C:\Windows\System\lIwqZQm.exe
  2⤵
  PID:9812
- C:\Windows\System\XZsaaut.exe
  C:\Windows\System\XZsaaut.exe
  2⤵
  PID:9832
- C:\Windows\System\VsHDMaQ.exe
  C:\Windows\System\VsHDMaQ.exe
  2⤵
  PID:9856
- C:\Windows\System\HpXZSvc.exe
  C:\Windows\System\HpXZSvc.exe
  2⤵
  PID:9876
- C:\Windows\System\SuIhvMs.exe
  C:\Windows\System\SuIhvMs.exe
  2⤵
  PID:9904
- C:\Windows\System\tVhOtdO.exe
  C:\Windows\System\tVhOtdO.exe
  2⤵
  PID:9928
- C:\Windows\System\rWRdFUe.exe
  C:\Windows\System\rWRdFUe.exe
  2⤵
  PID:9944
- C:\Windows\System\cHunvhE.exe
  C:\Windows\System\cHunvhE.exe
  2⤵
  PID:9960
- C:\Windows\System\SimqFRF.exe
  C:\Windows\System\SimqFRF.exe
  2⤵
  PID:10004
- C:\Windows\System\scatDQq.exe
  C:\Windows\System\scatDQq.exe
  2⤵
  PID:10020
- C:\Windows\System\OmJOhTV.exe
  C:\Windows\System\OmJOhTV.exe
  2⤵
  PID:10036
- C:\Windows\System\SNRWOJz.exe
  C:\Windows\System\SNRWOJz.exe
  2⤵
  PID:10056
- C:\Windows\System\EriJHrb.exe
  C:\Windows\System\EriJHrb.exe
  2⤵
  PID:10084
- C:\Windows\System\uReStDR.exe
  C:\Windows\System\uReStDR.exe
  2⤵
  PID:10108
- C:\Windows\System\XjsuStH.exe
  C:\Windows\System\XjsuStH.exe
  2⤵
  PID:10128
- C:\Windows\System\YIeCPmV.exe
  C:\Windows\System\YIeCPmV.exe
  2⤵
  PID:10148
- C:\Windows\System\ymbQqzD.exe
  C:\Windows\System\ymbQqzD.exe
  2⤵
  PID:10176
- C:\Windows\System\nVWDkBx.exe
  C:\Windows\System\nVWDkBx.exe
  2⤵
  PID:10196
- C:\Windows\System\iwwRkSC.exe
  C:\Windows\System\iwwRkSC.exe
  2⤵
  PID:10228
- C:\Windows\System\eJwTcho.exe
  C:\Windows\System\eJwTcho.exe
  2⤵
  PID:5544
- C:\Windows\System\yMHUUDH.exe
  C:\Windows\System\yMHUUDH.exe
  2⤵
  PID:5708
- C:\Windows\System\PaXdEEY.exe
  C:\Windows\System\PaXdEEY.exe
  2⤵
  PID:4220
- C:\Windows\System\OSpykCx.exe
  C:\Windows\System\OSpykCx.exe
  2⤵
  PID:6004
- C:\Windows\System\KHRBfLU.exe
  C:\Windows\System\KHRBfLU.exe
  2⤵
  PID:3508
- C:\Windows\System\wDJHhZz.exe
  C:\Windows\System\wDJHhZz.exe
  2⤵
  PID:1052
- C:\Windows\System\WzNOJxk.exe
  C:\Windows\System\WzNOJxk.exe
  2⤵
  PID:6484
- C:\Windows\System\UQaZcJN.exe
  C:\Windows\System\UQaZcJN.exe
  2⤵
  PID:6972
- C:\Windows\System\wMkxRwJ.exe
  C:\Windows\System\wMkxRwJ.exe
  2⤵
  PID:3452
- C:\Windows\System\eWoZeUA.exe
  C:\Windows\System\eWoZeUA.exe
  2⤵
  PID:8336
- C:\Windows\System\GJGcETg.exe
  C:\Windows\System\GJGcETg.exe
  2⤵
  PID:8376
- C:\Windows\System\HSiEqiK.exe
  C:\Windows\System\HSiEqiK.exe
  2⤵
  PID:8380
- C:\Windows\System\tzGgwPL.exe
  C:\Windows\System\tzGgwPL.exe
  2⤵
  PID:8420
- C:\Windows\System\GmulZiv.exe
  C:\Windows\System\GmulZiv.exe
  2⤵
  PID:8520
- C:\Windows\System\KjNUXHu.exe
  C:\Windows\System\KjNUXHu.exe
  2⤵
  PID:8584
- C:\Windows\System\MLBfVfF.exe
  C:\Windows\System\MLBfVfF.exe
  2⤵
  PID:5916
- C:\Windows\System\JFqhuZt.exe
  C:\Windows\System\JFqhuZt.exe
  2⤵
  PID:7284
- C:\Windows\System\IafcmTT.exe
  C:\Windows\System\IafcmTT.exe
  2⤵
  PID:6168
- C:\Windows\System\KATXCIS.exe
  C:\Windows\System\KATXCIS.exe
  2⤵
  PID:6276
- C:\Windows\System\jvgULpV.exe
  C:\Windows\System\jvgULpV.exe
  2⤵
  PID:8900
- C:\Windows\System\ZEWhdWG.exe
  C:\Windows\System\ZEWhdWG.exe
  2⤵
  PID:9148
- C:\Windows\System\bjtsUSo.exe
  C:\Windows\System\bjtsUSo.exe
  2⤵
  PID:9212
- C:\Windows\System\BIsmLWC.exe
  C:\Windows\System\BIsmLWC.exe
  2⤵
  PID:8580
- C:\Windows\System\wtxifeS.exe
  C:\Windows\System\wtxifeS.exe
  2⤵
  PID:4416
- C:\Windows\System\robMbIm.exe
  C:\Windows\System\robMbIm.exe
  2⤵
  PID:9324
- C:\Windows\System\kmAGdML.exe
  C:\Windows\System\kmAGdML.exe
  2⤵
  PID:9472
- C:\Windows\System\arJdJBd.exe
  C:\Windows\System\arJdJBd.exe
  2⤵
  PID:9516
- C:\Windows\System\hWwENRY.exe
  C:\Windows\System\hWwENRY.exe
  2⤵
  PID:9564
- C:\Windows\System\mzdbPxB.exe
  C:\Windows\System\mzdbPxB.exe
  2⤵
  PID:9648
- C:\Windows\System\VkjDQeZ.exe
  C:\Windows\System\VkjDQeZ.exe
  2⤵
  PID:9672
- C:\Windows\System\BLFqWMl.exe
  C:\Windows\System\BLFqWMl.exe
  2⤵
  PID:9752
- C:\Windows\System\uuxGxEI.exe
  C:\Windows\System\uuxGxEI.exe
  2⤵
  PID:9824
- C:\Windows\System\TLEWnsr.exe
  C:\Windows\System\TLEWnsr.exe
  2⤵
  PID:10000
- C:\Windows\System\cdFzlGZ.exe
  C:\Windows\System\cdFzlGZ.exe
  2⤵
  PID:10064
- C:\Windows\System\vxRjPCs.exe
  C:\Windows\System\vxRjPCs.exe
  2⤵
  PID:10120
- C:\Windows\System\KTxHcOK.exe
  C:\Windows\System\KTxHcOK.exe
  2⤵
  PID:10172
- C:\Windows\System\jjpkpZH.exe
  C:\Windows\System\jjpkpZH.exe
  2⤵
  PID:10212
- C:\Windows\System\PqHrFqi.exe
  C:\Windows\System\PqHrFqi.exe
  2⤵
  PID:5580
- C:\Windows\System\WhtvskE.exe
  C:\Windows\System\WhtvskE.exe
  2⤵
  PID:5780
- C:\Windows\System\SQtkxHy.exe
  C:\Windows\System\SQtkxHy.exe
  2⤵
  PID:6032
- C:\Windows\System\RmFMwGp.exe
  C:\Windows\System\RmFMwGp.exe
  2⤵
  PID:5188
- C:\Windows\System\MTmrdBa.exe
  C:\Windows\System\MTmrdBa.exe
  2⤵
  PID:6852
- C:\Windows\System\HzooEIQ.exe
  C:\Windows\System\HzooEIQ.exe
  2⤵
  PID:4780
- C:\Windows\System\TptbGpM.exe
  C:\Windows\System\TptbGpM.exe
  2⤵
  PID:10244
- C:\Windows\System\UxPWaLd.exe
  C:\Windows\System\UxPWaLd.exe
  2⤵
  PID:10268
- C:\Windows\System\YYeylbO.exe
  C:\Windows\System\YYeylbO.exe
  2⤵
  PID:10292
- C:\Windows\System\LlTupky.exe
  C:\Windows\System\LlTupky.exe
  2⤵
  PID:10328
- C:\Windows\System\rbCtJBD.exe
  C:\Windows\System\rbCtJBD.exe
  2⤵
  PID:10352
- C:\Windows\System\MYdGHdM.exe
  C:\Windows\System\MYdGHdM.exe
  2⤵
  PID:10368
- C:\Windows\System\PaZBfWO.exe
  C:\Windows\System\PaZBfWO.exe
  2⤵
  PID:10396
- C:\Windows\System\qsqvEoI.exe
  C:\Windows\System\qsqvEoI.exe
  2⤵
  PID:10416
- C:\Windows\System\uQrpNqE.exe
  C:\Windows\System\uQrpNqE.exe
  2⤵
  PID:10448
- C:\Windows\System\XVZAiUB.exe
  C:\Windows\System\XVZAiUB.exe
  2⤵
  PID:10468
- C:\Windows\System\hojPfYp.exe
  C:\Windows\System\hojPfYp.exe
  2⤵
  PID:10488
- C:\Windows\System\ZCjQWuP.exe
  C:\Windows\System\ZCjQWuP.exe
  2⤵
  PID:10512
- C:\Windows\System\ZAtLaSL.exe
  C:\Windows\System\ZAtLaSL.exe
  2⤵
  PID:10540
- C:\Windows\System\eGHfunL.exe
  C:\Windows\System\eGHfunL.exe
  2⤵
  PID:10568
- C:\Windows\System\hjcmqzQ.exe
  C:\Windows\System\hjcmqzQ.exe
  2⤵
  PID:10588
- C:\Windows\System\aTqAXKy.exe
  C:\Windows\System\aTqAXKy.exe
  2⤵
  PID:10616
- C:\Windows\System\otgootg.exe
  C:\Windows\System\otgootg.exe
  2⤵
  PID:10640
- C:\Windows\System\fOudpFU.exe
  C:\Windows\System\fOudpFU.exe
  2⤵
  PID:10660
- C:\Windows\System\uDxNSbF.exe
  C:\Windows\System\uDxNSbF.exe
  2⤵
  PID:10700
- C:\Windows\System\EuzVNxX.exe
  C:\Windows\System\EuzVNxX.exe
  2⤵
  PID:10720
- C:\Windows\System\jjroWaA.exe
  C:\Windows\System\jjroWaA.exe
  2⤵
  PID:10740
- C:\Windows\System\HTxogTZ.exe
  C:\Windows\System\HTxogTZ.exe
  2⤵
  PID:10764
- C:\Windows\System\QmXbTzm.exe
  C:\Windows\System\QmXbTzm.exe
  2⤵
  PID:10784
- C:\Windows\System\nbmadKB.exe
  C:\Windows\System\nbmadKB.exe
  2⤵
  PID:10800
- C:\Windows\System\KIzkklB.exe
  C:\Windows\System\KIzkklB.exe
  2⤵
  PID:10824
- C:\Windows\System\TxZnMyJ.exe
  C:\Windows\System\TxZnMyJ.exe
  2⤵
  PID:10856
- C:\Windows\System\RPmWUSm.exe
  C:\Windows\System\RPmWUSm.exe
  2⤵
  PID:10916
- C:\Windows\System\UTJvTeO.exe
  C:\Windows\System\UTJvTeO.exe
  2⤵
  PID:10936
- C:\Windows\System\ZAjOebh.exe
  C:\Windows\System\ZAjOebh.exe
  2⤵
  PID:10956
- C:\Windows\System\YOPqvFB.exe
  C:\Windows\System\YOPqvFB.exe
  2⤵
  PID:10980
- C:\Windows\System\VEixBLX.exe
  C:\Windows\System\VEixBLX.exe
  2⤵
  PID:11004
- C:\Windows\System\WphCxGm.exe
  C:\Windows\System\WphCxGm.exe
  2⤵
  PID:11024
- C:\Windows\System\ZGRCHKN.exe
  C:\Windows\System\ZGRCHKN.exe
  2⤵
  PID:11048
- C:\Windows\System\tJOPbBh.exe
  C:\Windows\System\tJOPbBh.exe
  2⤵
  PID:11072
- C:\Windows\System\KyhDrwl.exe
  C:\Windows\System\KyhDrwl.exe
  2⤵
  PID:11100
- C:\Windows\System\EDiekhK.exe
  C:\Windows\System\EDiekhK.exe
  2⤵
  PID:11124
- C:\Windows\System\CIcKnht.exe
  C:\Windows\System\CIcKnht.exe
  2⤵
  PID:11144
- C:\Windows\System\oQEQLll.exe
  C:\Windows\System\oQEQLll.exe
  2⤵
  PID:11168
- C:\Windows\System\ZnIICHq.exe
  C:\Windows\System\ZnIICHq.exe
  2⤵
  PID:11188
- C:\Windows\System\gJqWfuZ.exe
  C:\Windows\System\gJqWfuZ.exe
  2⤵
  PID:11208
- C:\Windows\System\rXDJQKZ.exe
  C:\Windows\System\rXDJQKZ.exe
  2⤵
  PID:11232
- C:\Windows\System\krJGBAl.exe
  C:\Windows\System\krJGBAl.exe
  2⤵
  PID:11256
- C:\Windows\System\MOUrWXQ.exe
  C:\Windows\System\MOUrWXQ.exe
  2⤵
  PID:8680
- C:\Windows\System\hMVtWbg.exe
  C:\Windows\System\hMVtWbg.exe
  2⤵
  PID:2452
- C:\Windows\System\puzZaCD.exe
  C:\Windows\System\puzZaCD.exe
  2⤵
  PID:7676
- C:\Windows\System\ADtbcSM.exe
  C:\Windows\System\ADtbcSM.exe
  2⤵
  PID:7932
- C:\Windows\System\rZwUnIP.exe
  C:\Windows\System\rZwUnIP.exe
  2⤵
  PID:8052
- C:\Windows\System\xQQCHGb.exe
  C:\Windows\System\xQQCHGb.exe
  2⤵
  PID:7348
- C:\Windows\System\hgvVziO.exe
  C:\Windows\System\hgvVziO.exe
  2⤵
  PID:7064
- C:\Windows\System\mRXIgAP.exe
  C:\Windows\System\mRXIgAP.exe
  2⤵
  PID:8512
- C:\Windows\System\CMuiNxM.exe
  C:\Windows\System\CMuiNxM.exe
  2⤵
  PID:6840
- C:\Windows\System\XzMCinO.exe
  C:\Windows\System\XzMCinO.exe
  2⤵
  PID:1448
- C:\Windows\System\SGBmkez.exe
  C:\Windows\System\SGBmkez.exe
  2⤵
  PID:10076
- C:\Windows\System\vdIGWMc.exe
  C:\Windows\System\vdIGWMc.exe
  2⤵
  PID:11280
- C:\Windows\System\RwRCtUK.exe
  C:\Windows\System\RwRCtUK.exe
  2⤵
  PID:11296
- C:\Windows\System\AJZVGXE.exe
  C:\Windows\System\AJZVGXE.exe
  2⤵
  PID:11320
- C:\Windows\System\zonVqUx.exe
  C:\Windows\System\zonVqUx.exe
  2⤵
  PID:11336
- C:\Windows\System\QhteaHZ.exe
  C:\Windows\System\QhteaHZ.exe
  2⤵
  PID:11352
- C:\Windows\System\iWXFIYp.exe
  C:\Windows\System\iWXFIYp.exe
  2⤵
  PID:11368
- C:\Windows\System\YmtkCDr.exe
  C:\Windows\System\YmtkCDr.exe
  2⤵
  PID:11396
- C:\Windows\System\YfgLdyG.exe
  C:\Windows\System\YfgLdyG.exe
  2⤵
  PID:11412
- C:\Windows\System\BMhSjWn.exe
  C:\Windows\System\BMhSjWn.exe
  2⤵
  PID:11444
- C:\Windows\System\UEfRzkk.exe
  C:\Windows\System\UEfRzkk.exe
  2⤵
  PID:11464
- C:\Windows\System\CLJVZsP.exe
  C:\Windows\System\CLJVZsP.exe
  2⤵
  PID:11484
- C:\Windows\System\XmnhDaK.exe
  C:\Windows\System\XmnhDaK.exe
  2⤵
  PID:11504
- C:\Windows\System\qOsDXdG.exe
  C:\Windows\System\qOsDXdG.exe
  2⤵
  PID:11532
- C:\Windows\System\seOAcxS.exe
  C:\Windows\System\seOAcxS.exe
  2⤵
  PID:11556
- C:\Windows\System\nQqyAXe.exe
  C:\Windows\System\nQqyAXe.exe
  2⤵
  PID:11576
- C:\Windows\System\pJcUDVM.exe
  C:\Windows\System\pJcUDVM.exe
  2⤵
  PID:12004
- C:\Windows\System\msOEfOM.exe
  C:\Windows\System\msOEfOM.exe
  2⤵
  PID:12092
- C:\Windows\System\fgiFMFC.exe
  C:\Windows\System\fgiFMFC.exe
  2⤵
  PID:12112
- C:\Windows\System\ckWSnOi.exe
  C:\Windows\System\ckWSnOi.exe
  2⤵
  PID:12136
- C:\Windows\System\Wnrnwbm.exe
  C:\Windows\System\Wnrnwbm.exe
  2⤵
  PID:12160
- C:\Windows\System\olMJXAt.exe
  C:\Windows\System\olMJXAt.exe
  2⤵
  PID:12180
- C:\Windows\System\lQNBVup.exe
  C:\Windows\System\lQNBVup.exe
  2⤵
  PID:12200
- C:\Windows\System\RfEHtlN.exe
  C:\Windows\System\RfEHtlN.exe
  2⤵
  PID:12224
- C:\Windows\System\IYaEsKH.exe
  C:\Windows\System\IYaEsKH.exe
  2⤵
  PID:12240
- C:\Windows\System\XTeiMFL.exe
  C:\Windows\System\XTeiMFL.exe
  2⤵
  PID:12264
- C:\Windows\System\dBqqzzX.exe
  C:\Windows\System\dBqqzzX.exe
  2⤵
  PID:12284
- C:\Windows\System\zcYrcwL.exe
  C:\Windows\System\zcYrcwL.exe
  2⤵
  PID:10316
- C:\Windows\System\DzyXafV.exe
  C:\Windows\System\DzyXafV.exe
  2⤵
  PID:3852
- C:\Windows\System\UIdXUMe.exe
  C:\Windows\System\UIdXUMe.exe
  2⤵
  PID:10436
- C:\Windows\System\YJEdFFr.exe
  C:\Windows\System\YJEdFFr.exe
  2⤵
  PID:10612
- C:\Windows\System\PxFrOkH.exe
  C:\Windows\System\PxFrOkH.exe
  2⤵
  PID:7696
- C:\Windows\System\zMTnOCx.exe
  C:\Windows\System\zMTnOCx.exe
  2⤵
  PID:7732
- C:\Windows\System\KKFLzgO.exe
  C:\Windows\System\KKFLzgO.exe
  2⤵
  PID:7796
- C:\Windows\System\diTJsEU.exe
  C:\Windows\System\diTJsEU.exe
  2⤵
  PID:7860
- C:\Windows\System\Utnkazn.exe
  C:\Windows\System\Utnkazn.exe
  2⤵
  PID:7948
- C:\Windows\System\UfazrCB.exe
  C:\Windows\System\UfazrCB.exe
  2⤵
  PID:8776
- C:\Windows\System\HltFVOU.exe
  C:\Windows\System\HltFVOU.exe
  2⤵
  PID:6164
- C:\Windows\System\nnqLONY.exe
  C:\Windows\System\nnqLONY.exe
  2⤵
  PID:10256
- C:\Windows\System\pRFBuPS.exe
  C:\Windows\System\pRFBuPS.exe
  2⤵
  PID:6560
- C:\Windows\System\xXvHIfk.exe
  C:\Windows\System\xXvHIfk.exe
  2⤵
  PID:11420
- C:\Windows\System\ESoEDFA.exe
  C:\Windows\System\ESoEDFA.exe
  2⤵
  PID:10376
- C:\Windows\System\jxwByGM.exe
  C:\Windows\System\jxwByGM.exe
  2⤵
  PID:11544
- C:\Windows\System\ICJyVPR.exe
  C:\Windows\System\ICJyVPR.exe
  2⤵
  PID:10464
- C:\Windows\System\MMKOwgv.exe
  C:\Windows\System\MMKOwgv.exe
  2⤵
  PID:10636
- C:\Windows\System\ccqefjN.exe
  C:\Windows\System\ccqefjN.exe
  2⤵
  PID:9012
- C:\Windows\System\nNKtPtP.exe
  C:\Windows\System\nNKtPtP.exe
  2⤵
  PID:9276
- C:\Windows\System\xhXUmgt.exe
  C:\Windows\System\xhXUmgt.exe
  2⤵
  PID:9380
- C:\Windows\System\LvDXanP.exe
  C:\Windows\System\LvDXanP.exe
  2⤵
  PID:9556
- C:\Windows\System\FkIOXgx.exe
  C:\Windows\System\FkIOXgx.exe
  2⤵
  PID:7660
- C:\Windows\System\oflrkID.exe
  C:\Windows\System\oflrkID.exe
  2⤵
  PID:9772
- C:\Windows\System\mUmdTkZ.exe
  C:\Windows\System\mUmdTkZ.exe
  2⤵
  PID:11780
- C:\Windows\System\zIMnxOu.exe
  C:\Windows\System\zIMnxOu.exe
  2⤵
  PID:11796
- C:\Windows\System\BcMXKyB.exe
  C:\Windows\System\BcMXKyB.exe
  2⤵
  PID:10456
- C:\Windows\System\TCKMvmj.exe
  C:\Windows\System\TCKMvmj.exe
  2⤵
  PID:11456
- C:\Windows\System\hSiXeET.exe
  C:\Windows\System\hSiXeET.exe
  2⤵
  PID:11328
- C:\Windows\System\ZNGkXfW.exe
  C:\Windows\System\ZNGkXfW.exe
  2⤵
  PID:10692
- C:\Windows\System\OTyGsvm.exe
  C:\Windows\System\OTyGsvm.exe
  2⤵
  PID:10760
- C:\Windows\System\pGciGVA.exe
  C:\Windows\System\pGciGVA.exe
  2⤵
  PID:10832
- C:\Windows\System\pTVsXZE.exe
  C:\Windows\System\pTVsXZE.exe
  2⤵
  PID:10912
- C:\Windows\System\CWxnoRL.exe
  C:\Windows\System\CWxnoRL.exe
  2⤵
  PID:10976
- C:\Windows\System\RmBYysI.exe
  C:\Windows\System\RmBYysI.exe
  2⤵
  PID:11032
- C:\Windows\System\QAPWJqE.exe
  C:\Windows\System\QAPWJqE.exe
  2⤵
  PID:11084
- C:\Windows\System\oqESGnW.exe
  C:\Windows\System\oqESGnW.exe
  2⤵
  PID:11140
- C:\Windows\System\CxhsEMF.exe
  C:\Windows\System\CxhsEMF.exe
  2⤵
  PID:11184
- C:\Windows\System\skXsZqB.exe
  C:\Windows\System\skXsZqB.exe
  2⤵
  PID:11252
- C:\Windows\System\iyJtSXJ.exe
  C:\Windows\System\iyJtSXJ.exe
  2⤵
  PID:8944
- C:\Windows\System\FdvIoHT.exe
  C:\Windows\System\FdvIoHT.exe
  2⤵
  PID:7340
- C:\Windows\System\xxEtOsL.exe
  C:\Windows\System\xxEtOsL.exe
  2⤵
  PID:8608
- C:\Windows\System\MSlspNN.exe
  C:\Windows\System\MSlspNN.exe
  2⤵
  PID:11792
- C:\Windows\System\LnalSgU.exe
  C:\Windows\System\LnalSgU.exe
  2⤵
  PID:12304
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12304 -s 28
    3⤵
    PID:12156
- C:\Windows\System\sudquqM.exe
  C:\Windows\System\sudquqM.exe
  2⤵
  PID:12320
- C:\Windows\System\KdCqiqI.exe
  C:\Windows\System\KdCqiqI.exe
  2⤵
  PID:12344
- C:\Windows\System\utvVRtx.exe
  C:\Windows\System\utvVRtx.exe
  2⤵
  PID:12368
- C:\Windows\System\McfTzRo.exe
  C:\Windows\System\McfTzRo.exe
  2⤵
  PID:12388
- C:\Windows\System\adtQYjV.exe
  C:\Windows\System\adtQYjV.exe
  2⤵
  PID:12408
- C:\Windows\System\dEjEStI.exe
  C:\Windows\System\dEjEStI.exe
  2⤵
  PID:12432
- C:\Windows\System\fpmQRMp.exe
  C:\Windows\System\fpmQRMp.exe
  2⤵
  PID:12460
- C:\Windows\System\CgJXCJy.exe
  C:\Windows\System\CgJXCJy.exe
  2⤵
  PID:12488
- C:\Windows\System\OtFKZaY.exe
  C:\Windows\System\OtFKZaY.exe
  2⤵
  PID:12504
- C:\Windows\System\aWvZCez.exe
  C:\Windows\System\aWvZCez.exe
  2⤵
  PID:12532
- C:\Windows\System\FUCcKuM.exe
  C:\Windows\System\FUCcKuM.exe
  2⤵
  PID:12560
- C:\Windows\System\CGDwjsB.exe
  C:\Windows\System\CGDwjsB.exe
  2⤵
  PID:12588
- C:\Windows\System\vxrHEDj.exe
  C:\Windows\System\vxrHEDj.exe
  2⤵
  PID:12616
- C:\Windows\System\zDmCHPY.exe
  C:\Windows\System\zDmCHPY.exe
  2⤵
  PID:12636
- C:\Windows\System\hQjmUxv.exe
  C:\Windows\System\hQjmUxv.exe
  2⤵
  PID:12660
- C:\Windows\System\WsChaic.exe
  C:\Windows\System\WsChaic.exe
  2⤵
  PID:12680
- C:\Windows\System\leFdalq.exe
  C:\Windows\System\leFdalq.exe
  2⤵
  PID:12700
- C:\Windows\System\NKLkDTZ.exe
  C:\Windows\System\NKLkDTZ.exe
  2⤵
  PID:12720
- C:\Windows\System\GNAPexW.exe
  C:\Windows\System\GNAPexW.exe
  2⤵
  PID:12748
- C:\Windows\System\dBVJRMc.exe
  C:\Windows\System\dBVJRMc.exe
  2⤵
  PID:12764
- C:\Windows\System\qnIkAdR.exe
  C:\Windows\System\qnIkAdR.exe
  2⤵
  PID:12780
- C:\Windows\System\DmPdeAb.exe
  C:\Windows\System\DmPdeAb.exe
  2⤵
  PID:12796
- C:\Windows\System\dcNyZUN.exe
  C:\Windows\System\dcNyZUN.exe
  2⤵
  PID:12812
- C:\Windows\System\ubWdnyX.exe
  C:\Windows\System\ubWdnyX.exe
  2⤵
  PID:3876
- C:\Windows\System\pOUpoci.exe
  C:\Windows\System\pOUpoci.exe
  2⤵
  PID:11736
- C:\Windows\System\Clbqxrj.exe
  C:\Windows\System\Clbqxrj.exe
  2⤵
  PID:4408
- C:\Windows\System\IRiShsJ.exe
  C:\Windows\System\IRiShsJ.exe
  2⤵
  PID:1792
- C:\Windows\System\qOHXsLe.exe
  C:\Windows\System\qOHXsLe.exe
  2⤵
  PID:12520
- C:\Windows\System\FOaPKHH.exe
  C:\Windows\System\FOaPKHH.exe
  2⤵
  PID:12544
- C:\Windows\System\nCOyqPA.exe
  C:\Windows\System\nCOyqPA.exe
  2⤵
  PID:10380
- C:\Windows\System\lmEeAjr.exe
  C:\Windows\System\lmEeAjr.exe
  2⤵
  PID:11512
- C:\Windows\System\gcSLqhn.exe
  C:\Windows\System\gcSLqhn.exe
  2⤵
  PID:9084
- C:\Windows\System\jsnzTXF.exe
  C:\Windows\System\jsnzTXF.exe
  2⤵
  PID:9636
- C:\Windows\System\BVdhGnD.exe
  C:\Windows\System\BVdhGnD.exe
  2⤵
  PID:9800
- C:\Windows\System\yXjKgUa.exe
  C:\Windows\System\yXjKgUa.exe
  2⤵
  PID:11476
- C:\Windows\System\FIdAEYO.exe
  C:\Windows\System\FIdAEYO.exe
  2⤵
  PID:10932
- C:\Windows\System\luwfjdQ.exe
  C:\Windows\System\luwfjdQ.exe
  2⤵
  PID:11020
- C:\Windows\System\DjmlTdr.exe
  C:\Windows\System\DjmlTdr.exe
  2⤵
  PID:11244
- C:\Windows\System\XzvPfCx.exe
  C:\Windows\System\XzvPfCx.exe
  2⤵
  PID:8316
- C:\Windows\System\NNHogaF.exe
  C:\Windows\System\NNHogaF.exe
  2⤵
  PID:11760
- C:\Windows\System\qRPLdts.exe
  C:\Windows\System\qRPLdts.exe
  2⤵
  PID:12316
- C:\Windows\System\mspvNnF.exe
  C:\Windows\System\mspvNnF.exe
  2⤵
  PID:12364
- C:\Windows\System\EUxDWFA.exe
  C:\Windows\System\EUxDWFA.exe
  2⤵
  PID:13152
- C:\Windows\System\yExVvTr.exe
  C:\Windows\System\yExVvTr.exe
  2⤵
  PID:13176
- C:\Windows\System\kPqcXkn.exe
  C:\Windows\System\kPqcXkn.exe
  2⤵
  PID:3904
- C:\Windows\System\jKLoLmJ.exe
  C:\Windows\System\jKLoLmJ.exe
  2⤵
  PID:6316
- C:\Windows\System\UQciYom.exe
  C:\Windows\System\UQciYom.exe
  2⤵
  PID:1944
- C:\Windows\System\FjRzkxH.exe
  C:\Windows\System\FjRzkxH.exe
  2⤵
  PID:4636
- C:\Windows\System\FUuXmWG.exe
  C:\Windows\System\FUuXmWG.exe
  2⤵
  PID:3020
- C:\Windows\System\UniTiGW.exe
  C:\Windows\System\UniTiGW.exe
  2⤵
  PID:12944
- C:\Windows\System\AoXujRc.exe
  C:\Windows\System\AoXujRc.exe
  2⤵
  PID:12968
- C:\Windows\System\IQInQju.exe
  C:\Windows\System\IQInQju.exe
  2⤵
  PID:13136
- C:\Windows\System\ThCKBSI.exe
  C:\Windows\System\ThCKBSI.exe
  2⤵
  PID:13228
- C:\Windows\System\COozoaB.exe
  C:\Windows\System\COozoaB.exe
  2⤵
  PID:4916
- C:\Windows\System\nMzJRUl.exe
  C:\Windows\System\nMzJRUl.exe
  2⤵
  PID:13296
- C:\Windows\System\XtuNgaJ.exe
  C:\Windows\System\XtuNgaJ.exe
  2⤵
  PID:6940
- C:\Windows\System\ogNeadF.exe
  C:\Windows\System\ogNeadF.exe
  2⤵
  PID:12152
- C:\Windows\System\NTomNYC.exe
  C:\Windows\System\NTomNYC.exe
  2⤵
  PID:11424
- C:\Windows\System\NXEMrZr.exe
  C:\Windows\System\NXEMrZr.exe
  2⤵
  PID:12236
- C:\Windows\System\LDCcKMH.exe
  C:\Windows\System\LDCcKMH.exe
  2⤵
  PID:11692
- C:\Windows\System\TlPGXpz.exe
  C:\Windows\System\TlPGXpz.exe
  2⤵
  PID:9492
- C:\Windows\System\mGhYTwe.exe
  C:\Windows\System\mGhYTwe.exe
  2⤵
  PID:11224
- C:\Windows\System\PSQYrgo.exe
  C:\Windows\System\PSQYrgo.exe
  2⤵
  PID:12676
- C:\Windows\System\FvwxURY.exe
  C:\Windows\System\FvwxURY.exe
  2⤵
  PID:4184
- C:\Windows\System\ufDeTtR.exe
  C:\Windows\System\ufDeTtR.exe
  2⤵
  PID:12156
- C:\Windows\System\AmgluZK.exe
  C:\Windows\System\AmgluZK.exe
  2⤵
  PID:6740
- C:\Windows\System\yvdMAOr.exe
  C:\Windows\System\yvdMAOr.exe
  2⤵
  PID:12500
- C:\Windows\System\WPpSDXS.exe
  C:\Windows\System\WPpSDXS.exe
  2⤵
  PID:12572
- C:\Windows\System\uxSpNdT.exe
  C:\Windows\System\uxSpNdT.exe
  2⤵
  PID:1540
- C:\Windows\System\yEUMSWI.exe
  C:\Windows\System\yEUMSWI.exe
  2⤵
  PID:12476
- C:\Windows\System\uvHNtGz.exe
  C:\Windows\System\uvHNtGz.exe
  2⤵
  PID:4308
- C:\Windows\System\aaqqQMQ.exe
  C:\Windows\System\aaqqQMQ.exe
  2⤵
  PID:4276
- C:\Windows\System\lojwsik.exe
  C:\Windows\System\lojwsik.exe
  2⤵
  PID:5060
- C:\Windows\System\EBvsjti.exe
  C:\Windows\System\EBvsjti.exe
  2⤵
  PID:11364
- C:\Windows\System\vrGlxfz.exe
  C:\Windows\System\vrGlxfz.exe
  2⤵
  PID:12380
- C:\Windows\System\txCuxBB.exe
  C:\Windows\System\txCuxBB.exe
  2⤵
  PID:10188
- C:\Windows\System\cLeEceC.exe
  C:\Windows\System\cLeEceC.exe
  2⤵
  PID:7292
- C:\Windows\System\IYocpnO.exe
  C:\Windows\System\IYocpnO.exe
  2⤵
  PID:11584
- C:\Windows\System\llrAnVB.exe
  C:\Windows\System\llrAnVB.exe
  2⤵
  PID:4832
- C:\Windows\System\fxjNWSH.exe
  C:\Windows\System\fxjNWSH.exe
  2⤵
  PID:12964
- C:\Windows\System\SMQuRLL.exe
  C:\Windows\System\SMQuRLL.exe
  2⤵
  PID:11160
- C:\Windows\System\rdjndqT.exe
  C:\Windows\System\rdjndqT.exe
  2⤵
  PID:13256
- C:\Windows\System\fJxniDG.exe
  C:\Windows\System\fJxniDG.exe
  2⤵
  PID:12496
- C:\Windows\System\BVxOCwT.exe
  C:\Windows\System\BVxOCwT.exe
  2⤵
  PID:10052
- C:\Windows\System\TAmTQdq.exe
  C:\Windows\System\TAmTQdq.exe
  2⤵
  PID:12856
- C:\Windows\System\vfvHrPV.exe
  C:\Windows\System\vfvHrPV.exe
  2⤵
  PID:4624
- C:\Windows\System\MuTiowa.exe
  C:\Windows\System\MuTiowa.exe
  2⤵
  PID:10696
- C:\Windows\System\ZpkRFiA.exe
  C:\Windows\System\ZpkRFiA.exe
  2⤵
  PID:13016
- C:\Windows\System\hiMTbrO.exe
  C:\Windows\System\hiMTbrO.exe
  2⤵
  PID:12668
- C:\Windows\System\sbafyGC.exe
  C:\Windows\System\sbafyGC.exe
  2⤵
  PID:12340
- C:\Windows\System\YVDxWFW.exe
  C:\Windows\System\YVDxWFW.exe
  2⤵
  PID:12440
- C:\Windows\System\mSJryMR.exe
  C:\Windows\System\mSJryMR.exe
  2⤵
  PID:13184
- C:\Windows\System\zCMvbaA.exe
  C:\Windows\System\zCMvbaA.exe
  2⤵
  PID:13268
- C:\Windows\System\xxrGSWr.exe
  C:\Windows\System\xxrGSWr.exe
  2⤵
  PID:3440
- C:\Windows\System\jnFsAPj.exe
  C:\Windows\System\jnFsAPj.exe
  2⤵
  PID:11844
- C:\Windows\System\piOKoGB.exe
  C:\Windows\System\piOKoGB.exe
  2⤵
  PID:12232
- C:\Windows\System\MguZAxy.exe
  C:\Windows\System\MguZAxy.exe
  2⤵
  PID:2844
- C:\Windows\System\cnsFRep.exe
  C:\Windows\System\cnsFRep.exe
  2⤵
  PID:12600
- C:\Windows\System\vXgrdvF.exe
  C:\Windows\System\vXgrdvF.exe
  2⤵
  PID:876
- C:\Windows\System\galvKtY.exe
  C:\Windows\System\galvKtY.exe
  2⤵
  PID:7764
- C:\Windows\System\HxYpBNn.exe
  C:\Windows\System\HxYpBNn.exe
  2⤵
  PID:12788
- C:\Windows\System\TFImjAT.exe
  C:\Windows\System\TFImjAT.exe
  2⤵
  PID:5484
- C:\Windows\System\ingvpqP.exe
  C:\Windows\System\ingvpqP.exe
  2⤵
  PID:10312
- C:\Windows\System\JMZLScd.exe
  C:\Windows\System\JMZLScd.exe
  2⤵
  PID:7844
- C:\Windows\System\xacBReh.exe
  C:\Windows\System\xacBReh.exe
  2⤵
  PID:12604
- C:\Windows\System\IRTLSTr.exe
  C:\Windows\System\IRTLSTr.exe
  2⤵
  PID:5504

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 12432 -ip 12432
1⤵
PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wcbmitaa.nau.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\GLhWNkC.exe

Filesize
1.8MB

MD5
2e5e72d76d2af9d6d4c684833ac3a8a7

SHA1
50db3b0b92150316f8398982dc71ef0190e77d34

SHA256
501a0279b522cb0ccf4915a29994b58ed9ce388e474a3b6badedc9007f4c2bfe

SHA512
ef7167eff8894e8eb0b7465330a3cab1423e8270bf3b4e82e77f190e8a2809a7f5c42654ab82b773c787b529af57cb77da75eafba82bef0c8f890b2959031a92

Download Submit
C:\Windows\System\HRibTQp.exe

Filesize
1.8MB

MD5
e2f1e154902521c21b304a920889be9c

SHA1
81ff9613e15faa8f7e3bf7636b9a0fffff601dd0

SHA256
4347fe92bccae426988a90afad914868587eb2d1f6b9898aa53c5abfd671b9e9

SHA512
34cabfc0b10fa2eb2dff75026916cded723a76867efad48b18773bf500924af6f092b4409041e2b486af13c012c646b85fbb9916af9c2d165753e1c177ab26ad

Download Submit
C:\Windows\System\HSBPlrQ.exe

Filesize
1.8MB

MD5
b9f34e9c22225d8b029968e5a9198c92

SHA1
8da8ad82368f2048247deb4424fbaecbe9394516

SHA256
c6348cd17ed761746fbad84546532b9c294488e829a7a0557cec67a52814b859

SHA512
4baf602b883f88b7bf9150d990ee24c7fdbd64c35ed8cea5d3bea3eb316c419937fe757b3f918a5c85f4562b1234db70019ca0b6d4983182ddb48f4d1af6ba3e

Download Submit
C:\Windows\System\JBGpAxV.exe

Filesize
1.8MB

MD5
e07e21046ef41759e4916f2adf94ef5c

SHA1
95d112e50218ef5957cc9743429d317bb826a58a

SHA256
5f37ff125fde1bf810173f2fbe574cd412dc1a0032df92375f433cd063a2884e

SHA512
0c0a3d4fca0836b5f9b93bd75357407035a3cdf05ac4d43efae83ad7aada615a3226a7b2cf6cc64db0f7b186c97737ac02e5162805174bb61753a39273a077d9

Download Submit
C:\Windows\System\KYQElcl.exe

Filesize
1.8MB

MD5
b9f92eb8459454f6bd584f25606f991d

SHA1
59e2f1ed2cb6dcffc8a7e00c66d328ec1bda924e

SHA256
8abcd66d275950e6254729a3a8703ef68a7acd09caa7113aa9a33c563884970b

SHA512
a453004d7c91a92da8cb00f69011ada812d75d306117b54a8d5a8a43f57d018c1ad1acf2a70cc4e426e88f0589dfb545588fa83f741c016bb0ea6e757223b049

Download Submit
C:\Windows\System\KfULpwQ.exe

Filesize
1.8MB

MD5
acf3ea7dd08b51ea24b5b920f6e80b7b

SHA1
71b70798778e2a9899030ecc88ede87f6e9d7f5f

SHA256
0fc79f27183d2c8fe782e721db620fee9ba2d430e2d1f85934fbb452a2a550a7

SHA512
17d5776b980f3593f012f939ba7c6010ba00f373bb605de428725697dd2db9296ec3127ece131491a7803cbdf6f6c5e4635070e9fff259f90944a83c7ce7add6

Download Submit
C:\Windows\System\KqYruss.exe

Filesize
1.8MB

MD5
c77237c2b86639e840b426e859d533a9

SHA1
ae14fcd1a35ac87d810739be539cfe8cc0b1cc67

SHA256
0745b37c81eb084102a51e15b551d446b0d214cda925253295562406f98ca89a

SHA512
334efa1e7dd5c6d809767051b77803bc66965dea01a6746d7bf4d89ef5235019afa7827527fa51f3760b75ad89b88a17ff2da6e2d883853e9893f3c5117bdfd3

Download Submit
C:\Windows\System\LbcihnS.exe

Filesize
1.8MB

MD5
705d56b0f1da096786ee5ab8813de4f3

SHA1
389c9889f8100443586d1d646772683d0d77eba3

SHA256
2145cd9a3385156f9596a507d4b9e112d503bfc933c822c11b991e8af2231c51

SHA512
abfeea987b47f52223868319756e024a9c44c6d0f43bddfd33aeee376022b932a764d56ad024c1e45b0e66154f482f661f7204eb20d5a0685d94db7edc697bd7

Download Submit
C:\Windows\System\LhFoWPI.exe

Filesize
1.8MB

MD5
a20e00fefc79a047a33b2b877721df3e

SHA1
fcd8cd94ab6700ecbc05ce26b5f596930466de57

SHA256
4e52c2035cc8b91922ecb713074700ab250da61425c7fb39953e9eb992f70523

SHA512
c75180161bb956b72ca124589d19349b36925149cf8f24d4aa0f696fd9992cfbad7e01673ce0742de26c2684346bfcb48494e2cf6f924615df884ae75dc8893a

Download Submit
C:\Windows\System\MHnVnEB.exe

Filesize
1.8MB

MD5
5ebb41752f74157652acff121fda5323

SHA1
8d0ffab3351db796f9925d04de8fa2cba31bc799

SHA256
8a339d79f40e38a717bd95c08324b4ff6443a00930a11f22e9a0c1f07362e8b7

SHA512
26941e00fb5cf66e760a522ab334f3f87870f296ad3932e418e241908281228cbffe25a58ca716d8dd167d0e762f4c6590217d539ced7da9218acb7263484116

Download Submit
C:\Windows\System\NSzROcb.exe

Filesize
1.8MB

MD5
2891689f75043d397a2134bdb0f0ab8f

SHA1
aff47ff260e6795974c265466cb52627e443c6f5

SHA256
efaff94e726695dc25f0a49a20b71fc22429f8742ed2f7a5cdf52fa20185442e

SHA512
8837203d751177dcfa21258e2e56f2b8aba80ee147f8eef81eb004eac623869487164aec76127e11b38d540c94df0856e6c28093d5203c958f47926dc26debee

Download Submit
C:\Windows\System\OZulPBq.exe

Filesize
1.8MB

MD5
dddb704f73360d4dc789c0efbbfbdae0

SHA1
8469b5c4cab43051c9bc5c8749edb0c2833167e5

SHA256
a0f256babbf0692f401463021b44bebad7ced54c57c349bdde08d4c0093cca00

SHA512
4224367a1925eb775981beab2368cc55d2ca698f730a6c042af18d1feb00e115dce6f2baa5f8e385a902c596fd415ff72a4deba2f7e910a487d85c799ff96cab

Download Submit
C:\Windows\System\QXvJRwl.exe

Filesize
1.8MB

MD5
62bf2f85d798f9778b5884e21db016c1

SHA1
002604fcd693b7d1bc623a9953e49f07c9b3284a

SHA256
e9b182b0a43ba702f1e3b27b08b58e8cfae7860a7183069dc02c9989401abefa

SHA512
b71eba4957cdcaa833b2240c474b958f858b32cdd729608636972710e21ccd31551d12b542585cd1e0359bba8e0c698ba2dac0950784d1de5fdf962d7b00ff10

Download Submit
C:\Windows\System\StFLxMU.exe

Filesize
1.8MB

MD5
83d2bbf6d42bdd8d2b98e00932e05448

SHA1
3f295c5297d9af2382a7d46adc489962f40555e8

SHA256
74d51a0ff53182fcb35ed0370c0b7fd0eb516e25ba6f5e6fc4b0caade57b88dc

SHA512
abbcf46b341ebaa5188cb10d4f9a9dee247c24609273475c376ca0a070cf1d2de0ac185455e6b4e0eeded2d7391d93539f1bc9ad35913305abef07a79fc04b42

Download Submit
C:\Windows\System\SywuxJU.exe

Filesize
1.8MB

MD5
f5d9afa9a78a9a4c14952901b5661814

SHA1
52934744074e4561912ba6ee16752366eb51652b

SHA256
5feb5ec5f591645b59916d574b7f62392e701c7e753d621a08c1a3751cb3e966

SHA512
fe1c50e20d3bf64c7effbad52e831f2969fae8405fdc85091767289bf53fddc669107300d1d9b333ec9c77cbca813b522eedf2deb9cfd827b575c188d3cd5dca

Download Submit
C:\Windows\System\ToAVQli.exe

Filesize
1.8MB

MD5
c08158512c34e869a4fe392ad199e68b

SHA1
50bf308465786e894eb90e752bc70333a6ac4249

SHA256
6e2c4bfe0c57515c1327a7ed627838b2f294342ebd462693c05758ac5a32781a

SHA512
e66d43a6bad604a2421db638c241a0363252b093fd4033052cc6508e945d8b243b1f6794f01f71d31d5ce14f5a90e278be90f39b3de85cf8ae71e98df95c8c50

Download Submit
C:\Windows\System\UriDbyl.exe

Filesize
1.8MB

MD5
25723d56e33f4d13f6398ffe33284e79

SHA1
20c0b54b7f3e6fe12ec3db0cdecbc2811acc430e

SHA256
f7390af579d839e412d661b7ea96fb413754dea027dd918cdf2a6dff39b8a512

SHA512
579634489bb072a4b6988dc385f252409031ec9909517311fdfdc22649a5938b1d5ecc5d0392294702d49c1c73c59246b8a8305d43e08ae8ebb5b01971dbece0

Download Submit
C:\Windows\System\VQAYAGD.exe

Filesize
1.8MB

MD5
2c6ceb05b9867b6c60c08637a7fa544e

SHA1
86cff12880c332b89e7eabe306fa4bafaa821a75

SHA256
bfcc1bbe95cb5a5bbd6427768c0f138a36a6cc83c2a0b16d4421fec3c88161d3

SHA512
b933f7efff3f33169a57311d417534d8d04967241a411058a095f12d9d9b6bcec633caa09f4e8ba15bb2d9dbee5516edbeeb32fbf34a6b354d2b4be814349159

Download Submit
C:\Windows\System\alyOqkk.exe

Filesize
1.8MB

MD5
e5122ba60225adf65b421cd2b8f0a27e

SHA1
7746b698136a906d60daab3a34b59a5fc73dd3eb

SHA256
c2c21290dc291ca46afdf0fc6b434c6c79533d99a8cc190503868e3023ccac47

SHA512
52a2ba2e299f44324730afcd37e0d3ca4f217d806ea73b09da8d2ec27802f56288d2df9ca062d3c4fe7fd67a81eb9ee426ce39a5ce450827b541a3aca14714bb

Download Submit
C:\Windows\System\fsxvrwv.exe

Filesize
1.8MB

MD5
a1582242a3c62738221ebf7d6f3ea42c

SHA1
d21df796842170f41ba594a2533ff76d3c4eabcf

SHA256
60f364776fe7caef4cc0970c4e2bbd8e09e8f96513e3cdf4ec34bf96762b224c

SHA512
4ee5072049d6a9f856e226567b308baf9fb761bd8889ed70117d2f11fb76c0c04234ffc8a48896334eacecc7652cd56c5a9747115d4bd97b8c86ca004203390f

Download Submit
C:\Windows\System\hgcIYBh.exe

Filesize
1.8MB

MD5
4dae8d967a6be5dfa95cc325a54cb4c9

SHA1
32fbf1b849c9c11985cd8f48591d4dce179fe618

SHA256
fb515d15f214372960efdd8ad09b7e15d332790576374ff4437bf6beb9a27b83

SHA512
5350a5db52594c080700c72bf8ef163d61084543a05f3c23b1a7cf6fb23927685152a584799c2b1c79d8345165ff1880c5e55a5d1b37164d568f1ad5a02bfbe4

Download Submit
C:\Windows\System\iPuSOtV.exe

Filesize
1.8MB

MD5
ab0b7cc54e8d208b9b52095ea1b90e81

SHA1
940c3e14c2600e6e7e45db3bfc4a022a74cce758

SHA256
d04d1da620547f19b6ffc73e1a9ce85e8ef5cf658b23104213ee5657e4c1632a

SHA512
0044ceb93d3cfacfb53731a8a61173e6167224041a0b7dd9a0e272b272e7741cc9e8a12b51a5c6902bd67ae9de3425ef26e82744559bf53f7607d1c7cab4c2ed

Download Submit
C:\Windows\System\ijNehSL.exe

Filesize
1.8MB

MD5
6a0e9906e78ea8911086b300feb06d9d

SHA1
6cf9c0584a6729b578d73517a278c4033799953a

SHA256
c29d22b1dd8db1a5600f67e0458ed84c604e45e7c203f1ffee6acc97f8787725

SHA512
3c960c8ad6fd5e676586ca5837a9835d25ddb99582ea1fad1c0ce421961451513fce8b8bcb2bb9df1292740dca21bcc97c6db698c67a1c2ad644cc6fee7afdd2

Download Submit
C:\Windows\System\jMeRoXt.exe

Filesize
1.8MB

MD5
189a434e73bdb226b8caf094cc5f12a9

SHA1
4962b3803794b6b1ccd38e205db435fe4b3cfcb6

SHA256
075f618bd2c6e8e93c15ed085714648251e1d2246e355185e61c47170761486d

SHA512
e98ac4fff1340e1b0eac43b687ab353eea5b89ac8fa3780c0d12bcebb717458e032107e6093fa779eec8588f8a545a4a0271dbf0773bfcfeafb163cd74a70a61

Download Submit
C:\Windows\System\kphayMX.exe

Filesize
1.8MB

MD5
68db0095cd735fb3b3c08a154cbd065a

SHA1
cc83d5685ff89045302cc2e266b95cf5e73c91b8

SHA256
b522d8bcd34fd98d23df83174d27c4e942f4afcaee29f19be89e0ae11dd426d4

SHA512
22b96d46b51860fa82e750bb22d3a40d317c94ae435ebdd3c525ae334daed48ba6f20bd84879785b4b98308a4a70a625fafa6ae96af7b629ab1e614ea09abef1

Download Submit
C:\Windows\System\lmVwhPj.exe

Filesize
1.8MB

MD5
d0875073f6340d91642850daebe52cf9

SHA1
223086420740cba277a4b995c0429ec2ed247771

SHA256
8a44c6b700d3d369baa5d1a0647caf76501562d96d4c89640a3eccfe29e406f6

SHA512
128841e962d69e61b0f07aa3d540bb5328be4822b9336fb198dc1db52c0691bd87fac29d08b179bbda6aabf468c47e24b94443b2c638fc3f61cccfe04f730df9

Download Submit
C:\Windows\System\mJzJeVY.exe

Filesize
1.8MB

MD5
1c154f9f3b95c6ff2d2abf4fcfaec019

SHA1
0c1cf1594e772aa09d58d85c076c38fd8f86ef8e

SHA256
5b4e709a35da6d8a25d4a8f4f7f28f166f00028299b9ea21af1c24928339ce24

SHA512
35028713490a37e2f345c0d870af54b5ce7d31fb4223b1bc507122a1e5af90e3e1815979764101365730f701a6e080d18af7ce955bc98413137725b49a6f5393

Download Submit
C:\Windows\System\nRjOMAw.exe

Filesize
1.8MB

MD5
bc7a883dd455b29ea04f17063481ccbe

SHA1
0d4b61eed13d65c1912bf720188bc4aca6e94663

SHA256
ab2f48dcc2dcb7a6ac05d0b673b6e5b757427a73ad09377e4a6c232b4293d9fb

SHA512
f32027c4632e54b0a61deb3a908aad967c858dae2a6d427b6d5e08e2c2a774ab3045de974ba394e9f80fdabb608c4fbb303857d97093696d123514a52a698075

Download Submit
C:\Windows\System\nZRIBNQ.exe

Filesize
1.8MB

MD5
b23e6ca6599728061f2d0a328985be07

SHA1
66975877d589a961d3f92c721c1d6d661023c584

SHA256
be7be8cdf61954783739538bcfa612f4b81c5e17304efea665cff276831f6b2a

SHA512
b676a8b8092a032313aa0b74274ec591c295b515bf2292a6dbdf74d2dad04c7ccda007895d487713e3a4ac4a3d0f26f0b5051f63b3b741fee7bfebd71c2d781c

Download Submit
C:\Windows\System\pFSTLhV.exe

Filesize
8B

MD5
65f7b8657984819dc27b22f9c381d415

SHA1
1ce581c5645b7662406b3fc8e0c497ddaff00abf

SHA256
7707900d6f36f887fbff88d568e146d2ae9fe7388ef50b8f7503f1b7f50fd709

SHA512
353f9e4fdde80ec79f346ecb0b266a68ac1f51eb9db1013fb89af717575c51022dfe671993b4cb0495624e85754a94f25f41caa8cac80e404b177030a8081e50

Download Submit
C:\Windows\System\qbdUmTT.exe

Filesize
1.8MB

MD5
b2cb5e797d4c73ef185c9b0603c47396

SHA1
07394b04af9a7328b0f4c72a957709818fe52de8

SHA256
bc59dd3bca379769dcadc66bcfd02f86f1072ea457062e5cf18e8340b62437ac

SHA512
7d2554ddb53d07b3325e7f088a74bd1309f29fcfaf7fe6ca61a151675ac0993c23b8fa95a06de00bbd982329aa8994753c15957f56d234e72ad44ae6a97b5f88

Download Submit
C:\Windows\System\shdFXhF.exe

Filesize
1.8MB

MD5
7bc78b561f83fd1e24b33d4873314e5e

SHA1
e9d3872cca6d83e57389d3713db166fd0d382f82

SHA256
e66124d26d753513b7ed4c28573858205539adfb308310ffae3ffc613a32d4b1

SHA512
94a072bd8fc8ecd2ae838c3918b0cbf8068273634086ba9272ea91acc283c2fd663490236cc55d4557e4a7df843d6d2df64d9ba5f9119dbec8cfb3fff9f48a10

Download Submit
C:\Windows\System\tvYnGCC.exe

Filesize
1.8MB

MD5
77d1e263d3760f7a0b04dd21ed803101

SHA1
9186df459743fc30f96881b4d012ef7251c935a2

SHA256
bcedb487acf04dba50404b51f39b8445fbd09215bb44f905404b283b39657749

SHA512
0c65df4164f292649a38374aee3ce6e05becc04cd6b959b1905f34ca4299b582e04ff43d608ff40a455fc0c13b3cc4897d65f2ce4e0df30ec6ec592f8eb33fcd

Download Submit
C:\Windows\System\vAqJMdr.exe

Filesize
1.8MB

MD5
e2336f3f62276459538350a33bebd62d

SHA1
4161ded033b99f93f7bb2598d53ef0d01e0065d2

SHA256
ab01a2a1a76b670162e7008bbd301c6ed0be81e84b412e74556837056aa1ef35

SHA512
a7ed8c3c758ced8949e5aee70b819a7ae5956e45ccf59d8da3021e0538f9bde3a0fe772a82147ca0b803a4e2fb19b96e91976c35ac7811866dc62ceb6cb04106

Download Submit
C:\Windows\System\vNwDeal.exe

Filesize
1.8MB

MD5
444778a610ba2133a4352da3b541eaa2

SHA1
300e4eb425c8d5f39f9acb933ce4cedb8bb35a22

SHA256
b487cdfc943a36d81571633d941695f81b654a16a91fc2eb21091aa606284090

SHA512
10e691b3179ae6668eed384220efd92dad38b99a01f477ac87a22a649d26a0bc45a7eb5415efd3527406ca77a71724c0b9b7527a91486110db068d2f7892a871

Download Submit
C:\Windows\System\wUcCnHs.exe

Filesize
1.8MB

MD5
52a50d34c28413087da15e347d4ba9bd

SHA1
6dc1f52c9f797c919a8d4e58b3922c76633f4c0f

SHA256
d9027fbf4b11e9b819cdba25fec2024f70c3b61b5038e2c7f24b717afe67d6f1

SHA512
520c5028d6e2e4ecb51eb67108859a4ce864c3f26c9638c3718b5646671fd8335f06ca54cb01890720211ae3980aed4a65dd93f137249e980a7633d426cbb362

Download Submit
C:\Windows\System\wiWOfjN.exe

Filesize
1.8MB

MD5
a57cc27ed051358e4efddb8cd3414a93

SHA1
c10e5c927c399553afd66ce8002f970c32a145c2

SHA256
debf734f8b46ef486d6725e6f42986fad43684e930014a9354320b0e5e36123c

SHA512
72e366b6607a70698f24f33b61b3d90557523ed07757b76eceb7da57edd82d7e072b1523f5bf74c95da893a1e636706ecb338c2bec0c7ad92c60b6f4b6d049df

Download Submit
C:\Windows\System\xryMbPy.exe

Filesize
1.8MB

MD5
1b8f565901a2304f9e07a27a2cf4bd2d

SHA1
98b688e3b1e692358f8f3a13a92d4975d29d2446

SHA256
234117feea43eb4327e742773841bf054af60f6014bd88e68977f15f7331d797

SHA512
26d4aa1b303debf4012d10d41a039f29f2f0ab59d56b09f9e599481c2998901ad57d0ff244ac0cbda1f40a186bddc70b647cc62cf1610f1ee050180d860cb534

Download Submit
C:\Windows\System\yKHnbmp.exe

Filesize
1.8MB

MD5
b88907a60803b62a28b1f823244900f2

SHA1
d3d3abb023aa167142ac38822f889ddae5e63f78

SHA256
f39387a230dcc2392d5394726aa682f37a9e9de3541ef27edba3dda8fb9498ad

SHA512
c05b6a3c526a638ef5dd7c7246089593d84ccbee7df38bc69246f7e08bdb124607276f5d45910517b3de05c52ed0d5629861418a19a59813be46a9dea2c7bd70

Download Submit
C:\Windows\System\yqRNdUZ.exe

Filesize
1.8MB

MD5
2b3bfe4eb94ecae8ff366abccd7b9677

SHA1
21f2d05f4f4df0fb6ca05114ee95953bab77c608

SHA256
973a5e4206f2e1a5a687d92b00affbde77eb830a94b04e4958a1998d4ec7aba4

SHA512
ee865f39cf3d735cfecef833cb24a50973b4ea4b7460eb978d4762c047d7f0eec4d8540e37693a79602dc6b0226be5031f3ca651371b7035d2c6f74411b2b39e

Download Submit
C:\Windows\System\ztQAuUp.exe

Filesize
1.8MB

MD5
9b84a3a7dedb043aa1c1f8a4dedeffee

SHA1
d6b357593f8bd7f642ee106da77f2494a9941cbc

SHA256
233cf04a3dcdf0598eb72097eb784da9526e64b69291c0e6cb8757caaebc284b

SHA512
efa911daccfde6bcb26cdbff9f3c130e4564a6924925f9f022092639b1a670e496786562af11c4ce04d06bdbec55b9256d68e64dbcb281c4ffed38c02291c0bc

Download Submit
C:\Windows\System\zzmUVlx.exe

Filesize
1.8MB

MD5
f8879b3be0f0f13d48cfac3eccd3005f

SHA1
3353606fd7c1c7bafcaf90be8b3c8236b475c00b

SHA256
2ef074eb5671202fcd3dbdb96213ca251af76eae7202ee78b9ebe8f7774f62e5

SHA512
15f649b767bb60ba441edfbea601cb87d701cd788df1eebfadcceaf8e4d6bcbadd7fa5e31812f98d43d03b65196debe4d5f47508086a111ddbeee14ec914d995

Download Submit
memory/436-306-0x00007FF667290000-0x00007FF667682000-memory.dmp

Filesize
3.9MB

Download
memory/436-2668-0x00007FF667290000-0x00007FF667682000-memory.dmp

Filesize
3.9MB

Download
memory/540-2588-0x00007FF7F7EC0000-0x00007FF7F82B2000-memory.dmp

Filesize
3.9MB

Download
memory/540-1-0x000001EB226D0000-0x000001EB226E0000-memory.dmp

Filesize
64KB

Download
memory/540-0-0x00007FF7F7EC0000-0x00007FF7F82B2000-memory.dmp

Filesize
3.9MB

Download
memory/768-631-0x00007FF7CE440000-0x00007FF7CE832000-memory.dmp

Filesize
3.9MB

Download
memory/768-2693-0x00007FF7CE440000-0x00007FF7CE832000-memory.dmp

Filesize
3.9MB

Download
memory/844-629-0x00007FF7A5030000-0x00007FF7A5422000-memory.dmp

Filesize
3.9MB

Download
memory/844-2696-0x00007FF7A5030000-0x00007FF7A5422000-memory.dmp

Filesize
3.9MB

Download
memory/1404-2680-0x00007FF7881A0000-0x00007FF788592000-memory.dmp

Filesize
3.9MB

Download
memory/1404-640-0x00007FF7881A0000-0x00007FF788592000-memory.dmp

Filesize
3.9MB

Download
memory/1916-2673-0x00007FF6A0170000-0x00007FF6A0562000-memory.dmp

Filesize
3.9MB

Download
memory/1916-305-0x00007FF6A0170000-0x00007FF6A0562000-memory.dmp

Filesize
3.9MB

Download
memory/1936-2705-0x00007FF68BEF0000-0x00007FF68C2E2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-637-0x00007FF68BEF0000-0x00007FF68C2E2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-2676-0x00007FF7EE400000-0x00007FF7EE7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-641-0x00007FF7EE400000-0x00007FF7EE7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-634-0x00007FF701D40000-0x00007FF702132000-memory.dmp

Filesize
3.9MB

Download
memory/2116-2687-0x00007FF701D40000-0x00007FF702132000-memory.dmp

Filesize
3.9MB

Download
memory/2260-2675-0x00007FF6B6400000-0x00007FF6B67F2000-memory.dmp

Filesize
3.9MB

Download
memory/2260-625-0x00007FF6B6400000-0x00007FF6B67F2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-2712-0x00007FF74D710000-0x00007FF74DB02000-memory.dmp

Filesize
3.9MB

Download
memory/2348-638-0x00007FF74D710000-0x00007FF74DB02000-memory.dmp

Filesize
3.9MB

Download
memory/2444-503-0x00007FF6CCF60000-0x00007FF6CD352000-memory.dmp

Filesize
3.9MB

Download
memory/2444-2670-0x00007FF6CCF60000-0x00007FF6CD352000-memory.dmp

Filesize
3.9MB

Download
memory/2484-729-0x00007FF6472E0000-0x00007FF6476D2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-2700-0x00007FF6472E0000-0x00007FF6476D2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-2698-0x00007FF7C37C0000-0x00007FF7C3BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-633-0x00007FF7C37C0000-0x00007FF7C3BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-636-0x00007FF733140000-0x00007FF733532000-memory.dmp

Filesize
3.9MB

Download
memory/2952-2714-0x00007FF733140000-0x00007FF733532000-memory.dmp

Filesize
3.9MB

Download
memory/3288-27-0x00007FF60F360000-0x00007FF60F752000-memory.dmp

Filesize
3.9MB

Download
memory/3288-2656-0x00007FF60F360000-0x00007FF60F752000-memory.dmp

Filesize
3.9MB

Download
memory/3324-399-0x00007FF6E83B0000-0x00007FF6E87A2000-memory.dmp

Filesize
3.9MB

Download
memory/3324-2678-0x00007FF6E83B0000-0x00007FF6E87A2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-626-0x00007FF708930000-0x00007FF708D22000-memory.dmp

Filesize
3.9MB

Download
memory/3540-2689-0x00007FF708930000-0x00007FF708D22000-memory.dmp

Filesize
3.9MB

Download
memory/3908-627-0x00007FF66C210000-0x00007FF66C602000-memory.dmp

Filesize
3.9MB

Download
memory/3908-2683-0x00007FF66C210000-0x00007FF66C602000-memory.dmp

Filesize
3.9MB

Download
memory/3932-2662-0x00007FF7B7490000-0x00007FF7B7882000-memory.dmp

Filesize
3.9MB

Download
memory/3932-21-0x00007FF7B7490000-0x00007FF7B7882000-memory.dmp

Filesize
3.9MB

Download
memory/3948-632-0x00007FF77CC40000-0x00007FF77D032000-memory.dmp

Filesize
3.9MB

Download
memory/3948-2690-0x00007FF77CC40000-0x00007FF77D032000-memory.dmp

Filesize
3.9MB

Download
memory/4180-628-0x00007FF72B6A0000-0x00007FF72BA92000-memory.dmp

Filesize
3.9MB

Download
memory/4180-2685-0x00007FF72B6A0000-0x00007FF72BA92000-memory.dmp

Filesize
3.9MB

Download
memory/4476-2710-0x00007FF6F8860000-0x00007FF6F8C52000-memory.dmp

Filesize
3.9MB

Download
memory/4476-639-0x00007FF6F8860000-0x00007FF6F8C52000-memory.dmp

Filesize
3.9MB

Download
memory/4900-2707-0x00007FF7DA360000-0x00007FF7DA752000-memory.dmp

Filesize
3.9MB

Download
memory/4900-635-0x00007FF7DA360000-0x00007FF7DA752000-memory.dmp

Filesize
3.9MB

Download
memory/4968-28-0x00007FF8DCC73000-0x00007FF8DCC75000-memory.dmp

Filesize
8KB

Download
memory/4968-376-0x000002D2468D0000-0x000002D2468F2000-memory.dmp

Filesize
136KB

Download
memory/4968-92-0x00007FF8DCC70000-0x00007FF8DD731000-memory.dmp

Filesize
10.8MB

Download
memory/4968-212-0x00007FF8DCC70000-0x00007FF8DD731000-memory.dmp

Filesize
10.8MB

Download
memory/5056-2695-0x00007FF711540000-0x00007FF711932000-memory.dmp

Filesize
3.9MB

Download
memory/5056-630-0x00007FF711540000-0x00007FF711932000-memory.dmp

Filesize
3.9MB

Download