xmrig | 85e187327343cd0e3a6ccd36dcc6ceba6b0d48b7348f287975d007bd5c4b5932

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a935878da87905106d019ada57c5a290N.exe
Size

1.5MB
MD5

a935878da87905106d019ada57c5a290
SHA1

3ec31bdc537754436285676626bfe25c490d6ce2
SHA256

85e187327343cd0e3a6ccd36dcc6ceba6b0d48b7348f287975d007bd5c4b5932
SHA512

76f8820b7140848903de1de111e3a562c27ab4a2edc0666ea17d19c908b13d8ab627a23c085cea12cd0858f0028181ee240024470b6c697e6e5b8c51246d9df9
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZrV5GgCzxcMfS0GcLMwWVV:Lz071uv4BPMkyW10/w16BWgac2xGvV

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/2100-395-0x00007FF765A30000-0x00007FF765E22000-memory.dmp	xmrig
behavioral2/memory/4928-396-0x00007FF6370D0000-0x00007FF6374C2000-memory.dmp	xmrig
behavioral2/memory/1396-506-0x00007FF7CF2B0000-0x00007FF7CF6A2000-memory.dmp	xmrig
behavioral2/memory/2800-556-0x00007FF63BA70000-0x00007FF63BE62000-memory.dmp	xmrig
behavioral2/memory/2124-560-0x00007FF6FA960000-0x00007FF6FAD52000-memory.dmp	xmrig
behavioral2/memory/2032-563-0x00007FF72CAB0000-0x00007FF72CEA2000-memory.dmp	xmrig
behavioral2/memory/1912-837-0x00007FF79E830000-0x00007FF79EC22000-memory.dmp	xmrig
behavioral2/memory/4244-821-0x00007FF7B9540000-0x00007FF7B9932000-memory.dmp	xmrig
behavioral2/memory/1516-820-0x00007FF69CFB0000-0x00007FF69D3A2000-memory.dmp	xmrig
behavioral2/memory/5008-589-0x00007FF71C9C0000-0x00007FF71CDB2000-memory.dmp	xmrig
behavioral2/memory/4992-566-0x00007FF639E60000-0x00007FF63A252000-memory.dmp	xmrig
behavioral2/memory/2804-565-0x00007FF7D3090000-0x00007FF7D3482000-memory.dmp	xmrig
behavioral2/memory/1600-564-0x00007FF63EB60000-0x00007FF63EF52000-memory.dmp	xmrig
behavioral2/memory/2492-562-0x00007FF6690C0000-0x00007FF6694B2000-memory.dmp	xmrig
behavioral2/memory/3488-561-0x00007FF7AC400000-0x00007FF7AC7F2000-memory.dmp	xmrig
behavioral2/memory/3540-559-0x00007FF603030000-0x00007FF603422000-memory.dmp	xmrig
behavioral2/memory/2864-558-0x00007FF7805E0000-0x00007FF7809D2000-memory.dmp	xmrig
behavioral2/memory/2304-557-0x00007FF71E740000-0x00007FF71EB32000-memory.dmp	xmrig
behavioral2/memory/4424-383-0x00007FF6D2050000-0x00007FF6D2442000-memory.dmp	xmrig
behavioral2/memory/2700-287-0x00007FF69FC80000-0x00007FF6A0072000-memory.dmp	xmrig
behavioral2/memory/2532-238-0x00007FF638AD0000-0x00007FF638EC2000-memory.dmp	xmrig
behavioral2/memory/3648-175-0x00007FF787DE0000-0x00007FF7881D2000-memory.dmp	xmrig
behavioral2/memory/3192-125-0x00007FF6D5120000-0x00007FF6D5512000-memory.dmp	xmrig
behavioral2/memory/4212-2635-0x00007FF6DC120000-0x00007FF6DC512000-memory.dmp	xmrig
behavioral2/memory/1912-2637-0x00007FF79E830000-0x00007FF79EC22000-memory.dmp	xmrig
behavioral2/memory/3648-2639-0x00007FF787DE0000-0x00007FF7881D2000-memory.dmp	xmrig
behavioral2/memory/2532-2641-0x00007FF638AD0000-0x00007FF638EC2000-memory.dmp	xmrig
behavioral2/memory/2700-2643-0x00007FF69FC80000-0x00007FF6A0072000-memory.dmp	xmrig
behavioral2/memory/4928-2653-0x00007FF6370D0000-0x00007FF6374C2000-memory.dmp	xmrig
behavioral2/memory/2032-2665-0x00007FF72CAB0000-0x00007FF72CEA2000-memory.dmp	xmrig
behavioral2/memory/4424-2669-0x00007FF6D2050000-0x00007FF6D2442000-memory.dmp	xmrig
behavioral2/memory/2804-2673-0x00007FF7D3090000-0x00007FF7D3482000-memory.dmp	xmrig
behavioral2/memory/2124-2707-0x00007FF6FA960000-0x00007FF6FAD52000-memory.dmp	xmrig
behavioral2/memory/4244-2702-0x00007FF7B9540000-0x00007FF7B9932000-memory.dmp	xmrig
behavioral2/memory/1516-2697-0x00007FF69CFB0000-0x00007FF69D3A2000-memory.dmp	xmrig
behavioral2/memory/4992-2671-0x00007FF639E60000-0x00007FF63A252000-memory.dmp	xmrig
behavioral2/memory/5008-2675-0x00007FF71C9C0000-0x00007FF71CDB2000-memory.dmp	xmrig
behavioral2/memory/1600-2667-0x00007FF63EB60000-0x00007FF63EF52000-memory.dmp	xmrig
behavioral2/memory/2864-2664-0x00007FF7805E0000-0x00007FF7809D2000-memory.dmp	xmrig
behavioral2/memory/3488-2659-0x00007FF7AC400000-0x00007FF7AC7F2000-memory.dmp	xmrig
behavioral2/memory/2304-2658-0x00007FF71E740000-0x00007FF71EB32000-memory.dmp	xmrig
behavioral2/memory/3540-2662-0x00007FF603030000-0x00007FF603422000-memory.dmp	xmrig
behavioral2/memory/3192-2656-0x00007FF6D5120000-0x00007FF6D5512000-memory.dmp	xmrig
behavioral2/memory/2492-2651-0x00007FF6690C0000-0x00007FF6694B2000-memory.dmp	xmrig
behavioral2/memory/1396-2650-0x00007FF7CF2B0000-0x00007FF7CF6A2000-memory.dmp	xmrig
behavioral2/memory/2100-2647-0x00007FF765A30000-0x00007FF765E22000-memory.dmp	xmrig
behavioral2/memory/2800-2646-0x00007FF63BA70000-0x00007FF63BE62000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5016	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4212	duhevLF.exe
1912	lFXXSdg.exe
3192	EmpQIRW.exe
3648	jICpCia.exe
2532	QettxVS.exe
2700	sjYaoPG.exe
4424	HXPDZyb.exe
2100	YzHfyYO.exe
4928	bsYrDZd.exe
1396	GEWIoQM.exe
2800	pLdMFxv.exe
2304	FLtmpIr.exe
2864	OOdBstZ.exe
3540	qPXrFYo.exe
2124	GMuZucQ.exe
3488	ToljvZs.exe
2492	cJkaJhv.exe
2032	qZQkeeO.exe
1600	hzGQxTR.exe
2804	qDkaeUb.exe
4992	vzsnKiS.exe
5008	raeElCE.exe
1516	jTmrtvE.exe
4244	OhZoSuf.exe
1232	rSWNLKl.exe
464	StXodID.exe
3304	pnHmNTv.exe
4932	lcrFoHD.exe
3588	eLVkJLE.exe
3000	dLZUCyU.exe
632	hThuqDO.exe
4416	GycvaxD.exe
1068	AXqbcmR.exe
4868	InIkEPY.exe
2828	OmIufHj.exe
1464	JrgRtIO.exe
1228	pbzlBfb.exe
1128	lmCpHOR.exe
4376	Rditptp.exe
4292	nXhnecy.exe
2600	dIIoSFH.exe
4184	qzNLAnb.exe
836	EQostwM.exe
932	mVrYJbL.exe
4472	lqzFrjA.exe
1616	Hxwiafq.exe
2576	lHORdZy.exe
4524	nGbZBPm.exe
4652	SMzsmXi.exe
3208	YtAcwlz.exe
4948	QtybEeA.exe
4804	YAwtltf.exe
1064	TIISYcc.exe
4900	LtCwUuz.exe
220	ZsnRMwB.exe
4328	bFDNgqp.exe
4320	TNVlHMh.exe
3840	ByROtKW.exe
4712	BKzYhqq.exe
2220	baIryGX.exe
1412	pXmNsgQ.exe
2488	wQGYtGz.exe
3228	HxjuBsQ.exe
444	uBzZuid.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1108-0-0x00007FF633110000-0x00007FF633502000-memory.dmp	upx
behavioral2/memory/4212-12-0x00007FF6DC120000-0x00007FF6DC512000-memory.dmp	upx
behavioral2/files/0x0007000000023431-22.dat	upx
behavioral2/files/0x0007000000023430-7.dat	upx
behavioral2/files/0x000b000000023423-5.dat	upx
behavioral2/files/0x0007000000023433-31.dat	upx
behavioral2/files/0x0007000000023432-25.dat	upx
behavioral2/files/0x000700000002342f-18.dat	upx
behavioral2/files/0x0007000000023434-33.dat	upx
behavioral2/files/0x000700000002343a-72.dat	upx
behavioral2/files/0x0007000000023445-110.dat	upx
behavioral2/memory/2100-395-0x00007FF765A30000-0x00007FF765E22000-memory.dmp	upx
behavioral2/memory/4928-396-0x00007FF6370D0000-0x00007FF6374C2000-memory.dmp	upx
behavioral2/memory/1396-506-0x00007FF7CF2B0000-0x00007FF7CF6A2000-memory.dmp	upx
behavioral2/memory/2800-556-0x00007FF63BA70000-0x00007FF63BE62000-memory.dmp	upx
behavioral2/memory/2124-560-0x00007FF6FA960000-0x00007FF6FAD52000-memory.dmp	upx
behavioral2/memory/2032-563-0x00007FF72CAB0000-0x00007FF72CEA2000-memory.dmp	upx
behavioral2/memory/1912-837-0x00007FF79E830000-0x00007FF79EC22000-memory.dmp	upx
behavioral2/memory/4244-821-0x00007FF7B9540000-0x00007FF7B9932000-memory.dmp	upx
behavioral2/memory/1516-820-0x00007FF69CFB0000-0x00007FF69D3A2000-memory.dmp	upx
behavioral2/memory/5008-589-0x00007FF71C9C0000-0x00007FF71CDB2000-memory.dmp	upx
behavioral2/memory/4992-566-0x00007FF639E60000-0x00007FF63A252000-memory.dmp	upx
behavioral2/memory/2804-565-0x00007FF7D3090000-0x00007FF7D3482000-memory.dmp	upx
behavioral2/memory/1600-564-0x00007FF63EB60000-0x00007FF63EF52000-memory.dmp	upx
behavioral2/memory/2492-562-0x00007FF6690C0000-0x00007FF6694B2000-memory.dmp	upx
behavioral2/memory/3488-561-0x00007FF7AC400000-0x00007FF7AC7F2000-memory.dmp	upx
behavioral2/memory/3540-559-0x00007FF603030000-0x00007FF603422000-memory.dmp	upx
behavioral2/memory/2864-558-0x00007FF7805E0000-0x00007FF7809D2000-memory.dmp	upx
behavioral2/memory/2304-557-0x00007FF71E740000-0x00007FF71EB32000-memory.dmp	upx
behavioral2/memory/4424-383-0x00007FF6D2050000-0x00007FF6D2442000-memory.dmp	upx
behavioral2/memory/2700-287-0x00007FF69FC80000-0x00007FF6A0072000-memory.dmp	upx
behavioral2/memory/2532-238-0x00007FF638AD0000-0x00007FF638EC2000-memory.dmp	upx
behavioral2/files/0x0007000000023457-218.dat	upx
behavioral2/files/0x0007000000023456-217.dat	upx
behavioral2/files/0x0007000000023442-213.dat	upx
behavioral2/files/0x0007000000023444-207.dat	upx
behavioral2/files/0x0007000000023443-204.dat	upx
behavioral2/files/0x0007000000023455-202.dat	upx
behavioral2/files/0x0007000000023454-199.dat	upx
behavioral2/files/0x0007000000023441-191.dat	upx
behavioral2/files/0x0007000000023453-190.dat	upx
behavioral2/files/0x0007000000023440-185.dat	upx
behavioral2/memory/3648-175-0x00007FF787DE0000-0x00007FF7881D2000-memory.dmp	upx
behavioral2/files/0x000700000002343f-172.dat	upx
behavioral2/files/0x0007000000023452-169.dat	upx
behavioral2/files/0x0007000000023451-168.dat	upx
behavioral2/files/0x0007000000023450-167.dat	upx
behavioral2/files/0x000700000002343d-162.dat	upx
behavioral2/files/0x000700000002343b-158.dat	upx
behavioral2/files/0x000700000002344e-149.dat	upx
behavioral2/files/0x000700000002344d-148.dat	upx
behavioral2/files/0x000700000002344c-147.dat	upx
behavioral2/files/0x0007000000023439-139.dat	upx
behavioral2/files/0x0007000000023438-132.dat	upx
behavioral2/files/0x0007000000023435-128.dat	upx
behavioral2/files/0x000700000002344b-127.dat	upx
behavioral2/files/0x000700000002344a-126.dat	upx
behavioral2/memory/3192-125-0x00007FF6D5120000-0x00007FF6D5512000-memory.dmp	upx
behavioral2/files/0x000700000002343e-116.dat	upx
behavioral2/files/0x0007000000023449-114.dat	upx
behavioral2/files/0x000700000002344f-166.dat	upx
behavioral2/files/0x0007000000023447-112.dat	upx
behavioral2/files/0x0007000000023446-111.dat	upx
behavioral2/files/0x0007000000023437-104.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nvrisDK.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\jvroUbX.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\vOIRPfM.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\DALUJgb.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\PggnUpH.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\QaqAuRr.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\MgoOkot.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\YAvoxSY.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\WQtnOdD.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\PunggMB.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\HfUqzjo.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\HWYKNft.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\nBhYMqQ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\wJSGSQV.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\AnngsIz.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\DiMZKia.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\iptiNRc.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\RnWiZoZ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\FunSkwa.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\zyySOAf.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\ZmmSUVD.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\CYcbnhz.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\PVAXhFq.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\dcrBMhQ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\iSNdqtR.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\hzBFnxJ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\YDPxQMd.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\fQowwYD.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\WebFWKD.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\QdglamO.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\CbGlWkL.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\ffHcFfy.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\zGyLYWP.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\LRlxnkW.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\wSLrzEr.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\GdFKMrI.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\KVCGFWt.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\FsrmCNt.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\xZJvjwD.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\CkzLxLT.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\tLPfwKr.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\Hxwiafq.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\VKHJGXb.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\idTvYyX.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\QanBjuW.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\OCqIMhi.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\pjBAtfc.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\LhBFkOK.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\bgCsUnw.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\YAwtltf.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\bMkJAgQ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\YBiOPgc.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\zZQnvHs.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\mvFiIwj.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\aJZmCTZ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\CsjvqsL.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\PEexFfz.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\pXmNsgQ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\QFypeim.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\TCtKEES.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\hXiMngu.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\HyRdFQl.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\ZSsqksh.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\qkJhQMI.exe	a935878da87905106d019ada57c5a290N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1108	a935878da87905106d019ada57c5a290N.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeLockMemoryPrivilege	1108	a935878da87905106d019ada57c5a290N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 5016	1108	a935878da87905106d019ada57c5a290N.exe	85
PID 1108 wrote to memory of 5016	1108	a935878da87905106d019ada57c5a290N.exe	85
PID 1108 wrote to memory of 4212	1108	a935878da87905106d019ada57c5a290N.exe	86
PID 1108 wrote to memory of 4212	1108	a935878da87905106d019ada57c5a290N.exe	86
PID 1108 wrote to memory of 1912	1108	a935878da87905106d019ada57c5a290N.exe	87
PID 1108 wrote to memory of 1912	1108	a935878da87905106d019ada57c5a290N.exe	87
PID 1108 wrote to memory of 3192	1108	a935878da87905106d019ada57c5a290N.exe	88
PID 1108 wrote to memory of 3192	1108	a935878da87905106d019ada57c5a290N.exe	88
PID 1108 wrote to memory of 3648	1108	a935878da87905106d019ada57c5a290N.exe	89
PID 1108 wrote to memory of 3648	1108	a935878da87905106d019ada57c5a290N.exe	89
PID 1108 wrote to memory of 2532	1108	a935878da87905106d019ada57c5a290N.exe	90
PID 1108 wrote to memory of 2532	1108	a935878da87905106d019ada57c5a290N.exe	90
PID 1108 wrote to memory of 2700	1108	a935878da87905106d019ada57c5a290N.exe	91
PID 1108 wrote to memory of 2700	1108	a935878da87905106d019ada57c5a290N.exe	91
PID 1108 wrote to memory of 4424	1108	a935878da87905106d019ada57c5a290N.exe	92
PID 1108 wrote to memory of 4424	1108	a935878da87905106d019ada57c5a290N.exe	92
PID 1108 wrote to memory of 2100	1108	a935878da87905106d019ada57c5a290N.exe	93
PID 1108 wrote to memory of 2100	1108	a935878da87905106d019ada57c5a290N.exe	93
PID 1108 wrote to memory of 4928	1108	a935878da87905106d019ada57c5a290N.exe	94
PID 1108 wrote to memory of 4928	1108	a935878da87905106d019ada57c5a290N.exe	94
PID 1108 wrote to memory of 1396	1108	a935878da87905106d019ada57c5a290N.exe	95
PID 1108 wrote to memory of 1396	1108	a935878da87905106d019ada57c5a290N.exe	95
PID 1108 wrote to memory of 2800	1108	a935878da87905106d019ada57c5a290N.exe	96
PID 1108 wrote to memory of 2800	1108	a935878da87905106d019ada57c5a290N.exe	96
PID 1108 wrote to memory of 2304	1108	a935878da87905106d019ada57c5a290N.exe	97
PID 1108 wrote to memory of 2304	1108	a935878da87905106d019ada57c5a290N.exe	97
PID 1108 wrote to memory of 2864	1108	a935878da87905106d019ada57c5a290N.exe	98
PID 1108 wrote to memory of 2864	1108	a935878da87905106d019ada57c5a290N.exe	98
PID 1108 wrote to memory of 3540	1108	a935878da87905106d019ada57c5a290N.exe	99
PID 1108 wrote to memory of 3540	1108	a935878da87905106d019ada57c5a290N.exe	99
PID 1108 wrote to memory of 2124	1108	a935878da87905106d019ada57c5a290N.exe	100
PID 1108 wrote to memory of 2124	1108	a935878da87905106d019ada57c5a290N.exe	100
PID 1108 wrote to memory of 3488	1108	a935878da87905106d019ada57c5a290N.exe	101
PID 1108 wrote to memory of 3488	1108	a935878da87905106d019ada57c5a290N.exe	101
PID 1108 wrote to memory of 2492	1108	a935878da87905106d019ada57c5a290N.exe	102
PID 1108 wrote to memory of 2492	1108	a935878da87905106d019ada57c5a290N.exe	102
PID 1108 wrote to memory of 2032	1108	a935878da87905106d019ada57c5a290N.exe	103
PID 1108 wrote to memory of 2032	1108	a935878da87905106d019ada57c5a290N.exe	103
PID 1108 wrote to memory of 1600	1108	a935878da87905106d019ada57c5a290N.exe	104
PID 1108 wrote to memory of 1600	1108	a935878da87905106d019ada57c5a290N.exe	104
PID 1108 wrote to memory of 2804	1108	a935878da87905106d019ada57c5a290N.exe	105
PID 1108 wrote to memory of 2804	1108	a935878da87905106d019ada57c5a290N.exe	105
PID 1108 wrote to memory of 3000	1108	a935878da87905106d019ada57c5a290N.exe	106
PID 1108 wrote to memory of 3000	1108	a935878da87905106d019ada57c5a290N.exe	106
PID 1108 wrote to memory of 4992	1108	a935878da87905106d019ada57c5a290N.exe	107
PID 1108 wrote to memory of 4992	1108	a935878da87905106d019ada57c5a290N.exe	107
PID 1108 wrote to memory of 5008	1108	a935878da87905106d019ada57c5a290N.exe	108
PID 1108 wrote to memory of 5008	1108	a935878da87905106d019ada57c5a290N.exe	108
PID 1108 wrote to memory of 1516	1108	a935878da87905106d019ada57c5a290N.exe	109
PID 1108 wrote to memory of 1516	1108	a935878da87905106d019ada57c5a290N.exe	109
PID 1108 wrote to memory of 4244	1108	a935878da87905106d019ada57c5a290N.exe	110
PID 1108 wrote to memory of 4244	1108	a935878da87905106d019ada57c5a290N.exe	110
PID 1108 wrote to memory of 1232	1108	a935878da87905106d019ada57c5a290N.exe	111
PID 1108 wrote to memory of 1232	1108	a935878da87905106d019ada57c5a290N.exe	111
PID 1108 wrote to memory of 464	1108	a935878da87905106d019ada57c5a290N.exe	112
PID 1108 wrote to memory of 464	1108	a935878da87905106d019ada57c5a290N.exe	112
PID 1108 wrote to memory of 3304	1108	a935878da87905106d019ada57c5a290N.exe	113
PID 1108 wrote to memory of 3304	1108	a935878da87905106d019ada57c5a290N.exe	113
PID 1108 wrote to memory of 4932	1108	a935878da87905106d019ada57c5a290N.exe	114
PID 1108 wrote to memory of 4932	1108	a935878da87905106d019ada57c5a290N.exe	114
PID 1108 wrote to memory of 3588	1108	a935878da87905106d019ada57c5a290N.exe	115
PID 1108 wrote to memory of 3588	1108	a935878da87905106d019ada57c5a290N.exe	115
PID 1108 wrote to memory of 632	1108	a935878da87905106d019ada57c5a290N.exe	116
PID 1108 wrote to memory of 632	1108	a935878da87905106d019ada57c5a290N.exe	116

C:\Users\Admin\AppData\Local\Temp\a935878da87905106d019ada57c5a290N.exe
"C:\Users\Admin\AppData\Local\Temp\a935878da87905106d019ada57c5a290N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\System\duhevLF.exe
  C:\Windows\System\duhevLF.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\lFXXSdg.exe
  C:\Windows\System\lFXXSdg.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\EmpQIRW.exe
  C:\Windows\System\EmpQIRW.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\jICpCia.exe
  C:\Windows\System\jICpCia.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\QettxVS.exe
  C:\Windows\System\QettxVS.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\sjYaoPG.exe
  C:\Windows\System\sjYaoPG.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\HXPDZyb.exe
  C:\Windows\System\HXPDZyb.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\YzHfyYO.exe
  C:\Windows\System\YzHfyYO.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\bsYrDZd.exe
  C:\Windows\System\bsYrDZd.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\GEWIoQM.exe
  C:\Windows\System\GEWIoQM.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\pLdMFxv.exe
  C:\Windows\System\pLdMFxv.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\FLtmpIr.exe
  C:\Windows\System\FLtmpIr.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\OOdBstZ.exe
  C:\Windows\System\OOdBstZ.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\qPXrFYo.exe
  C:\Windows\System\qPXrFYo.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\GMuZucQ.exe
  C:\Windows\System\GMuZucQ.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\ToljvZs.exe
  C:\Windows\System\ToljvZs.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\cJkaJhv.exe
  C:\Windows\System\cJkaJhv.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\qZQkeeO.exe
  C:\Windows\System\qZQkeeO.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\hzGQxTR.exe
  C:\Windows\System\hzGQxTR.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\qDkaeUb.exe
  C:\Windows\System\qDkaeUb.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\dLZUCyU.exe
  C:\Windows\System\dLZUCyU.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\vzsnKiS.exe
  C:\Windows\System\vzsnKiS.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\raeElCE.exe
  C:\Windows\System\raeElCE.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\jTmrtvE.exe
  C:\Windows\System\jTmrtvE.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\OhZoSuf.exe
  C:\Windows\System\OhZoSuf.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\rSWNLKl.exe
  C:\Windows\System\rSWNLKl.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\StXodID.exe
  C:\Windows\System\StXodID.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\pnHmNTv.exe
  C:\Windows\System\pnHmNTv.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\lcrFoHD.exe
  C:\Windows\System\lcrFoHD.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\eLVkJLE.exe
  C:\Windows\System\eLVkJLE.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\hThuqDO.exe
  C:\Windows\System\hThuqDO.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\GycvaxD.exe
  C:\Windows\System\GycvaxD.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\AXqbcmR.exe
  C:\Windows\System\AXqbcmR.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\InIkEPY.exe
  C:\Windows\System\InIkEPY.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\OmIufHj.exe
  C:\Windows\System\OmIufHj.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\JrgRtIO.exe
  C:\Windows\System\JrgRtIO.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\pbzlBfb.exe
  C:\Windows\System\pbzlBfb.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\lmCpHOR.exe
  C:\Windows\System\lmCpHOR.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\Rditptp.exe
  C:\Windows\System\Rditptp.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\nXhnecy.exe
  C:\Windows\System\nXhnecy.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\dIIoSFH.exe
  C:\Windows\System\dIIoSFH.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\qzNLAnb.exe
  C:\Windows\System\qzNLAnb.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\EQostwM.exe
  C:\Windows\System\EQostwM.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\mVrYJbL.exe
  C:\Windows\System\mVrYJbL.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\lqzFrjA.exe
  C:\Windows\System\lqzFrjA.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\Hxwiafq.exe
  C:\Windows\System\Hxwiafq.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\lHORdZy.exe
  C:\Windows\System\lHORdZy.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\nGbZBPm.exe
  C:\Windows\System\nGbZBPm.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\SMzsmXi.exe
  C:\Windows\System\SMzsmXi.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\YtAcwlz.exe
  C:\Windows\System\YtAcwlz.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\QtybEeA.exe
  C:\Windows\System\QtybEeA.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\YAwtltf.exe
  C:\Windows\System\YAwtltf.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\TIISYcc.exe
  C:\Windows\System\TIISYcc.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\LtCwUuz.exe
  C:\Windows\System\LtCwUuz.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\TPVQrrj.exe
  C:\Windows\System\TPVQrrj.exe
  2⤵
  PID:5000
- C:\Windows\System\ZsnRMwB.exe
  C:\Windows\System\ZsnRMwB.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\bFDNgqp.exe
  C:\Windows\System\bFDNgqp.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\TNVlHMh.exe
  C:\Windows\System\TNVlHMh.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\ByROtKW.exe
  C:\Windows\System\ByROtKW.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\BKzYhqq.exe
  C:\Windows\System\BKzYhqq.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\baIryGX.exe
  C:\Windows\System\baIryGX.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\pXmNsgQ.exe
  C:\Windows\System\pXmNsgQ.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\wQGYtGz.exe
  C:\Windows\System\wQGYtGz.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\HxjuBsQ.exe
  C:\Windows\System\HxjuBsQ.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\uBzZuid.exe
  C:\Windows\System\uBzZuid.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\iNdHzsT.exe
  C:\Windows\System\iNdHzsT.exe
  2⤵
  PID:2940
- C:\Windows\System\MNGMSLn.exe
  C:\Windows\System\MNGMSLn.exe
  2⤵
  PID:4564
- C:\Windows\System\iDdVwWJ.exe
  C:\Windows\System\iDdVwWJ.exe
  2⤵
  PID:1460
- C:\Windows\System\qWfbOHc.exe
  C:\Windows\System\qWfbOHc.exe
  2⤵
  PID:5140
- C:\Windows\System\pjidhxa.exe
  C:\Windows\System\pjidhxa.exe
  2⤵
  PID:5160
- C:\Windows\System\LDbTQbZ.exe
  C:\Windows\System\LDbTQbZ.exe
  2⤵
  PID:5200
- C:\Windows\System\PggnUpH.exe
  C:\Windows\System\PggnUpH.exe
  2⤵
  PID:5220
- C:\Windows\System\fecuRzu.exe
  C:\Windows\System\fecuRzu.exe
  2⤵
  PID:5252
- C:\Windows\System\KXwJFhD.exe
  C:\Windows\System\KXwJFhD.exe
  2⤵
  PID:5268
- C:\Windows\System\qkJhQMI.exe
  C:\Windows\System\qkJhQMI.exe
  2⤵
  PID:5284
- C:\Windows\System\JkYCZRY.exe
  C:\Windows\System\JkYCZRY.exe
  2⤵
  PID:5312
- C:\Windows\System\DfQzFLr.exe
  C:\Windows\System\DfQzFLr.exe
  2⤵
  PID:5328
- C:\Windows\System\tROZEIY.exe
  C:\Windows\System\tROZEIY.exe
  2⤵
  PID:5348
- C:\Windows\System\jyHneMZ.exe
  C:\Windows\System\jyHneMZ.exe
  2⤵
  PID:5368
- C:\Windows\System\JOGqktQ.exe
  C:\Windows\System\JOGqktQ.exe
  2⤵
  PID:5404
- C:\Windows\System\NXGFJKn.exe
  C:\Windows\System\NXGFJKn.exe
  2⤵
  PID:5420
- C:\Windows\System\AGZwARm.exe
  C:\Windows\System\AGZwARm.exe
  2⤵
  PID:5436
- C:\Windows\System\hlKKeSp.exe
  C:\Windows\System\hlKKeSp.exe
  2⤵
  PID:5452
- C:\Windows\System\MudtPXo.exe
  C:\Windows\System\MudtPXo.exe
  2⤵
  PID:5472
- C:\Windows\System\qLDIXmq.exe
  C:\Windows\System\qLDIXmq.exe
  2⤵
  PID:5492
- C:\Windows\System\keZTnte.exe
  C:\Windows\System\keZTnte.exe
  2⤵
  PID:5516
- C:\Windows\System\YTbKKdn.exe
  C:\Windows\System\YTbKKdn.exe
  2⤵
  PID:5560
- C:\Windows\System\furaYMm.exe
  C:\Windows\System\furaYMm.exe
  2⤵
  PID:5604
- C:\Windows\System\LDuxKCB.exe
  C:\Windows\System\LDuxKCB.exe
  2⤵
  PID:5620
- C:\Windows\System\GDRDeHd.exe
  C:\Windows\System\GDRDeHd.exe
  2⤵
  PID:5640
- C:\Windows\System\JpwaLjC.exe
  C:\Windows\System\JpwaLjC.exe
  2⤵
  PID:5660
- C:\Windows\System\CMjMWTC.exe
  C:\Windows\System\CMjMWTC.exe
  2⤵
  PID:5680
- C:\Windows\System\PijKCFJ.exe
  C:\Windows\System\PijKCFJ.exe
  2⤵
  PID:5704
- C:\Windows\System\GlNlOEB.exe
  C:\Windows\System\GlNlOEB.exe
  2⤵
  PID:5724
- C:\Windows\System\WbmxPBz.exe
  C:\Windows\System\WbmxPBz.exe
  2⤵
  PID:5744
- C:\Windows\System\QvNYboD.exe
  C:\Windows\System\QvNYboD.exe
  2⤵
  PID:5760
- C:\Windows\System\LhmOjLL.exe
  C:\Windows\System\LhmOjLL.exe
  2⤵
  PID:5784
- C:\Windows\System\dcYFaYf.exe
  C:\Windows\System\dcYFaYf.exe
  2⤵
  PID:5800
- C:\Windows\System\mJPgemD.exe
  C:\Windows\System\mJPgemD.exe
  2⤵
  PID:5824
- C:\Windows\System\bMkJAgQ.exe
  C:\Windows\System\bMkJAgQ.exe
  2⤵
  PID:5840
- C:\Windows\System\dtyuhQv.exe
  C:\Windows\System\dtyuhQv.exe
  2⤵
  PID:5868
- C:\Windows\System\lxYMLkP.exe
  C:\Windows\System\lxYMLkP.exe
  2⤵
  PID:5888
- C:\Windows\System\WDmfSET.exe
  C:\Windows\System\WDmfSET.exe
  2⤵
  PID:5916
- C:\Windows\System\GhgUVLX.exe
  C:\Windows\System\GhgUVLX.exe
  2⤵
  PID:5936
- C:\Windows\System\VrsRmiw.exe
  C:\Windows\System\VrsRmiw.exe
  2⤵
  PID:5968
- C:\Windows\System\wILrcLf.exe
  C:\Windows\System\wILrcLf.exe
  2⤵
  PID:5988
- C:\Windows\System\nXYsPun.exe
  C:\Windows\System\nXYsPun.exe
  2⤵
  PID:6008
- C:\Windows\System\CzJSDvw.exe
  C:\Windows\System\CzJSDvw.exe
  2⤵
  PID:6028
- C:\Windows\System\eIlnwSl.exe
  C:\Windows\System\eIlnwSl.exe
  2⤵
  PID:6044
- C:\Windows\System\HhXGjFj.exe
  C:\Windows\System\HhXGjFj.exe
  2⤵
  PID:6068
- C:\Windows\System\VpsThGN.exe
  C:\Windows\System\VpsThGN.exe
  2⤵
  PID:6084
- C:\Windows\System\LmZGNPj.exe
  C:\Windows\System\LmZGNPj.exe
  2⤵
  PID:6108
- C:\Windows\System\iZiwKAR.exe
  C:\Windows\System\iZiwKAR.exe
  2⤵
  PID:6128
- C:\Windows\System\KGjwbKP.exe
  C:\Windows\System\KGjwbKP.exe
  2⤵
  PID:2284
- C:\Windows\System\rkgJHfz.exe
  C:\Windows\System\rkgJHfz.exe
  2⤵
  PID:5092
- C:\Windows\System\ZPWrnUG.exe
  C:\Windows\System\ZPWrnUG.exe
  2⤵
  PID:4348
- C:\Windows\System\mvFiIwj.exe
  C:\Windows\System\mvFiIwj.exe
  2⤵
  PID:2380
- C:\Windows\System\jfpQRmW.exe
  C:\Windows\System\jfpQRmW.exe
  2⤵
  PID:2140
- C:\Windows\System\JpRYCUO.exe
  C:\Windows\System\JpRYCUO.exe
  2⤵
  PID:2920
- C:\Windows\System\VnjypLT.exe
  C:\Windows\System\VnjypLT.exe
  2⤵
  PID:4032
- C:\Windows\System\NFQQupz.exe
  C:\Windows\System\NFQQupz.exe
  2⤵
  PID:5292
- C:\Windows\System\fJUeVNv.exe
  C:\Windows\System\fJUeVNv.exe
  2⤵
  PID:60
- C:\Windows\System\mQHCeRm.exe
  C:\Windows\System\mQHCeRm.exe
  2⤵
  PID:2732
- C:\Windows\System\PpyAkoR.exe
  C:\Windows\System\PpyAkoR.exe
  2⤵
  PID:4224
- C:\Windows\System\BluOVNp.exe
  C:\Windows\System\BluOVNp.exe
  2⤵
  PID:5504
- C:\Windows\System\OLFXrkp.exe
  C:\Windows\System\OLFXrkp.exe
  2⤵
  PID:2060
- C:\Windows\System\gkMfphW.exe
  C:\Windows\System\gkMfphW.exe
  2⤵
  PID:2296
- C:\Windows\System\vJIDpPZ.exe
  C:\Windows\System\vJIDpPZ.exe
  2⤵
  PID:3440
- C:\Windows\System\gPzrwXh.exe
  C:\Windows\System\gPzrwXh.exe
  2⤵
  PID:3620
- C:\Windows\System\rHmxyne.exe
  C:\Windows\System\rHmxyne.exe
  2⤵
  PID:6152
- C:\Windows\System\URYuWwj.exe
  C:\Windows\System\URYuWwj.exe
  2⤵
  PID:6168
- C:\Windows\System\HgWdTqR.exe
  C:\Windows\System\HgWdTqR.exe
  2⤵
  PID:6188
- C:\Windows\System\DreXkoc.exe
  C:\Windows\System\DreXkoc.exe
  2⤵
  PID:6204
- C:\Windows\System\MqWsJsj.exe
  C:\Windows\System\MqWsJsj.exe
  2⤵
  PID:6252
- C:\Windows\System\Iruzios.exe
  C:\Windows\System\Iruzios.exe
  2⤵
  PID:6352
- C:\Windows\System\eTWNcOL.exe
  C:\Windows\System\eTWNcOL.exe
  2⤵
  PID:6368
- C:\Windows\System\ELLlHKP.exe
  C:\Windows\System\ELLlHKP.exe
  2⤵
  PID:6384
- C:\Windows\System\aieVoBg.exe
  C:\Windows\System\aieVoBg.exe
  2⤵
  PID:6400
- C:\Windows\System\vyZMJip.exe
  C:\Windows\System\vyZMJip.exe
  2⤵
  PID:6424
- C:\Windows\System\qoBNAHu.exe
  C:\Windows\System\qoBNAHu.exe
  2⤵
  PID:6456
- C:\Windows\System\MhMjIsf.exe
  C:\Windows\System\MhMjIsf.exe
  2⤵
  PID:6472
- C:\Windows\System\JfbEvsl.exe
  C:\Windows\System\JfbEvsl.exe
  2⤵
  PID:6496
- C:\Windows\System\RfWdJae.exe
  C:\Windows\System\RfWdJae.exe
  2⤵
  PID:6516
- C:\Windows\System\CYcbnhz.exe
  C:\Windows\System\CYcbnhz.exe
  2⤵
  PID:6540
- C:\Windows\System\UzyltgD.exe
  C:\Windows\System\UzyltgD.exe
  2⤵
  PID:6556
- C:\Windows\System\ilrxZjV.exe
  C:\Windows\System\ilrxZjV.exe
  2⤵
  PID:6576
- C:\Windows\System\AJqhWdX.exe
  C:\Windows\System\AJqhWdX.exe
  2⤵
  PID:6592
- C:\Windows\System\LYIwcfm.exe
  C:\Windows\System\LYIwcfm.exe
  2⤵
  PID:6616
- C:\Windows\System\fJdbCCy.exe
  C:\Windows\System\fJdbCCy.exe
  2⤵
  PID:6632
- C:\Windows\System\PoRnohD.exe
  C:\Windows\System\PoRnohD.exe
  2⤵
  PID:6664
- C:\Windows\System\rzbQOZC.exe
  C:\Windows\System\rzbQOZC.exe
  2⤵
  PID:6680
- C:\Windows\System\PJhYxor.exe
  C:\Windows\System\PJhYxor.exe
  2⤵
  PID:6696
- C:\Windows\System\lEiaWQP.exe
  C:\Windows\System\lEiaWQP.exe
  2⤵
  PID:6712
- C:\Windows\System\PVpXzgQ.exe
  C:\Windows\System\PVpXzgQ.exe
  2⤵
  PID:6736
- C:\Windows\System\ENeSKKw.exe
  C:\Windows\System\ENeSKKw.exe
  2⤵
  PID:6752
- C:\Windows\System\QMhdrzR.exe
  C:\Windows\System\QMhdrzR.exe
  2⤵
  PID:6776
- C:\Windows\System\JmjiKtS.exe
  C:\Windows\System\JmjiKtS.exe
  2⤵
  PID:6792
- C:\Windows\System\VKHJGXb.exe
  C:\Windows\System\VKHJGXb.exe
  2⤵
  PID:6812
- C:\Windows\System\hblNcEg.exe
  C:\Windows\System\hblNcEg.exe
  2⤵
  PID:6832
- C:\Windows\System\xWOzyHF.exe
  C:\Windows\System\xWOzyHF.exe
  2⤵
  PID:6848
- C:\Windows\System\sLkNSgW.exe
  C:\Windows\System\sLkNSgW.exe
  2⤵
  PID:6872
- C:\Windows\System\piYwOQU.exe
  C:\Windows\System\piYwOQU.exe
  2⤵
  PID:6892
- C:\Windows\System\KuUTDFu.exe
  C:\Windows\System\KuUTDFu.exe
  2⤵
  PID:6912
- C:\Windows\System\WdjsaFd.exe
  C:\Windows\System\WdjsaFd.exe
  2⤵
  PID:6932
- C:\Windows\System\chthHJt.exe
  C:\Windows\System\chthHJt.exe
  2⤵
  PID:6952
- C:\Windows\System\GoqvTsK.exe
  C:\Windows\System\GoqvTsK.exe
  2⤵
  PID:6976
- C:\Windows\System\BMwFOku.exe
  C:\Windows\System\BMwFOku.exe
  2⤵
  PID:7000
- C:\Windows\System\wkEjVJC.exe
  C:\Windows\System\wkEjVJC.exe
  2⤵
  PID:7016
- C:\Windows\System\zmvadXO.exe
  C:\Windows\System\zmvadXO.exe
  2⤵
  PID:7040
- C:\Windows\System\muuOZvm.exe
  C:\Windows\System\muuOZvm.exe
  2⤵
  PID:7056
- C:\Windows\System\ycpaiwF.exe
  C:\Windows\System\ycpaiwF.exe
  2⤵
  PID:7080
- C:\Windows\System\UZGvjUK.exe
  C:\Windows\System\UZGvjUK.exe
  2⤵
  PID:7104
- C:\Windows\System\HavxEcp.exe
  C:\Windows\System\HavxEcp.exe
  2⤵
  PID:7120
- C:\Windows\System\EjAmHsX.exe
  C:\Windows\System\EjAmHsX.exe
  2⤵
  PID:7140
- C:\Windows\System\aCJWgNE.exe
  C:\Windows\System\aCJWgNE.exe
  2⤵
  PID:7156
- C:\Windows\System\bzAieCb.exe
  C:\Windows\System\bzAieCb.exe
  2⤵
  PID:5692
- C:\Windows\System\rVPglbj.exe
  C:\Windows\System\rVPglbj.exe
  2⤵
  PID:1548
- C:\Windows\System\YCcnFVJ.exe
  C:\Windows\System\YCcnFVJ.exe
  2⤵
  PID:4748
- C:\Windows\System\qgOqjHZ.exe
  C:\Windows\System\qgOqjHZ.exe
  2⤵
  PID:1560
- C:\Windows\System\WpmKIcK.exe
  C:\Windows\System\WpmKIcK.exe
  2⤵
  PID:2420
- C:\Windows\System\hrsrCbl.exe
  C:\Windows\System\hrsrCbl.exe
  2⤵
  PID:3520
- C:\Windows\System\ZdSEiuB.exe
  C:\Windows\System\ZdSEiuB.exe
  2⤵
  PID:3844
- C:\Windows\System\NPEdEeW.exe
  C:\Windows\System\NPEdEeW.exe
  2⤵
  PID:1316
- C:\Windows\System\RkHonhz.exe
  C:\Windows\System\RkHonhz.exe
  2⤵
  PID:1684
- C:\Windows\System\APrToxt.exe
  C:\Windows\System\APrToxt.exe
  2⤵
  PID:3020
- C:\Windows\System\jdsCApb.exe
  C:\Windows\System\jdsCApb.exe
  2⤵
  PID:3920
- C:\Windows\System\XTVxIDe.exe
  C:\Windows\System\XTVxIDe.exe
  2⤵
  PID:6212
- C:\Windows\System\aiHnDkg.exe
  C:\Windows\System\aiHnDkg.exe
  2⤵
  PID:5264
- C:\Windows\System\aJZmCTZ.exe
  C:\Windows\System\aJZmCTZ.exe
  2⤵
  PID:5860
- C:\Windows\System\hynalJP.exe
  C:\Windows\System\hynalJP.exe
  2⤵
  PID:5360
- C:\Windows\System\xMESeYK.exe
  C:\Windows\System\xMESeYK.exe
  2⤵
  PID:1408
- C:\Windows\System\WeixLFF.exe
  C:\Windows\System\WeixLFF.exe
  2⤵
  PID:3188
- C:\Windows\System\ccHOndy.exe
  C:\Windows\System\ccHOndy.exe
  2⤵
  PID:5428
- C:\Windows\System\kVhenMX.exe
  C:\Windows\System\kVhenMX.exe
  2⤵
  PID:5488
- C:\Windows\System\MzviUIh.exe
  C:\Windows\System\MzviUIh.exe
  2⤵
  PID:5596
- C:\Windows\System\RdOMRcd.exe
  C:\Windows\System\RdOMRcd.exe
  2⤵
  PID:5932
- C:\Windows\System\fyWNonc.exe
  C:\Windows\System\fyWNonc.exe
  2⤵
  PID:5884
- C:\Windows\System\UEhTNsM.exe
  C:\Windows\System\UEhTNsM.exe
  2⤵
  PID:2764
- C:\Windows\System\zuXbUuj.exe
  C:\Windows\System\zuXbUuj.exe
  2⤵
  PID:4016
- C:\Windows\System\djsBZBO.exe
  C:\Windows\System\djsBZBO.exe
  2⤵
  PID:5820
- C:\Windows\System\vINMYaB.exe
  C:\Windows\System\vINMYaB.exe
  2⤵
  PID:5792
- C:\Windows\System\iLuvsEQ.exe
  C:\Windows\System\iLuvsEQ.exe
  2⤵
  PID:5756
- C:\Windows\System\YBiOPgc.exe
  C:\Windows\System\YBiOPgc.exe
  2⤵
  PID:5720
- C:\Windows\System\JvFhyLR.exe
  C:\Windows\System\JvFhyLR.exe
  2⤵
  PID:5956
- C:\Windows\System\dUtBsfy.exe
  C:\Windows\System\dUtBsfy.exe
  2⤵
  PID:5996
- C:\Windows\System\ITIyRdK.exe
  C:\Windows\System\ITIyRdK.exe
  2⤵
  PID:6024
- C:\Windows\System\RIQEtJM.exe
  C:\Windows\System\RIQEtJM.exe
  2⤵
  PID:6092
- C:\Windows\System\ooTirnw.exe
  C:\Windows\System\ooTirnw.exe
  2⤵
  PID:6116
- C:\Windows\System\cnplwvw.exe
  C:\Windows\System\cnplwvw.exe
  2⤵
  PID:1672
- C:\Windows\System\LJiJrUX.exe
  C:\Windows\System\LJiJrUX.exe
  2⤵
  PID:1416
- C:\Windows\System\ChTzmLI.exe
  C:\Windows\System\ChTzmLI.exe
  2⤵
  PID:4584
- C:\Windows\System\cRVbFwU.exe
  C:\Windows\System\cRVbFwU.exe
  2⤵
  PID:1112
- C:\Windows\System\YfbPfAJ.exe
  C:\Windows\System\YfbPfAJ.exe
  2⤵
  PID:5340
- C:\Windows\System\EdvjxqI.exe
  C:\Windows\System\EdvjxqI.exe
  2⤵
  PID:448
- C:\Windows\System\jxxmiFL.exe
  C:\Windows\System\jxxmiFL.exe
  2⤵
  PID:2120
- C:\Windows\System\bGgLwgj.exe
  C:\Windows\System\bGgLwgj.exe
  2⤵
  PID:2796
- C:\Windows\System\VMhLVSa.exe
  C:\Windows\System\VMhLVSa.exe
  2⤵
  PID:6160
- C:\Windows\System\BMFSRIt.exe
  C:\Windows\System\BMFSRIt.exe
  2⤵
  PID:3544
- C:\Windows\System\eackjkk.exe
  C:\Windows\System\eackjkk.exe
  2⤵
  PID:6320
- C:\Windows\System\xTJPHZY.exe
  C:\Windows\System\xTJPHZY.exe
  2⤵
  PID:6360
- C:\Windows\System\SGwXgxd.exe
  C:\Windows\System\SGwXgxd.exe
  2⤵
  PID:6420
- C:\Windows\System\omQuafx.exe
  C:\Windows\System\omQuafx.exe
  2⤵
  PID:6464
- C:\Windows\System\pibcwge.exe
  C:\Windows\System\pibcwge.exe
  2⤵
  PID:6508
- C:\Windows\System\GmElzMC.exe
  C:\Windows\System\GmElzMC.exe
  2⤵
  PID:6656
- C:\Windows\System\TvUTYqd.exe
  C:\Windows\System\TvUTYqd.exe
  2⤵
  PID:6856
- C:\Windows\System\GdFKMrI.exe
  C:\Windows\System\GdFKMrI.exe
  2⤵
  PID:7024
- C:\Windows\System\WEZUduk.exe
  C:\Windows\System\WEZUduk.exe
  2⤵
  PID:4388
- C:\Windows\System\POUAHIs.exe
  C:\Windows\System\POUAHIs.exe
  2⤵
  PID:4920
- C:\Windows\System\SOpOmQx.exe
  C:\Windows\System\SOpOmQx.exe
  2⤵
  PID:5380
- C:\Windows\System\OGSXfke.exe
  C:\Windows\System\OGSXfke.exe
  2⤵
  PID:6728
- C:\Windows\System\plIkKFB.exe
  C:\Windows\System\plIkKFB.exe
  2⤵
  PID:6772
- C:\Windows\System\noRYXCs.exe
  C:\Windows\System\noRYXCs.exe
  2⤵
  PID:6828
- C:\Windows\System\zYknsyA.exe
  C:\Windows\System\zYknsyA.exe
  2⤵
  PID:6884
- C:\Windows\System\LhSjEKP.exe
  C:\Windows\System\LhSjEKP.exe
  2⤵
  PID:7176
- C:\Windows\System\QGizYBV.exe
  C:\Windows\System\QGizYBV.exe
  2⤵
  PID:7200
- C:\Windows\System\UuhpwGZ.exe
  C:\Windows\System\UuhpwGZ.exe
  2⤵
  PID:7216
- C:\Windows\System\HOaIRlP.exe
  C:\Windows\System\HOaIRlP.exe
  2⤵
  PID:7240
- C:\Windows\System\ElnDnER.exe
  C:\Windows\System\ElnDnER.exe
  2⤵
  PID:7256
- C:\Windows\System\ZVwwjkB.exe
  C:\Windows\System\ZVwwjkB.exe
  2⤵
  PID:7276
- C:\Windows\System\SBLxqdK.exe
  C:\Windows\System\SBLxqdK.exe
  2⤵
  PID:7296
- C:\Windows\System\idTvYyX.exe
  C:\Windows\System\idTvYyX.exe
  2⤵
  PID:7324
- C:\Windows\System\RGtkzUe.exe
  C:\Windows\System\RGtkzUe.exe
  2⤵
  PID:7340
- C:\Windows\System\QdhFVrV.exe
  C:\Windows\System\QdhFVrV.exe
  2⤵
  PID:7360
- C:\Windows\System\iNtNQWP.exe
  C:\Windows\System\iNtNQWP.exe
  2⤵
  PID:7376
- C:\Windows\System\jgDnddp.exe
  C:\Windows\System\jgDnddp.exe
  2⤵
  PID:7400
- C:\Windows\System\pxtwuMl.exe
  C:\Windows\System\pxtwuMl.exe
  2⤵
  PID:7416
- C:\Windows\System\ezVFeyr.exe
  C:\Windows\System\ezVFeyr.exe
  2⤵
  PID:7440
- C:\Windows\System\QdglamO.exe
  C:\Windows\System\QdglamO.exe
  2⤵
  PID:7464
- C:\Windows\System\ZVgmZuZ.exe
  C:\Windows\System\ZVgmZuZ.exe
  2⤵
  PID:7480
- C:\Windows\System\mPtbKJe.exe
  C:\Windows\System\mPtbKJe.exe
  2⤵
  PID:7508
- C:\Windows\System\LLTeDRf.exe
  C:\Windows\System\LLTeDRf.exe
  2⤵
  PID:7524
- C:\Windows\System\PObrFcI.exe
  C:\Windows\System\PObrFcI.exe
  2⤵
  PID:7544
- C:\Windows\System\syAtIkY.exe
  C:\Windows\System\syAtIkY.exe
  2⤵
  PID:7560
- C:\Windows\System\mvzQDQG.exe
  C:\Windows\System\mvzQDQG.exe
  2⤵
  PID:7584
- C:\Windows\System\xWDGeBS.exe
  C:\Windows\System\xWDGeBS.exe
  2⤵
  PID:7608
- C:\Windows\System\lloqOmj.exe
  C:\Windows\System\lloqOmj.exe
  2⤵
  PID:7624
- C:\Windows\System\pgJZAkI.exe
  C:\Windows\System\pgJZAkI.exe
  2⤵
  PID:7648
- C:\Windows\System\EJsIlRC.exe
  C:\Windows\System\EJsIlRC.exe
  2⤵
  PID:7664
- C:\Windows\System\bBuNPPq.exe
  C:\Windows\System\bBuNPPq.exe
  2⤵
  PID:7688
- C:\Windows\System\tcJcSHq.exe
  C:\Windows\System\tcJcSHq.exe
  2⤵
  PID:7708
- C:\Windows\System\QFypeim.exe
  C:\Windows\System\QFypeim.exe
  2⤵
  PID:7728
- C:\Windows\System\iFCSkVe.exe
  C:\Windows\System\iFCSkVe.exe
  2⤵
  PID:7744
- C:\Windows\System\cATPaae.exe
  C:\Windows\System\cATPaae.exe
  2⤵
  PID:7768
- C:\Windows\System\nvvzooQ.exe
  C:\Windows\System\nvvzooQ.exe
  2⤵
  PID:7784
- C:\Windows\System\jzajlXP.exe
  C:\Windows\System\jzajlXP.exe
  2⤵
  PID:7804
- C:\Windows\System\tNinSHq.exe
  C:\Windows\System\tNinSHq.exe
  2⤵
  PID:7824
- C:\Windows\System\oGsNfcN.exe
  C:\Windows\System\oGsNfcN.exe
  2⤵
  PID:7852
- C:\Windows\System\RxkJogQ.exe
  C:\Windows\System\RxkJogQ.exe
  2⤵
  PID:7868
- C:\Windows\System\pMLJqGw.exe
  C:\Windows\System\pMLJqGw.exe
  2⤵
  PID:7888
- C:\Windows\System\sejliwI.exe
  C:\Windows\System\sejliwI.exe
  2⤵
  PID:7904
- C:\Windows\System\vTxaXVS.exe
  C:\Windows\System\vTxaXVS.exe
  2⤵
  PID:7928
- C:\Windows\System\lYbnlRM.exe
  C:\Windows\System\lYbnlRM.exe
  2⤵
  PID:7944
- C:\Windows\System\iiOcncm.exe
  C:\Windows\System\iiOcncm.exe
  2⤵
  PID:7968
- C:\Windows\System\wJpfjZz.exe
  C:\Windows\System\wJpfjZz.exe
  2⤵
  PID:7984
- C:\Windows\System\gTFTpoM.exe
  C:\Windows\System\gTFTpoM.exe
  2⤵
  PID:8008
- C:\Windows\System\CSNGWab.exe
  C:\Windows\System\CSNGWab.exe
  2⤵
  PID:8024
- C:\Windows\System\UzmCtGP.exe
  C:\Windows\System\UzmCtGP.exe
  2⤵
  PID:8048
- C:\Windows\System\PVAXhFq.exe
  C:\Windows\System\PVAXhFq.exe
  2⤵
  PID:8068
- C:\Windows\System\urqtKDL.exe
  C:\Windows\System\urqtKDL.exe
  2⤵
  PID:8088
- C:\Windows\System\KQDptCN.exe
  C:\Windows\System\KQDptCN.exe
  2⤵
  PID:8104
- C:\Windows\System\nnyEMeB.exe
  C:\Windows\System\nnyEMeB.exe
  2⤵
  PID:8128
- C:\Windows\System\yoeOKjS.exe
  C:\Windows\System\yoeOKjS.exe
  2⤵
  PID:8144
- C:\Windows\System\IJHMVVL.exe
  C:\Windows\System\IJHMVVL.exe
  2⤵
  PID:8164
- C:\Windows\System\ixwloQB.exe
  C:\Windows\System\ixwloQB.exe
  2⤵
  PID:8180
- C:\Windows\System\fYazjAc.exe
  C:\Windows\System\fYazjAc.exe
  2⤵
  PID:7136
- C:\Windows\System\ytQWusE.exe
  C:\Windows\System\ytQWusE.exe
  2⤵
  PID:2168
- C:\Windows\System\rkzIsiZ.exe
  C:\Windows\System\rkzIsiZ.exe
  2⤵
  PID:5324
- C:\Windows\System\DHuBJNq.exe
  C:\Windows\System\DHuBJNq.exe
  2⤵
  PID:8212
- C:\Windows\System\XTzqJKt.exe
  C:\Windows\System\XTzqJKt.exe
  2⤵
  PID:8232
- C:\Windows\System\ZNiBPND.exe
  C:\Windows\System\ZNiBPND.exe
  2⤵
  PID:8252
- C:\Windows\System\JLvsVvU.exe
  C:\Windows\System\JLvsVvU.exe
  2⤵
  PID:8268
- C:\Windows\System\GFAAxfL.exe
  C:\Windows\System\GFAAxfL.exe
  2⤵
  PID:8288
- C:\Windows\System\wkhhGqN.exe
  C:\Windows\System\wkhhGqN.exe
  2⤵
  PID:8304
- C:\Windows\System\GbZimui.exe
  C:\Windows\System\GbZimui.exe
  2⤵
  PID:8324
- C:\Windows\System\eFkKJPl.exe
  C:\Windows\System\eFkKJPl.exe
  2⤵
  PID:8348
- C:\Windows\System\xhXffqp.exe
  C:\Windows\System\xhXffqp.exe
  2⤵
  PID:8676
- C:\Windows\System\gNDsbiu.exe
  C:\Windows\System\gNDsbiu.exe
  2⤵
  PID:1732
- C:\Windows\System\Ayyqwzz.exe
  C:\Windows\System\Ayyqwzz.exe
  2⤵
  PID:7964
- C:\Windows\System\iNYZbVA.exe
  C:\Windows\System\iNYZbVA.exe
  2⤵
  PID:8020
- C:\Windows\System\tRnTYhc.exe
  C:\Windows\System\tRnTYhc.exe
  2⤵
  PID:1940
- C:\Windows\System\jTipTqc.exe
  C:\Windows\System\jTipTqc.exe
  2⤵
  PID:5460
- C:\Windows\System\QaqAuRr.exe
  C:\Windows\System\QaqAuRr.exe
  2⤵
  PID:2128
- C:\Windows\System\CgmLaEh.exe
  C:\Windows\System\CgmLaEh.exe
  2⤵
  PID:6676
- C:\Windows\System\QhbZyyP.exe
  C:\Windows\System\QhbZyyP.exe
  2⤵
  PID:6928
- C:\Windows\System\HnGPvrP.exe
  C:\Windows\System\HnGPvrP.exe
  2⤵
  PID:6992
- C:\Windows\System\arqnUyC.exe
  C:\Windows\System\arqnUyC.exe
  2⤵
  PID:7072
- C:\Windows\System\KrhqwFs.exe
  C:\Windows\System\KrhqwFs.exe
  2⤵
  PID:7152
- C:\Windows\System\HJGEZVQ.exe
  C:\Windows\System\HJGEZVQ.exe
  2⤵
  PID:7536
- C:\Windows\System\FTWxOSQ.exe
  C:\Windows\System\FTWxOSQ.exe
  2⤵
  PID:3292
- C:\Windows\System\mhgpGfp.exe
  C:\Windows\System\mhgpGfp.exe
  2⤵
  PID:5156
- C:\Windows\System\ZOtJPSo.exe
  C:\Windows\System\ZOtJPSo.exe
  2⤵
  PID:8604
- C:\Windows\System\fcicDGk.exe
  C:\Windows\System\fcicDGk.exe
  2⤵
  PID:5616
- C:\Windows\System\gRlRaNc.exe
  C:\Windows\System\gRlRaNc.exe
  2⤵
  PID:8188
- C:\Windows\System\tFybxLI.exe
  C:\Windows\System\tFybxLI.exe
  2⤵
  PID:1552
- C:\Windows\System\nAGdNGc.exe
  C:\Windows\System\nAGdNGc.exe
  2⤵
  PID:8196
- C:\Windows\System\aOKfXut.exe
  C:\Windows\System\aOKfXut.exe
  2⤵
  PID:5740
- C:\Windows\System\MgoOkot.exe
  C:\Windows\System\MgoOkot.exe
  2⤵
  PID:6052
- C:\Windows\System\goSvUvJ.exe
  C:\Windows\System\goSvUvJ.exe
  2⤵
  PID:4192
- C:\Windows\System\eIZpZnf.exe
  C:\Windows\System\eIZpZnf.exe
  2⤵
  PID:7592
- C:\Windows\System\UQzdESI.exe
  C:\Windows\System\UQzdESI.exe
  2⤵
  PID:7472
- C:\Windows\System\owZoScm.exe
  C:\Windows\System\owZoScm.exe
  2⤵
  PID:7616
- C:\Windows\System\XJrJhhY.exe
  C:\Windows\System\XJrJhhY.exe
  2⤵
  PID:7796
- C:\Windows\System\GlSpjGB.exe
  C:\Windows\System\GlSpjGB.exe
  2⤵
  PID:8056
- C:\Windows\System\TzatDXX.exe
  C:\Windows\System\TzatDXX.exe
  2⤵
  PID:8136
- C:\Windows\System\AyfLGwC.exe
  C:\Windows\System\AyfLGwC.exe
  2⤵
  PID:1320
- C:\Windows\System\ySiujzB.exe
  C:\Windows\System\ySiujzB.exe
  2⤵
  PID:8392
- C:\Windows\System\LOOkjTj.exe
  C:\Windows\System\LOOkjTj.exe
  2⤵
  PID:5732
- C:\Windows\System\BdToVak.exe
  C:\Windows\System\BdToVak.exe
  2⤵
  PID:6136
- C:\Windows\System\xRpaqmq.exe
  C:\Windows\System\xRpaqmq.exe
  2⤵
  PID:1752
- C:\Windows\System\YsSxJck.exe
  C:\Windows\System\YsSxJck.exe
  2⤵
  PID:4912
- C:\Windows\System\DzKbFPd.exe
  C:\Windows\System\DzKbFPd.exe
  2⤵
  PID:6148
- C:\Windows\System\TvNoqqz.exe
  C:\Windows\System\TvNoqqz.exe
  2⤵
  PID:6964
- C:\Windows\System\YCdnpEM.exe
  C:\Windows\System\YCdnpEM.exe
  2⤵
  PID:7476
- C:\Windows\System\JJcXjUy.exe
  C:\Windows\System\JJcXjUy.exe
  2⤵
  PID:7540
- C:\Windows\System\qRMhqqO.exe
  C:\Windows\System\qRMhqqO.exe
  2⤵
  PID:7596
- C:\Windows\System\FyzSpSv.exe
  C:\Windows\System\FyzSpSv.exe
  2⤵
  PID:7644
- C:\Windows\System\FsvIFJh.exe
  C:\Windows\System\FsvIFJh.exe
  2⤵
  PID:7752
- C:\Windows\System\NPdLcJC.exe
  C:\Windows\System\NPdLcJC.exe
  2⤵
  PID:7800
- C:\Windows\System\mmvVVUi.exe
  C:\Windows\System\mmvVVUi.exe
  2⤵
  PID:7864
- C:\Windows\System\elUNKmm.exe
  C:\Windows\System\elUNKmm.exe
  2⤵
  PID:7912
- C:\Windows\System\cUSPlKL.exe
  C:\Windows\System\cUSPlKL.exe
  2⤵
  PID:8080
- C:\Windows\System\rMAYFYN.exe
  C:\Windows\System\rMAYFYN.exe
  2⤵
  PID:9000
- C:\Windows\System\tIRXVOt.exe
  C:\Windows\System\tIRXVOt.exe
  2⤵
  PID:8228
- C:\Windows\System\JITlrki.exe
  C:\Windows\System\JITlrki.exe
  2⤵
  PID:8300
- C:\Windows\System\zlyVmje.exe
  C:\Windows\System\zlyVmje.exe
  2⤵
  PID:9072
- C:\Windows\System\XiMxzhp.exe
  C:\Windows\System\XiMxzhp.exe
  2⤵
  PID:4756
- C:\Windows\System\KVCGFWt.exe
  C:\Windows\System\KVCGFWt.exe
  2⤵
  PID:9120
- C:\Windows\System\OeyvrNx.exe
  C:\Windows\System\OeyvrNx.exe
  2⤵
  PID:8432
- C:\Windows\System\cjUZMSA.exe
  C:\Windows\System\cjUZMSA.exe
  2⤵
  PID:2784
- C:\Windows\System\RIKjlOQ.exe
  C:\Windows\System\RIKjlOQ.exe
  2⤵
  PID:6396
- C:\Windows\System\rVCfjIc.exe
  C:\Windows\System\rVCfjIc.exe
  2⤵
  PID:3220
- C:\Windows\System\QdGjhlJ.exe
  C:\Windows\System\QdGjhlJ.exe
  2⤵
  PID:6788
- C:\Windows\System\RKhavOu.exe
  C:\Windows\System\RKhavOu.exe
  2⤵
  PID:7248
- C:\Windows\System\tiwLPLF.exe
  C:\Windows\System\tiwLPLF.exe
  2⤵
  PID:5984
- C:\Windows\System\ordmqfD.exe
  C:\Windows\System\ordmqfD.exe
  2⤵
  PID:8296
- C:\Windows\System\CbGlWkL.exe
  C:\Windows\System\CbGlWkL.exe
  2⤵
  PID:8664
- C:\Windows\System\ivGvJUS.exe
  C:\Windows\System\ivGvJUS.exe
  2⤵
  PID:1640
- C:\Windows\System\tPSFZtr.exe
  C:\Windows\System\tPSFZtr.exe
  2⤵
  PID:9196
- C:\Windows\System\poqkUGS.exe
  C:\Windows\System\poqkUGS.exe
  2⤵
  PID:9252
- C:\Windows\System\zIhRxyd.exe
  C:\Windows\System\zIhRxyd.exe
  2⤵
  PID:9268
- C:\Windows\System\DNuaSzm.exe
  C:\Windows\System\DNuaSzm.exe
  2⤵
  PID:9284
- C:\Windows\System\xvbPPgB.exe
  C:\Windows\System\xvbPPgB.exe
  2⤵
  PID:9312
- C:\Windows\System\YNrqzkB.exe
  C:\Windows\System\YNrqzkB.exe
  2⤵
  PID:9336
- C:\Windows\System\cUENwag.exe
  C:\Windows\System\cUENwag.exe
  2⤵
  PID:9352
- C:\Windows\System\WBmMMyT.exe
  C:\Windows\System\WBmMMyT.exe
  2⤵
  PID:9368
- C:\Windows\System\ffHcFfy.exe
  C:\Windows\System\ffHcFfy.exe
  2⤵
  PID:9384
- C:\Windows\System\QqOZEKr.exe
  C:\Windows\System\QqOZEKr.exe
  2⤵
  PID:9460
- C:\Windows\System\DZrrhqs.exe
  C:\Windows\System\DZrrhqs.exe
  2⤵
  PID:9476
- C:\Windows\System\pdwQxhw.exe
  C:\Windows\System\pdwQxhw.exe
  2⤵
  PID:9492
- C:\Windows\System\WKwMSLI.exe
  C:\Windows\System\WKwMSLI.exe
  2⤵
  PID:9508
- C:\Windows\System\MzalZbB.exe
  C:\Windows\System\MzalZbB.exe
  2⤵
  PID:9524
- C:\Windows\System\GBGTpNC.exe
  C:\Windows\System\GBGTpNC.exe
  2⤵
  PID:9540
- C:\Windows\System\PmuxtzK.exe
  C:\Windows\System\PmuxtzK.exe
  2⤵
  PID:9556
- C:\Windows\System\RgFhmXu.exe
  C:\Windows\System\RgFhmXu.exe
  2⤵
  PID:9572
- C:\Windows\System\GtMWsEi.exe
  C:\Windows\System\GtMWsEi.exe
  2⤵
  PID:9588
- C:\Windows\System\mkglWJE.exe
  C:\Windows\System\mkglWJE.exe
  2⤵
  PID:9604
- C:\Windows\System\kZIYiAJ.exe
  C:\Windows\System\kZIYiAJ.exe
  2⤵
  PID:9620
- C:\Windows\System\wRoEZtA.exe
  C:\Windows\System\wRoEZtA.exe
  2⤵
  PID:9640
- C:\Windows\System\yWeOQxD.exe
  C:\Windows\System\yWeOQxD.exe
  2⤵
  PID:9656
- C:\Windows\System\KpDzVNG.exe
  C:\Windows\System\KpDzVNG.exe
  2⤵
  PID:9672
- C:\Windows\System\RLFxesV.exe
  C:\Windows\System\RLFxesV.exe
  2⤵
  PID:9688
- C:\Windows\System\IUjyxkR.exe
  C:\Windows\System\IUjyxkR.exe
  2⤵
  PID:9708
- C:\Windows\System\sdtdEil.exe
  C:\Windows\System\sdtdEil.exe
  2⤵
  PID:9732
- C:\Windows\System\CpyGiNk.exe
  C:\Windows\System\CpyGiNk.exe
  2⤵
  PID:9748
- C:\Windows\System\VGYLvJN.exe
  C:\Windows\System\VGYLvJN.exe
  2⤵
  PID:9768
- C:\Windows\System\KzwjOfp.exe
  C:\Windows\System\KzwjOfp.exe
  2⤵
  PID:9792
- C:\Windows\System\RRfgSXY.exe
  C:\Windows\System\RRfgSXY.exe
  2⤵
  PID:9816
- C:\Windows\System\udGxwkJ.exe
  C:\Windows\System\udGxwkJ.exe
  2⤵
  PID:9832
- C:\Windows\System\XAEcjph.exe
  C:\Windows\System\XAEcjph.exe
  2⤵
  PID:9960
- C:\Windows\System\TKxpebQ.exe
  C:\Windows\System\TKxpebQ.exe
  2⤵
  PID:9980
- C:\Windows\System\jCzQIJo.exe
  C:\Windows\System\jCzQIJo.exe
  2⤵
  PID:10004
- C:\Windows\System\akrqbOL.exe
  C:\Windows\System\akrqbOL.exe
  2⤵
  PID:10020
- C:\Windows\System\xzGGCVe.exe
  C:\Windows\System\xzGGCVe.exe
  2⤵
  PID:10044
- C:\Windows\System\awrZmVH.exe
  C:\Windows\System\awrZmVH.exe
  2⤵
  PID:10068
- C:\Windows\System\DhNDkWA.exe
  C:\Windows\System\DhNDkWA.exe
  2⤵
  PID:10088
- C:\Windows\System\HXVYUdk.exe
  C:\Windows\System\HXVYUdk.exe
  2⤵
  PID:10112
- C:\Windows\System\AAzMmyb.exe
  C:\Windows\System\AAzMmyb.exe
  2⤵
  PID:10148
- C:\Windows\System\xzJaUQV.exe
  C:\Windows\System\xzJaUQV.exe
  2⤵
  PID:10168
- C:\Windows\System\PHSgggt.exe
  C:\Windows\System\PHSgggt.exe
  2⤵
  PID:10188
- C:\Windows\System\NdPAuWh.exe
  C:\Windows\System\NdPAuWh.exe
  2⤵
  PID:10220
- C:\Windows\System\WONVrzg.exe
  C:\Windows\System\WONVrzg.exe
  2⤵
  PID:10236
- C:\Windows\System\FGRZDDn.exe
  C:\Windows\System\FGRZDDn.exe
  2⤵
  PID:8772
- C:\Windows\System\wmCCbXX.exe
  C:\Windows\System\wmCCbXX.exe
  2⤵
  PID:8816
- C:\Windows\System\nsZMJKe.exe
  C:\Windows\System\nsZMJKe.exe
  2⤵
  PID:8860
- C:\Windows\System\TGnWjee.exe
  C:\Windows\System\TGnWjee.exe
  2⤵
  PID:8904
- C:\Windows\System\gHKwVlx.exe
  C:\Windows\System\gHKwVlx.exe
  2⤵
  PID:8956
- C:\Windows\System\TobaIWr.exe
  C:\Windows\System\TobaIWr.exe
  2⤵
  PID:9032
- C:\Windows\System\rEYjCUh.exe
  C:\Windows\System\rEYjCUh.exe
  2⤵
  PID:7500
- C:\Windows\System\YScvhkm.exe
  C:\Windows\System\YScvhkm.exe
  2⤵
  PID:8172
- C:\Windows\System\zAuhXvy.exe
  C:\Windows\System\zAuhXvy.exe
  2⤵
  PID:8100
- C:\Windows\System\zNOyTdR.exe
  C:\Windows\System\zNOyTdR.exe
  2⤵
  PID:7092
- C:\Windows\System\fOTBLmv.exe
  C:\Windows\System\fOTBLmv.exe
  2⤵
  PID:8724
- C:\Windows\System\cCXReDg.exe
  C:\Windows\System\cCXReDg.exe
  2⤵
  PID:10248
- C:\Windows\System\NtLAIxo.exe
  C:\Windows\System\NtLAIxo.exe
  2⤵
  PID:10272
- C:\Windows\System\dabzSEE.exe
  C:\Windows\System\dabzSEE.exe
  2⤵
  PID:10296
- C:\Windows\System\AsBnXPy.exe
  C:\Windows\System\AsBnXPy.exe
  2⤵
  PID:10312
- C:\Windows\System\YsOpbgP.exe
  C:\Windows\System\YsOpbgP.exe
  2⤵
  PID:10332
- C:\Windows\System\McvyurN.exe
  C:\Windows\System\McvyurN.exe
  2⤵
  PID:10352
- C:\Windows\System\GQopqiY.exe
  C:\Windows\System\GQopqiY.exe
  2⤵
  PID:10380
- C:\Windows\System\QlzRiFr.exe
  C:\Windows\System\QlzRiFr.exe
  2⤵
  PID:10408
- C:\Windows\System\Trouhwz.exe
  C:\Windows\System\Trouhwz.exe
  2⤵
  PID:10424
- C:\Windows\System\ROKdjBc.exe
  C:\Windows\System\ROKdjBc.exe
  2⤵
  PID:10440
- C:\Windows\System\GWernKT.exe
  C:\Windows\System\GWernKT.exe
  2⤵
  PID:10456
- C:\Windows\System\AnngsIz.exe
  C:\Windows\System\AnngsIz.exe
  2⤵
  PID:10472
- C:\Windows\System\XUnfIFu.exe
  C:\Windows\System\XUnfIFu.exe
  2⤵
  PID:10492
- C:\Windows\System\RiEiGgq.exe
  C:\Windows\System\RiEiGgq.exe
  2⤵
  PID:10520
- C:\Windows\System\FqyhVCR.exe
  C:\Windows\System\FqyhVCR.exe
  2⤵
  PID:10548
- C:\Windows\System\ADbjXTV.exe
  C:\Windows\System\ADbjXTV.exe
  2⤵
  PID:10572
- C:\Windows\System\FsrmCNt.exe
  C:\Windows\System\FsrmCNt.exe
  2⤵
  PID:10596
- C:\Windows\System\jiSVQTp.exe
  C:\Windows\System\jiSVQTp.exe
  2⤵
  PID:10612
- C:\Windows\System\IXukiFl.exe
  C:\Windows\System\IXukiFl.exe
  2⤵
  PID:10636
- C:\Windows\System\pLIUpem.exe
  C:\Windows\System\pLIUpem.exe
  2⤵
  PID:10656
- C:\Windows\System\dKoUbcN.exe
  C:\Windows\System\dKoUbcN.exe
  2⤵
  PID:10680
- C:\Windows\System\ylLvWIs.exe
  C:\Windows\System\ylLvWIs.exe
  2⤵
  PID:10704
- C:\Windows\System\GDzDjYd.exe
  C:\Windows\System\GDzDjYd.exe
  2⤵
  PID:10732
- C:\Windows\System\uLNDwmI.exe
  C:\Windows\System\uLNDwmI.exe
  2⤵
  PID:11228
- C:\Windows\System\wTXrKWW.exe
  C:\Windows\System\wTXrKWW.exe
  2⤵
  PID:11244
- C:\Windows\System\VKcaqdA.exe
  C:\Windows\System\VKcaqdA.exe
  2⤵
  PID:9204
- C:\Windows\System\YDdadmg.exe
  C:\Windows\System\YDdadmg.exe
  2⤵
  PID:4880
- C:\Windows\System\AczsTDq.exe
  C:\Windows\System\AczsTDq.exe
  2⤵
  PID:6904
- C:\Windows\System\OgeEaoe.exe
  C:\Windows\System\OgeEaoe.exe
  2⤵
  PID:8004
- C:\Windows\System\iqTocen.exe
  C:\Windows\System\iqTocen.exe
  2⤵
  PID:3740
- C:\Windows\System\lmSWAgd.exe
  C:\Windows\System\lmSWAgd.exe
  2⤵
  PID:3972
- C:\Windows\System\IzjTSJQ.exe
  C:\Windows\System\IzjTSJQ.exe
  2⤵
  PID:6888
- C:\Windows\System\xAuSROA.exe
  C:\Windows\System\xAuSROA.exe
  2⤵
  PID:7008
- C:\Windows\System\FDMVyVJ.exe
  C:\Windows\System\FDMVyVJ.exe
  2⤵
  PID:7148
- C:\Windows\System\YdEFnij.exe
  C:\Windows\System\YdEFnij.exe
  2⤵
  PID:7680
- C:\Windows\System\MPrdXAq.exe
  C:\Windows\System\MPrdXAq.exe
  2⤵
  PID:5836
- C:\Windows\System\rYOOcQs.exe
  C:\Windows\System\rYOOcQs.exe
  2⤵
  PID:8176
- C:\Windows\System\hGdwyyo.exe
  C:\Windows\System\hGdwyyo.exe
  2⤵
  PID:4168
- C:\Windows\System\bDEZqso.exe
  C:\Windows\System\bDEZqso.exe
  2⤵
  PID:6004
- C:\Windows\System\bKIRQHI.exe
  C:\Windows\System\bKIRQHI.exe
  2⤵
  PID:7552
- C:\Windows\System\fWWeudD.exe
  C:\Windows\System\fWWeudD.exe
  2⤵
  PID:7760
- C:\Windows\System\iAWhEbo.exe
  C:\Windows\System\iAWhEbo.exe
  2⤵
  PID:9600
- C:\Windows\System\QKPZhHp.exe
  C:\Windows\System\QKPZhHp.exe
  2⤵
  PID:8552
- C:\Windows\System\zZQnvHs.exe
  C:\Windows\System\zZQnvHs.exe
  2⤵
  PID:6104
- C:\Windows\System\GUXRqmK.exe
  C:\Windows\System\GUXRqmK.exe
  2⤵
  PID:6196
- C:\Windows\System\AJxrwsW.exe
  C:\Windows\System\AJxrwsW.exe
  2⤵
  PID:7236
- C:\Windows\System\ihJwNUt.exe
  C:\Windows\System\ihJwNUt.exe
  2⤵
  PID:10264
- C:\Windows\System\AHTtZBJ.exe
  C:\Windows\System\AHTtZBJ.exe
  2⤵
  PID:7352
- C:\Windows\System\jcHOZOo.exe
  C:\Windows\System\jcHOZOo.exe
  2⤵
  PID:1956
- C:\Windows\System\mkjpFOt.exe
  C:\Windows\System\mkjpFOt.exe
  2⤵
  PID:2812
- C:\Windows\System\qnCzOwK.exe
  C:\Windows\System\qnCzOwK.exe
  2⤵
  PID:11288
- C:\Windows\System\JBdDBdQ.exe
  C:\Windows\System\JBdDBdQ.exe
  2⤵
  PID:11312
- C:\Windows\System\xmPZZjX.exe
  C:\Windows\System\xmPZZjX.exe
  2⤵
  PID:11340
- C:\Windows\System\ZqGaPRj.exe
  C:\Windows\System\ZqGaPRj.exe
  2⤵
  PID:11580
- C:\Windows\System\BLNEqdO.exe
  C:\Windows\System\BLNEqdO.exe
  2⤵
  PID:11604
- C:\Windows\System\DOuIBkn.exe
  C:\Windows\System\DOuIBkn.exe
  2⤵
  PID:11620
- C:\Windows\System\GFIrKpT.exe
  C:\Windows\System\GFIrKpT.exe
  2⤵
  PID:11692
- C:\Windows\System\gorBofp.exe
  C:\Windows\System\gorBofp.exe
  2⤵
  PID:11708
- C:\Windows\System\aYAsSEm.exe
  C:\Windows\System\aYAsSEm.exe
  2⤵
  PID:11728
- C:\Windows\System\xZJvjwD.exe
  C:\Windows\System\xZJvjwD.exe
  2⤵
  PID:11744
- C:\Windows\System\SfFkznk.exe
  C:\Windows\System\SfFkznk.exe
  2⤵
  PID:11760
- C:\Windows\System\fENscTS.exe
  C:\Windows\System\fENscTS.exe
  2⤵
  PID:11776
- C:\Windows\System\QrbNmjs.exe
  C:\Windows\System\QrbNmjs.exe
  2⤵
  PID:11792
- C:\Windows\System\uKyzOMp.exe
  C:\Windows\System\uKyzOMp.exe
  2⤵
  PID:11808
- C:\Windows\System\QbeXSXe.exe
  C:\Windows\System\QbeXSXe.exe
  2⤵
  PID:11824
- C:\Windows\System\saytadt.exe
  C:\Windows\System\saytadt.exe
  2⤵
  PID:11840
- C:\Windows\System\opgPxAJ.exe
  C:\Windows\System\opgPxAJ.exe
  2⤵
  PID:11856
- C:\Windows\System\foKtWxd.exe
  C:\Windows\System\foKtWxd.exe
  2⤵
  PID:11872
- C:\Windows\System\tRpYUXV.exe
  C:\Windows\System\tRpYUXV.exe
  2⤵
  PID:11888
- C:\Windows\System\DgmsebD.exe
  C:\Windows\System\DgmsebD.exe
  2⤵
  PID:11916
- C:\Windows\System\EGzHeIU.exe
  C:\Windows\System\EGzHeIU.exe
  2⤵
  PID:11944
- C:\Windows\System\MxjtioU.exe
  C:\Windows\System\MxjtioU.exe
  2⤵
  PID:11960
- C:\Windows\System\wJSYGsi.exe
  C:\Windows\System\wJSYGsi.exe
  2⤵
  PID:11976
- C:\Windows\System\TckJdua.exe
  C:\Windows\System\TckJdua.exe
  2⤵
  PID:11992
- C:\Windows\System\hnKOdgJ.exe
  C:\Windows\System\hnKOdgJ.exe
  2⤵
  PID:12008
- C:\Windows\System\xATeQej.exe
  C:\Windows\System\xATeQej.exe
  2⤵
  PID:12024
- C:\Windows\System\lqWlKJu.exe
  C:\Windows\System\lqWlKJu.exe
  2⤵
  PID:12040
- C:\Windows\System\tKWYkoW.exe
  C:\Windows\System\tKWYkoW.exe
  2⤵
  PID:12056
- C:\Windows\System\uAKyxbw.exe
  C:\Windows\System\uAKyxbw.exe
  2⤵
  PID:12072
- C:\Windows\System\WcZheSe.exe
  C:\Windows\System\WcZheSe.exe
  2⤵
  PID:12088
- C:\Windows\System\IoFSlai.exe
  C:\Windows\System\IoFSlai.exe
  2⤵
  PID:12104
- C:\Windows\System\RsQinDR.exe
  C:\Windows\System\RsQinDR.exe
  2⤵
  PID:12120
- C:\Windows\System\NfwzDhs.exe
  C:\Windows\System\NfwzDhs.exe
  2⤵
  PID:12136
- C:\Windows\System\uJSSuBv.exe
  C:\Windows\System\uJSSuBv.exe
  2⤵
  PID:12152
- C:\Windows\System\eCqwgMn.exe
  C:\Windows\System\eCqwgMn.exe
  2⤵
  PID:12188
- C:\Windows\System\OSKljvE.exe
  C:\Windows\System\OSKljvE.exe
  2⤵
  PID:12204
- C:\Windows\System\WVsSgEM.exe
  C:\Windows\System\WVsSgEM.exe
  2⤵
  PID:12220
- C:\Windows\System\gofaHoT.exe
  C:\Windows\System\gofaHoT.exe
  2⤵
  PID:12236
- C:\Windows\System\RYpHjRl.exe
  C:\Windows\System\RYpHjRl.exe
  2⤵
  PID:12264
- C:\Windows\System\kHLzNre.exe
  C:\Windows\System\kHLzNre.exe
  2⤵
  PID:12280
- C:\Windows\System\EQRrBOf.exe
  C:\Windows\System\EQRrBOf.exe
  2⤵
  PID:4916
- C:\Windows\System\mLWNpAc.exe
  C:\Windows\System\mLWNpAc.exe
  2⤵
  PID:8336
- C:\Windows\System\dqijKOY.exe
  C:\Windows\System\dqijKOY.exe
  2⤵
  PID:8532
- C:\Windows\System\gYaGrKA.exe
  C:\Windows\System\gYaGrKA.exe
  2⤵
  PID:10180
- C:\Windows\System\ISLzaeN.exe
  C:\Windows\System\ISLzaeN.exe
  2⤵
  PID:10208
- C:\Windows\System\UsBDTCm.exe
  C:\Windows\System\UsBDTCm.exe
  2⤵
  PID:8896
- C:\Windows\System\oVwZicx.exe
  C:\Windows\System\oVwZicx.exe
  2⤵
  PID:8804
- C:\Windows\System\kdqUike.exe
  C:\Windows\System\kdqUike.exe
  2⤵
  PID:8752
- C:\Windows\System\OoSZOHi.exe
  C:\Windows\System\OoSZOHi.exe
  2⤵
  PID:8204
- C:\Windows\System\SJzSVtf.exe
  C:\Windows\System\SJzSVtf.exe
  2⤵
  PID:7844
- C:\Windows\System\fAuusrs.exe
  C:\Windows\System\fAuusrs.exe
  2⤵
  PID:7620
- C:\Windows\System\cCefevK.exe
  C:\Windows\System\cCefevK.exe
  2⤵
  PID:9016
- C:\Windows\System\BqOobwk.exe
  C:\Windows\System\BqOobwk.exe
  2⤵
  PID:10308
- C:\Windows\System\lWFSIGb.exe
  C:\Windows\System\lWFSIGb.exe
  2⤵
  PID:10344
- C:\Windows\System\ZeAniBE.exe
  C:\Windows\System\ZeAniBE.exe
  2⤵
  PID:10372
- C:\Windows\System\XiWJWVA.exe
  C:\Windows\System\XiWJWVA.exe
  2⤵
  PID:10416
- C:\Windows\System\UsOuRog.exe
  C:\Windows\System\UsOuRog.exe
  2⤵
  PID:10448
- C:\Windows\System\cimtoqQ.exe
  C:\Windows\System\cimtoqQ.exe
  2⤵
  PID:2364
- C:\Windows\System\ZkadaoX.exe
  C:\Windows\System\ZkadaoX.exe
  2⤵
  PID:10508
- C:\Windows\System\mYTwBfX.exe
  C:\Windows\System\mYTwBfX.exe
  2⤵
  PID:10540
- C:\Windows\System\kWREMZt.exe
  C:\Windows\System\kWREMZt.exe
  2⤵
  PID:10580
- C:\Windows\System\DiMZKia.exe
  C:\Windows\System\DiMZKia.exe
  2⤵
  PID:10608
- C:\Windows\System\plrTmKw.exe
  C:\Windows\System\plrTmKw.exe
  2⤵
  PID:10632
- C:\Windows\System\QgRMpxp.exe
  C:\Windows\System\QgRMpxp.exe
  2⤵
  PID:10668
- C:\Windows\System\GDBSXkr.exe
  C:\Windows\System\GDBSXkr.exe
  2⤵
  PID:10764
- C:\Windows\System\panZpMP.exe
  C:\Windows\System\panZpMP.exe
  2⤵
  PID:10804
- C:\Windows\System\hljxqwL.exe
  C:\Windows\System\hljxqwL.exe
  2⤵
  PID:11936
- C:\Windows\System\QwYQmaa.exe
  C:\Windows\System\QwYQmaa.exe
  2⤵
  PID:12000
- C:\Windows\System\yNRxDvk.exe
  C:\Windows\System\yNRxDvk.exe
  2⤵
  PID:12032
- C:\Windows\System\svYHcyF.exe
  C:\Windows\System\svYHcyF.exe
  2⤵
  PID:12100
- C:\Windows\System\BReWnzj.exe
  C:\Windows\System\BReWnzj.exe
  2⤵
  PID:10848
- C:\Windows\System\VBDWriN.exe
  C:\Windows\System\VBDWriN.exe
  2⤵
  PID:10864
- C:\Windows\System\rafHkaF.exe
  C:\Windows\System\rafHkaF.exe
  2⤵
  PID:12216
- C:\Windows\System\rUahezQ.exe
  C:\Windows\System\rUahezQ.exe
  2⤵
  PID:12272
- C:\Windows\System\TCtKEES.exe
  C:\Windows\System\TCtKEES.exe
  2⤵
  PID:12300
- C:\Windows\System\boRhibV.exe
  C:\Windows\System\boRhibV.exe
  2⤵
  PID:12324
- C:\Windows\System\ZGYRjdq.exe
  C:\Windows\System\ZGYRjdq.exe
  2⤵
  PID:12348
- C:\Windows\System\CYghYEc.exe
  C:\Windows\System\CYghYEc.exe
  2⤵
  PID:12364
- C:\Windows\System\zGyLYWP.exe
  C:\Windows\System\zGyLYWP.exe
  2⤵
  PID:12384
- C:\Windows\System\IqsWYGW.exe
  C:\Windows\System\IqsWYGW.exe
  2⤵
  PID:12404
- C:\Windows\System\EQybTSi.exe
  C:\Windows\System\EQybTSi.exe
  2⤵
  PID:12432
- C:\Windows\System\vurpfiP.exe
  C:\Windows\System\vurpfiP.exe
  2⤵
  PID:12448
- C:\Windows\System\gFCDIrr.exe
  C:\Windows\System\gFCDIrr.exe
  2⤵
  PID:12472
- C:\Windows\System\BcmcrBV.exe
  C:\Windows\System\BcmcrBV.exe
  2⤵
  PID:12500
- C:\Windows\System\GOLzlmX.exe
  C:\Windows\System\GOLzlmX.exe
  2⤵
  PID:12516
- C:\Windows\System\FVtyGES.exe
  C:\Windows\System\FVtyGES.exe
  2⤵
  PID:12536
- C:\Windows\System\pjBAtfc.exe
  C:\Windows\System\pjBAtfc.exe
  2⤵
  PID:12568
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12568 -s 28
    3⤵
    PID:13264
- C:\Windows\System\SuqZjIt.exe
  C:\Windows\System\SuqZjIt.exe
  2⤵
  PID:12588
- C:\Windows\System\tbcVrPw.exe
  C:\Windows\System\tbcVrPw.exe
  2⤵
  PID:12612
- C:\Windows\System\BSbeamr.exe
  C:\Windows\System\BSbeamr.exe
  2⤵
  PID:12636
- C:\Windows\System\hABGDJw.exe
  C:\Windows\System\hABGDJw.exe
  2⤵
  PID:12656
- C:\Windows\System\kXJrjaw.exe
  C:\Windows\System\kXJrjaw.exe
  2⤵
  PID:12704
- C:\Windows\System\KPOxiMR.exe
  C:\Windows\System\KPOxiMR.exe
  2⤵
  PID:12748
- C:\Windows\System\KcRTUqo.exe
  C:\Windows\System\KcRTUqo.exe
  2⤵
  PID:12764
- C:\Windows\System\uGbHaMe.exe
  C:\Windows\System\uGbHaMe.exe
  2⤵
  PID:12780
- C:\Windows\System\kaRYQxC.exe
  C:\Windows\System\kaRYQxC.exe
  2⤵
  PID:12796
- C:\Windows\System\IbMuVaD.exe
  C:\Windows\System\IbMuVaD.exe
  2⤵
  PID:12836
- C:\Windows\System\ctQrNPL.exe
  C:\Windows\System\ctQrNPL.exe
  2⤵
  PID:12884
- C:\Windows\System\eBkFpGp.exe
  C:\Windows\System\eBkFpGp.exe
  2⤵
  PID:12912
- C:\Windows\System\lwWIaWW.exe
  C:\Windows\System\lwWIaWW.exe
  2⤵
  PID:12928
- C:\Windows\System\XzvYNTi.exe
  C:\Windows\System\XzvYNTi.exe
  2⤵
  PID:12952
- C:\Windows\System\ktGaujH.exe
  C:\Windows\System\ktGaujH.exe
  2⤵
  PID:12972
- C:\Windows\System\yjzhHSy.exe
  C:\Windows\System\yjzhHSy.exe
  2⤵
  PID:12988
- C:\Windows\System\RYpSQVk.exe
  C:\Windows\System\RYpSQVk.exe
  2⤵
  PID:10784
- C:\Windows\System\qoksKMd.exe
  C:\Windows\System\qoksKMd.exe
  2⤵
  PID:12068
- C:\Windows\System\mNVdOiL.exe
  C:\Windows\System\mNVdOiL.exe
  2⤵
  PID:10844
- C:\Windows\System\OCqIMhi.exe
  C:\Windows\System\OCqIMhi.exe
  2⤵
  PID:12212
- C:\Windows\System\igaFpjM.exe
  C:\Windows\System\igaFpjM.exe
  2⤵
  PID:7836
- C:\Windows\System\zYhlaaE.exe
  C:\Windows\System\zYhlaaE.exe
  2⤵
  PID:12400
- C:\Windows\System\zFkErAL.exe
  C:\Windows\System\zFkErAL.exe
  2⤵
  PID:13204
- C:\Windows\System\hUpKtTQ.exe
  C:\Windows\System\hUpKtTQ.exe
  2⤵
  PID:11172
- C:\Windows\System\STnMgGO.exe
  C:\Windows\System\STnMgGO.exe
  2⤵
  PID:11880
- C:\Windows\System\hzBFnxJ.exe
  C:\Windows\System\hzBFnxJ.exe
  2⤵
  PID:10200
- C:\Windows\System\rppdRhn.exe
  C:\Windows\System\rppdRhn.exe
  2⤵
  PID:11220
- C:\Windows\System\bwRIABo.exe
  C:\Windows\System\bwRIABo.exe
  2⤵
  PID:1648
- C:\Windows\System\shSnzVH.exe
  C:\Windows\System\shSnzVH.exe
  2⤵
  PID:11568
- C:\Windows\System\jZTZKCd.exe
  C:\Windows\System\jZTZKCd.exe
  2⤵
  PID:4080
- C:\Windows\System\eXvPrnU.exe
  C:\Windows\System\eXvPrnU.exe
  2⤵
  PID:660
- C:\Windows\System\mOcRwKh.exe
  C:\Windows\System\mOcRwKh.exe
  2⤵
  PID:10860
- C:\Windows\System\xyyIIku.exe
  C:\Windows\System\xyyIIku.exe
  2⤵
  PID:9328
- C:\Windows\System\ysrAMqS.exe
  C:\Windows\System\ysrAMqS.exe
  2⤵
  PID:8764
- C:\Windows\System\YhibcmU.exe
  C:\Windows\System\YhibcmU.exe
  2⤵
  PID:7636
- C:\Windows\System\OdCnHMv.exe
  C:\Windows\System\OdCnHMv.exe
  2⤵
  PID:10400
- C:\Windows\System\GHOoQyn.exe
  C:\Windows\System\GHOoQyn.exe
  2⤵
  PID:3628
- C:\Windows\System\oJkWswy.exe
  C:\Windows\System\oJkWswy.exe
  2⤵
  PID:6672
- C:\Windows\System\dNBtdeW.exe
  C:\Windows\System\dNBtdeW.exe
  2⤵
  PID:6960
- C:\Windows\System\CBOwfgB.exe
  C:\Windows\System\CBOwfgB.exe
  2⤵
  PID:664
- C:\Windows\System\eyLdNPo.exe
  C:\Windows\System\eyLdNPo.exe
  2⤵
  PID:12252
- C:\Windows\System\QTmhlnJ.exe
  C:\Windows\System\QTmhlnJ.exe
  2⤵
  PID:13124
- C:\Windows\System\UffaXyY.exe
  C:\Windows\System\UffaXyY.exe
  2⤵
  PID:11012
- C:\Windows\System\xErXeWs.exe
  C:\Windows\System\xErXeWs.exe
  2⤵
  PID:11756
- C:\Windows\System\lTTnoFm.exe
  C:\Windows\System\lTTnoFm.exe
  2⤵
  PID:11912
- C:\Windows\System\isOfFqv.exe
  C:\Windows\System\isOfFqv.exe
  2⤵
  PID:11884
- C:\Windows\System\BdUfCpc.exe
  C:\Windows\System\BdUfCpc.exe
  2⤵
  PID:2972
- C:\Windows\System\ReppFdy.exe
  C:\Windows\System\ReppFdy.exe
  2⤵
  PID:3660
- C:\Windows\System\BBazDUe.exe
  C:\Windows\System\BBazDUe.exe
  2⤵
  PID:11152
- C:\Windows\System\lBKRbTh.exe
  C:\Windows\System\lBKRbTh.exe
  2⤵
  PID:10080
- C:\Windows\System\aNpuLyY.exe
  C:\Windows\System\aNpuLyY.exe
  2⤵
  PID:13160
- C:\Windows\System\CtrtWGN.exe
  C:\Windows\System\CtrtWGN.exe
  2⤵
  PID:12372
- C:\Windows\System\AlABkJU.exe
  C:\Windows\System\AlABkJU.exe
  2⤵
  PID:12604
- C:\Windows\System\LHsSYKV.exe
  C:\Windows\System\LHsSYKV.exe
  2⤵
  PID:13240
- C:\Windows\System\rOCshRE.exe
  C:\Windows\System\rOCshRE.exe
  2⤵
  PID:10912
- C:\Windows\System\KLzRbRq.exe
  C:\Windows\System\KLzRbRq.exe
  2⤵
  PID:13236
- C:\Windows\System\nXRbOMS.exe
  C:\Windows\System\nXRbOMS.exe
  2⤵
  PID:6584
- C:\Windows\System\LbOBuON.exe
  C:\Windows\System\LbOBuON.exe
  2⤵
  PID:4956
- C:\Windows\System\GOetCGK.exe
  C:\Windows\System\GOetCGK.exe
  2⤵
  PID:5212
- C:\Windows\System\usTVcQo.exe
  C:\Windows\System\usTVcQo.exe
  2⤵
  PID:12376
- C:\Windows\System\LRlxnkW.exe
  C:\Windows\System\LRlxnkW.exe
  2⤵
  PID:5980
- C:\Windows\System\NhAVkDM.exe
  C:\Windows\System\NhAVkDM.exe
  2⤵
  PID:13216
- C:\Windows\System\gwPHFov.exe
  C:\Windows\System\gwPHFov.exe
  2⤵
  PID:1564
- C:\Windows\System\MPKDIum.exe
  C:\Windows\System\MPKDIum.exe
  2⤵
  PID:1304
- C:\Windows\System\IubCZSR.exe
  C:\Windows\System\IubCZSR.exe
  2⤵
  PID:10324
- C:\Windows\System\WQtnOdD.exe
  C:\Windows\System\WQtnOdD.exe
  2⤵
  PID:11132
- C:\Windows\System\KlMXfXD.exe
  C:\Windows\System\KlMXfXD.exe
  2⤵
  PID:11704
- C:\Windows\System\dnZbAwZ.exe
  C:\Windows\System\dnZbAwZ.exe
  2⤵
  PID:5416
- C:\Windows\System\fRTNcfV.exe
  C:\Windows\System\fRTNcfV.exe
  2⤵
  PID:11140
- C:\Windows\System\RdJKAbE.exe
  C:\Windows\System\RdJKAbE.exe
  2⤵
  PID:12620
- C:\Windows\System\FZCmlaX.exe
  C:\Windows\System\FZCmlaX.exe
  2⤵
  PID:13188
- C:\Windows\System\zxbLLiq.exe
  C:\Windows\System\zxbLLiq.exe
  2⤵
  PID:12924
- C:\Windows\System\seOrUQW.exe
  C:\Windows\System\seOrUQW.exe
  2⤵
  PID:10368
- C:\Windows\System\AVTZDlW.exe
  C:\Windows\System\AVTZDlW.exe
  2⤵
  PID:13264
- C:\Windows\System\KwMHDuN.exe
  C:\Windows\System\KwMHDuN.exe
  2⤵
  PID:11420
- C:\Windows\System\cSIvmLn.exe
  C:\Windows\System\cSIvmLn.exe
  2⤵
  PID:9188
- C:\Windows\System\omGuXRC.exe
  C:\Windows\System\omGuXRC.exe
  2⤵
  PID:13252
- C:\Windows\System\XosMOfA.exe
  C:\Windows\System\XosMOfA.exe
  2⤵
  PID:11724
- C:\Windows\System\aJLwabw.exe
  C:\Windows\System\aJLwabw.exe
  2⤵
  PID:8756
- C:\Windows\System\zxEfbGA.exe
  C:\Windows\System\zxEfbGA.exe
  2⤵
  PID:6608
- C:\Windows\System\qvpygvk.exe
  C:\Windows\System\qvpygvk.exe
  2⤵
  PID:12320
- C:\Windows\System\iWlOfOt.exe
  C:\Windows\System\iWlOfOt.exe
  2⤵
  PID:9224
- C:\Windows\System\EbCfoOv.exe
  C:\Windows\System\EbCfoOv.exe
  2⤵
  PID:4836
- C:\Windows\System\bQxvpUs.exe
  C:\Windows\System\bQxvpUs.exe
  2⤵
  PID:6060
- C:\Windows\System\EtPXzfS.exe
  C:\Windows\System\EtPXzfS.exe
  2⤵
  PID:13328
- C:\Windows\System\OOJPSeq.exe
  C:\Windows\System\OOJPSeq.exe
  2⤵
  PID:13344
- C:\Windows\System\nBhYMqQ.exe
  C:\Windows\System\nBhYMqQ.exe
  2⤵
  PID:13360
- C:\Windows\System\UTIyREB.exe
  C:\Windows\System\UTIyREB.exe
  2⤵
  PID:13376
- C:\Windows\System\NPENHxW.exe
  C:\Windows\System\NPENHxW.exe
  2⤵
  PID:13392
- C:\Windows\System\tIVnGyr.exe
  C:\Windows\System\tIVnGyr.exe
  2⤵
  PID:13408
- C:\Windows\System\dQvyIfL.exe
  C:\Windows\System\dQvyIfL.exe
  2⤵
  PID:13968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:5416

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 12884 -ip 12884
1⤵
PID:13216

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 732 -p 10020 -ip 10020
1⤵
PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_csrvrqcd.k5i.psm1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AXqbcmR.exe

Filesize
1.5MB

MD5
462a436cda7d0596fe3517d14e9e85ea

SHA1
d2e8614f1c91bfea4e25d0bca132bf9e0854a844

SHA256
dc1b9b9002a97f3196daf952ccb6d299d8438a7b4f6aeb5e6de83141e5073021

SHA512
5a6a38a8df3b8518f7b6a395f8b9be1ddc2088edf3aee67aed5cb46ab153ce80e8927b057023a05d61372b2b4065deb2981de27853c911b2e4fe499730e755af

Download Submit
C:\Windows\System\EmpQIRW.exe

Filesize
1.5MB

MD5
1bb8ef479543bc0add56742f9f6f38ed

SHA1
d8edc2999ce9eb0b273ee5c9d210b14af58625f1

SHA256
69ea8839dbf7ecea4a98311d5eb5b43aa1b97df2efccf00113c938ff7c306d11

SHA512
3554b1685b518d852ae1293e8c0946d0da9093f466d4525249e968daf1fa7368e60aed9bb68767b14eec737c037900dd35b9431c2438b496ef31edf65e034d42

Download Submit
C:\Windows\System\FLtmpIr.exe

Filesize
1.5MB

MD5
c255392e42556f6d081f905569d1d0ca

SHA1
13f46350b0b2f620a3fd4b8ed6660777ea32d08e

SHA256
5e06753ae85809d4dc10904d4a6a252ef4739c327fbc2d5a854f4664327c10f2

SHA512
975c7e310bb75f46bbdd7d566579dd90970d7ff17b75e3f4f8d620b688e8951d9d8762946ba1fff4808564f4eebe434d65ded06f2a3ee2deae826a66f9f91bf0

Download Submit
C:\Windows\System\GEWIoQM.exe

Filesize
1.5MB

MD5
8c4e784c90dac8c4021a5380e01b6d8f

SHA1
11d7fab1507571a784474d90e67293fcab6d8ece

SHA256
cc2c4db84965c7eefde11939b79017d43afff884fda6b3873217cd0ef79015b1

SHA512
bcaa4de8b907765a0764e8c33f3a42615d67423db96b867cbc9e6d1eb0d486a13273a06eed86c5b4c78ac7d0a753bbb3682e9f91996d28ae82ff0a7e9a293740

Download Submit
C:\Windows\System\GMuZucQ.exe

Filesize
1.5MB

MD5
7ce8d67f986d7ee6b62753fad4976817

SHA1
9353527444eb4ab2f951bc3021b2b568f93beed2

SHA256
498c714b6d1c38f2657f0f73e1be4b64a7e40cf1a5e2daa89fd842c58ad18b57

SHA512
54d1ea38ce7f087c9dbfbdbb31018e69ebb0925a0bcd093dd0e2454d8297e747fd24291d9844a66d2c18073294bfd1b4313f766d117e473e67bae6e7606cfc24

Download Submit
C:\Windows\System\GycvaxD.exe

Filesize
1.5MB

MD5
665cc9649c514e0d90bc05d2e8f4691f

SHA1
eedae895ebc8356627c528a53fc828c772ec3fac

SHA256
eab930fc0f246709719d84a121ac576f9b09e458ae94fbdff845e131c3ce6891

SHA512
abde757d6fe2affaca3b31a5183f36234691c80a1bc340374752a49aa04063a1f81de66fdc0d06282d94ffb93dd7a7809e3b13f693e326dc6c74878c9e601d03

Download Submit
C:\Windows\System\HXPDZyb.exe

Filesize
1.5MB

MD5
fabe64f3de2f7cbb48deae98b3feae2d

SHA1
3752bc322b822934ebbe35fe91092262964ae722

SHA256
523ec29e38ddd0619715d54d649f3048f5cc58d5f39e04a0ae85fb563445779e

SHA512
eebf7b95a00a6772436c4ad6a866fe90577c28efbec485337bd2be9b79740721fcc5cd713230f6e190732ffcc0a3e250a32ecef3e6f8310d17d842702b19e9c0

Download Submit
C:\Windows\System\InIkEPY.exe

Filesize
1.5MB

MD5
f5c749a9ed81a38cee1fb4ec39b9b3e9

SHA1
628b9fce150a49671f8361a9a61d8cb235be1058

SHA256
11ce0f828812414732ad0e40543d169ed4a4939eadc06afc64732996dbac47e4

SHA512
c5740fbcda180f856b0a14c0f64c5f72a90fd3430477b057c74b90f86a8edb41189428d1ef3a9011f9041556da728d373eb67cfa6caa40e3b57d5628ac033771

Download Submit
C:\Windows\System\JrgRtIO.exe

Filesize
1.5MB

MD5
39f7d1cec5c21f9f170891034b3b589c

SHA1
169d1768c75c3bf53cfe2b8600a28a18f821d2d1

SHA256
2e34556f36e8646168b2c6eac27dc3f444050418d038fcf327c106328564db73

SHA512
be81dc055f9f740e4a8a398d5495906bbadc16bc8a6dbae813ded23a3e79011c1e68e5755fb11989028c8ef6032c6af39d46daa32b1baa13da4baf98ac81ecce

Download Submit
C:\Windows\System\OOdBstZ.exe

Filesize
1.5MB

MD5
f8da1b9b5910e6bfa1c755bc59107a7c

SHA1
b10653a9b5fe0e0bd37d34ddf7153487bb060148

SHA256
ed3b0c210cde2588aeffc6d4411d981e3c1129edfc30c57c832f8883e2c8ac82

SHA512
7d0b430f14f004f22bb5187ccb34d052c568b74048fd565de97873e0385ec41710c60fe7b011f2a394f1f7a9914861b18bd4a1722b27db7c642110c1fc842e34

Download Submit
C:\Windows\System\OhZoSuf.exe

Filesize
1.5MB

MD5
5df85502e7fa38b136cbbccdbab2c604

SHA1
50f47e6aebf2b5d9a9c68df88304cf29436d47e4

SHA256
574c660bc003b2ba0b99fc638ea26530540291aa66177dacb6f140393bbd9c89

SHA512
5e01fb17ad7f43f3fec95350e14fab53447895ba8ce9365bb91e2f3107ab0e2b12bba2b04144e27ad6211dfb8672ff0c1ad0d4a2ae33815191e3389d04088f39

Download Submit
C:\Windows\System\OmIufHj.exe

Filesize
1.5MB

MD5
fea6d13195991452b9f3b2a98a546e46

SHA1
8f4767727df43797c883dc60d20391dea2aa5cd4

SHA256
0260c3dda738c333d7ad5ce8ac7f986e3a45b25f9e3c31b555f232f028476157

SHA512
bdfa25304c852c8abc658747745c99d6e5f4bee1ce1ef3a4589741d3f659e020fb8540930dfb5d307a029de191cd2fcd3c7243560f68b9231be44f111ea445e8

Download Submit
C:\Windows\System\QettxVS.exe

Filesize
1.5MB

MD5
0d32409603c4a8c417b84e93558ee5c4

SHA1
960549f298f314f7951b1101cede5f6b9edbbb0e

SHA256
a4534f7263b2e3b6fdf24845ba26523c869287e36a4c2291e1c2744c40a4fcaa

SHA512
98f355e4cc6f16ec737c8c41c403a9a8cc20480d77863bfe48ee659fd7bc6975f382280c6e817a8fa4aa4f935e0e946a1bfe79230f9d604782a05d851f438c79

Download Submit
C:\Windows\System\Rditptp.exe

Filesize
1.5MB

MD5
270097011d61bf1e2dc5d86c686bc81a

SHA1
5d197186de217c64fe4bb3e8cf83bef10c7adde2

SHA256
2619286b126e19dc3f9c49fcc438f7c97b11346d790032832a1f8a1587498181

SHA512
7ad17223cc63449faed0f76c77acb2e86bf5548c0e8c0d27b80712bcde4c558b154498fe6dd4bacbe782a65e4c542a2dbc05935adbd8336b5b11cc18079e058a

Download Submit
C:\Windows\System\StXodID.exe

Filesize
1.5MB

MD5
35c3369673d47335f95213640e87867c

SHA1
f24467e7ad070a0041dd7095402a162f0d847175

SHA256
eb0291a0778c06d46f0d9f95ec938053c60b6456552c2f5f9a7cb64bef97a4fd

SHA512
f6f1984ec1ad9f91584e7942c4b98bb7bc29f7ea4f5ac786e3a963742f173795fd114d9a92f997f1756317793a92a3fc816601dd9256ce4722a9f22f75e5a65b

Download Submit
C:\Windows\System\ToljvZs.exe

Filesize
1.5MB

MD5
d4818b2f123e365ab9de26b4ea33a2e1

SHA1
5264f0e3d7a348cf42c7572ba283dd2f2fa7b4b1

SHA256
61b6f1715f7e0955ad8cefa9b3cb2d687662c16103130c6cc09e8c1bc3380318

SHA512
6385df4855f096847248424d2d79a6958938aa3b4c03eadd9a761269af26117a6200920371f08d4e2373d2f14f985af3d89ff93b62051f9c4592dde99de5b352

Download Submit
C:\Windows\System\YzHfyYO.exe

Filesize
1.5MB

MD5
bada1f7808532dd73cc22e445744a37a

SHA1
1af6b12fcf345c4e7fb11b47e4a25e5715a1e48e

SHA256
0f849bc50fd6e82e1b41800073fc89b37cf18aded762a1ace0c7c57e9b2e004a

SHA512
c463799b8471315b90cf8f0a2cdd0e26751b60786daeb57da01584fb84e4fbd0e780af35154704513dca67f42f3012125844299a74ad4ad36424c35737e5bf56

Download Submit
C:\Windows\System\bsYrDZd.exe

Filesize
1.5MB

MD5
12dae81e7f2218828869db7a4ab42c97

SHA1
a711bfcc42158b2f801ba8ef4adb2a57763174fe

SHA256
c0b562bab717a531b844553aca7d7e389fb9f4a54d9c1a00ee56780f6f279868

SHA512
d15cbb64c8d183be2498fac6ecc14e4e01986d4781d13643f60de12ae5650bed69b33e9829edfcaa6fe31fd45e60d8b6f565605b0d6541c741317c4f7b0497eb

Download Submit
C:\Windows\System\cJkaJhv.exe

Filesize
1.5MB

MD5
5eb9515dc19994b4415321561b1434f3

SHA1
706c90905b780d7f0a548ee26d5bbaa32df468f6

SHA256
78cdfd3097c17b6e658c3f59367b867269324977e95007116c75518fd96791ef

SHA512
2947a852cfba199cf06d8b84010e2b6c27e0b548bc38ce8a7b5664f3acff5a45661c9a998ed0304b70b50dcb2e244e2e9f4209d9be0a6a7c5c6fda2180b542b3

Download Submit
C:\Windows\System\dIIoSFH.exe

Filesize
1.5MB

MD5
1092bdb5aa93cc804cc73ae445f7c953

SHA1
e64da49d97981f23d5ea18ee5c398c8fea88a937

SHA256
91b3c1907c41157ee4cb679bc6bc24dcf5fb495e9a50f60e2d6c43e56cd4ea0c

SHA512
afe96a824e7ca07de79376dfdb5845c7f01e8a40fa0efd1d2eaf71cfd02f39f7613c22478266fa6c85699714e48238447f371e83bdce7c1bbe55dc13cb897825

Download Submit
C:\Windows\System\dLZUCyU.exe

Filesize
1.5MB

MD5
35d87af85e87d99dcf31e0f1eaf78f71

SHA1
cf71e960ca2d8b1a895e1e81c7d4d516003aac66

SHA256
b6353173929e4b880cdede7495137274fba5cb9f79950266834e90012f551e16

SHA512
98ee00c9e1361e38f77cc6c70d7e01e50c77173e307f7fd43585afdc6fb3d9882f7b8930ec0ebc6ecf22425fc499216eb7a4f1c3a4339b1d6c91d1ff8f6ed2f4

Download Submit
C:\Windows\System\duhevLF.exe

Filesize
1.5MB

MD5
79c69f27b9315df6f282bef7ee558522

SHA1
6b8901315b5f75f24a3562f63f49aba704064c8b

SHA256
ec963345dd265111f94f3c1e581950d436e6a974982a728ce7747f465a06cf1f

SHA512
5ff062823ab882d02d82d3043969a32d55a8620c113d3e4713be6845d9e56ee36bd41d7ee0528df5c5817de880d25074dd77c2391f3e261ba5faf9e1d50b081a

Download Submit
C:\Windows\System\eLVkJLE.exe

Filesize
1.5MB

MD5
b4eefb635c84fb5adacde49892c58743

SHA1
1e3bf0fc910ee464016ef20d695cd1610faffbee

SHA256
f2541944c6a7335ade501e973b19e52f19936bb3c18121b6b26eb7cc20af61f7

SHA512
1f71c0fe79df017c36940091c7065d8c46c9de9ce33c198a8f30abc222f5e82a8b432c29738d3695927df180a8aaee61276b4b4c724c6958271f5415cde6bc93

Download Submit
C:\Windows\System\hThuqDO.exe

Filesize
1.5MB

MD5
7e039e1cd202b1332c10a7fe6b992ed1

SHA1
fc6359c7a393f7aadd4c3b4db099248a9f7cb98f

SHA256
a696209281d41c0c2d4725e7bd4b9a3f75b2105bd6466ee1cc59a4f14a6f5b39

SHA512
c0f51c283707a966c30a6830417675a8679959c09bc9eb2f7275f4bcdbadf563ccfb96a50b3b8db8acb9d26cbc1438525d727b467ebcfc6166200bab13da44cd

Download Submit
C:\Windows\System\hzGQxTR.exe

Filesize
1.5MB

MD5
d47033ff49fa8d8ef6b7d073a38219ee

SHA1
b8a79a8f5c632fc883d3f2e36ff32409ac52f8eb

SHA256
85afd7db75edce1ebea1e45898ab9a9351747b3fe1aa8cdbeac0cf889332fd52

SHA512
66d54081274a2b0c11a7d1c22ed663789caa166b6c97a006d0459ef895bbbcaadc65a54fde6de4c3d90da775e651753b20e611d266662f4018f08f83bd65fdfa

Download Submit
C:\Windows\System\jICpCia.exe

Filesize
1.5MB

MD5
25a93db9774b9c99fb83693816e60864

SHA1
fa258c7b79c2cf1337ba35c85b0d8b447a96821b

SHA256
1f63e2bae7d769c8daaa61a7fe675970e5fbe36ad093310601b3193c9b027c24

SHA512
221ec60710e2e798732f5113443420213c2f337b363dbbff04ca1a86c87de5211696d9a4aa9fd05e284497353584372338e5e5723d69c6c323899771c1ed4e5d

Download Submit
C:\Windows\System\jQIMKtC.exe

Filesize
8B

MD5
6c6a33c852f4e05ffd14cdf0dcab7779

SHA1
70449821f99925d7b8d245181569b7ac4d2ffae8

SHA256
889f3baefc9f46c7632a467db8882ec92f1f0df14da91d5a211e7484de261e45

SHA512
92e5654661ef50c470f84dbec4dcad9efdca5e4026c073f08c798af48c0b5d8107a7b2ff4d63fdb982f371e15d79e95f8a6d716a30b5c5123a7273c49d650d19

Download Submit
C:\Windows\System\jTmrtvE.exe

Filesize
1.5MB

MD5
3e51e27e5102ca3177a06b9009fd825d

SHA1
3ec013f63630bff7b3da771790edc628639a9381

SHA256
f8f76c3a1e26893c099873d5cd31a1f2eef10a40e41cb117bfeff18515929819

SHA512
31270d29174d9feea07c5400a2dcc32eff92a30a528956e5eeb689863625f2ef65c29ac4301fb255ca466d82fda87d4e031ad53f79ebd889f19656a0264f4ce4

Download Submit
C:\Windows\System\lFXXSdg.exe

Filesize
1.5MB

MD5
67f3a61ad7e01e4272fad0ee5a651ac2

SHA1
8816bd6fd26264bf26a6a76819e65f5242eb28ad

SHA256
0e109bd35f97db59c44d1687f8ee6f304cb8dd722541bca1cce894e104f235b0

SHA512
f0ecae1baa45c3e267d37abcf91096c91d3a60a90df3707023b19b807cc0971a746c3ec27fe9659c255c7a057fa7fe1420ec05e3a60deec81d285884dcae1e29

Download Submit
C:\Windows\System\lcrFoHD.exe

Filesize
1.5MB

MD5
4a14b468d7805dfd01da2410343ec2ac

SHA1
599c008ab36e0f1265d0eceacfe4a26a2372a726

SHA256
f88a84dbf00b81b1b23d3e3f89071c7af34dd12fe8d18e4b462f1635a5eadcdd

SHA512
8f0ce381e4b884dfdac410606575bf8533b3cce41c958fcb27791e5e2b4f609fcc5c619c7b71f4ca904e268151951a34bdb4f9ccdd403c009745c5de0e0c075a

Download Submit
C:\Windows\System\lmCpHOR.exe

Filesize
1.5MB

MD5
8a29a37e8e01989073361f26011fdd7d

SHA1
68e60fa0913b2b87f25fd4a986cb42b48ceba41e

SHA256
1e0548e9853faad1cec22ac4c40c4f7041fb69a2274a78aaa2659ba034cdcaab

SHA512
13be50e4ffd4c318695b526440ab47689d4e94b043f8f2ec2806ac68591357f0180fdabbf18398d829cd1a17d1afb4b2632cd58adddc2c1c4885f697fa97bebc

Download Submit
C:\Windows\System\nXhnecy.exe

Filesize
1.5MB

MD5
2142c48b7e225be5ae31c47f89329b7d

SHA1
16bee5e725e9b3264e3884459ba0a6a985913f4e

SHA256
b7d80fa26c5ef8a3aac515e187fbb8a52b047f73cc91709bbfbba24679d4a885

SHA512
62bdeb3e522fe7b63e815696adb8fd5bc22f00a5be4aa4bb5b98fb61b96bdda932fc9c7803a75b0ab73ea85689006ff825c8007fc83511874a0a9e10a3292d52

Download Submit
C:\Windows\System\pLdMFxv.exe

Filesize
1.5MB

MD5
7b43f2f6e7b2fc85856cdca1964fb3a4

SHA1
bae7445361e2d22c305b13a0696bc37cbf1a0d42

SHA256
cd4f68d69a81ef540308b89f204f13b895b751744765af66e25b414f463fd430

SHA512
9a49daf9b7db87a2266c08f00336b02e094427e9889f0645a8d5cdc4532dbe13617bbf6c342fa506c8f63fd18cf0ea97d3a8d915cece745bde8c582d5734779a

Download Submit
C:\Windows\System\pbzlBfb.exe

Filesize
1.5MB

MD5
237a6cdee2cafbc2969676f08325dc55

SHA1
f4b5069dbee39fb8b1806d681c3bd81a5d3246cc

SHA256
5ead7474ecefcf0e70ec418bd2857a3f313eb8b99748be3e0043a4dc8e2b74e2

SHA512
3b1e326f87be19e75843cb247af6bcdea51f3aefb05ed692e30c0a2635baed8af85ab7404987629014c30faed4f76b34d2b4a3ae27e510ede951eb329a06ed73

Download Submit
C:\Windows\System\pnHmNTv.exe

Filesize
1.5MB

MD5
1dcd52a8f01391fc2bd7a1ac89f00858

SHA1
e77868f3e8b97f56184111bdb4849055ef676a47

SHA256
ef25c0eae15941f7e70fd3ffd73cb0d300bb78da163c4ffc9786e3a0d764825d

SHA512
f75eee53b9c650e8b28e929a6628f27908b54e8d4abcfe0117fe9f2e6ed631bbf15e8f213a00797176319be9da5ec79cfc8ce02188009b9851cf0bd8023099a5

Download Submit
C:\Windows\System\qDkaeUb.exe

Filesize
1.5MB

MD5
0a484f88db5ece4acdebaec6e5bca1a5

SHA1
36642a0a2866cd38b68240add26a0f1fe4833123

SHA256
4f889388a0d5995d7294b75a4e1c6fe098174a16119dc90596a6ec84c860156b

SHA512
93b783674306a6e58954c16a89fec41d667559d4fcaf6c23908283fc3d4fbeb271b79b00337c8e39368ef71a08ea136b685aae0e0eeb38e827b1953b085e1275

Download Submit
C:\Windows\System\qPXrFYo.exe

Filesize
1.5MB

MD5
046e8e93d175f1440dc792072bd81d79

SHA1
bfa6b0d3897f0616c2b727f9f034151955b16cce

SHA256
85d3cef60923575cd8478e356aa7e8dee9a6f683b45f64c0578beb00b2454112

SHA512
f9b15218b35b64134a22a7f0b9dbc9a29ff54ac46ca4a4a5c8e3c790e27f813ccc46926dfa61721e7d6a70a2f97dc23000434d0ab19f43a142ca4ed8441f324c

Download Submit
C:\Windows\System\qZQkeeO.exe

Filesize
1.5MB

MD5
f937831ee4ef4c2aa8fa8bb0587e7bd8

SHA1
e25e6f2432b185f644e39461dcab5b54ef4ce181

SHA256
463040bc8fa62c24a79b03a25ce1b1abad4d0dab06834de7d2e3a5d01971d216

SHA512
5f291d672d8dd3f6981ae63be6cc4145f4c83a9aa5159a2624c266553efd22fead01b561176963d0016f763bfadf45c98fe1501292a07aaf01ce440944e838a5

Download Submit
C:\Windows\System\qzNLAnb.exe

Filesize
1.5MB

MD5
23568c5dd6ca6407f1eef41fb0ebbd11

SHA1
6f7c8446918b730e39d429c40bc7935cd1ab907f

SHA256
8ab3b8d1bc1c65ccf5094e3ba738cbac8dccaac3afd1b9450fe75a994f6b3a6f

SHA512
5971d5ad5b40c553ac4444888322882a2a8c4e2920e8721dae8de85b90cc3895867e81d39e76d96b7df06a19bc61fe6d5bca2e6e8e4d542aa83febd1f1d0c3a6

Download Submit
C:\Windows\System\rSWNLKl.exe

Filesize
1.5MB

MD5
7a9ff036c6639d4a178f25a6f4f96054

SHA1
8260bdc0e87169af30eb7ffa2b6b259121d79142

SHA256
4e55a40a59d67eff3392b9505b4a1dbcbf7831f095e9e266ecc073a2dcda3d4a

SHA512
3df930c832830c1ed46f71a6fac8022dde186094c2556f71927948885ac7afbf41f228ef186bd979858022c27e518c149df50375f38fe7953fb3fe49e6fc8d5a

Download Submit
C:\Windows\System\raeElCE.exe

Filesize
1.5MB

MD5
e1d99fc99859c6b1571e62146086a25a

SHA1
e6d72e67dd8fe34850122a94fd4f3b5a5637fc0b

SHA256
2614112d300bd9afa25f3c148df1ff30dd62778e1cf389186a77f2cef54ba37b

SHA512
ece580f604b4dc17b7fe41b7f2d251f4b77b7d140a973a47292c8ed42b312ac3ac994e2a4c2b6ba406e11c8e726b79c73ff380ba9ef3127c49da0baaf8efb8e0

Download Submit
C:\Windows\System\sjYaoPG.exe

Filesize
1.5MB

MD5
80ba3c8f4f34f68d13431d7acefb0a64

SHA1
90fb17b3837e30e4e67e980cc776b47c4b1d4380

SHA256
abaf105e7c67ecac29cfa88b46775f6f8dfef97498ddba1ef89f772a35d8a089

SHA512
2f43d9f1fb8b8e62fc1d0eb69af95aef4ac3edeada4121b76a37a04ad9e8bf1e2c14bbd5d7dc4b43089615191294bb61c3f4d4b996fb84a346957647d60deb20

Download Submit
C:\Windows\System\vzsnKiS.exe

Filesize
1.5MB

MD5
23e2bc5971d4d102251c336a2099e596

SHA1
2af449f7d493b4d21da5247a3824b9410fd50824

SHA256
1ed7bffe085fd8f45656cd0ac318cd7f9d2df06dbf45115a7b15cd30fdf988ea

SHA512
02fbdae593b4fa1cb4c8cae503421b9934bbf6d77aae921c1593fc5f6cdbc446f5865169648083249e44f6466f9e93558dee84cbc4a0bebb29511735b964c1db

Download Submit
memory/1108-0-0x00007FF633110000-0x00007FF633502000-memory.dmp

Filesize
3.9MB

Download
memory/1108-1-0x000001E0E14D0000-0x000001E0E14E0000-memory.dmp

Filesize
64KB

Download
memory/1396-2650-0x00007FF7CF2B0000-0x00007FF7CF6A2000-memory.dmp

Filesize
3.9MB

Download
memory/1396-506-0x00007FF7CF2B0000-0x00007FF7CF6A2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-2697-0x00007FF69CFB0000-0x00007FF69D3A2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-820-0x00007FF69CFB0000-0x00007FF69D3A2000-memory.dmp

Filesize
3.9MB

Download
memory/1600-2667-0x00007FF63EB60000-0x00007FF63EF52000-memory.dmp

Filesize
3.9MB

Download
memory/1600-564-0x00007FF63EB60000-0x00007FF63EF52000-memory.dmp

Filesize
3.9MB

Download
memory/1912-837-0x00007FF79E830000-0x00007FF79EC22000-memory.dmp

Filesize
3.9MB

Download
memory/1912-2637-0x00007FF79E830000-0x00007FF79EC22000-memory.dmp

Filesize
3.9MB

Download
memory/2032-2665-0x00007FF72CAB0000-0x00007FF72CEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-563-0x00007FF72CAB0000-0x00007FF72CEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-2647-0x00007FF765A30000-0x00007FF765E22000-memory.dmp

Filesize
3.9MB

Download
memory/2100-395-0x00007FF765A30000-0x00007FF765E22000-memory.dmp

Filesize
3.9MB

Download
memory/2124-2707-0x00007FF6FA960000-0x00007FF6FAD52000-memory.dmp

Filesize
3.9MB

Download
memory/2124-560-0x00007FF6FA960000-0x00007FF6FAD52000-memory.dmp

Filesize
3.9MB

Download
memory/2304-557-0x00007FF71E740000-0x00007FF71EB32000-memory.dmp

Filesize
3.9MB

Download
memory/2304-2658-0x00007FF71E740000-0x00007FF71EB32000-memory.dmp

Filesize
3.9MB

Download
memory/2492-562-0x00007FF6690C0000-0x00007FF6694B2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-2651-0x00007FF6690C0000-0x00007FF6694B2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-2641-0x00007FF638AD0000-0x00007FF638EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-238-0x00007FF638AD0000-0x00007FF638EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-287-0x00007FF69FC80000-0x00007FF6A0072000-memory.dmp

Filesize
3.9MB

Download
memory/2700-2643-0x00007FF69FC80000-0x00007FF6A0072000-memory.dmp

Filesize
3.9MB

Download
memory/2800-556-0x00007FF63BA70000-0x00007FF63BE62000-memory.dmp

Filesize
3.9MB

Download
memory/2800-2646-0x00007FF63BA70000-0x00007FF63BE62000-memory.dmp

Filesize
3.9MB

Download
memory/2804-565-0x00007FF7D3090000-0x00007FF7D3482000-memory.dmp

Filesize
3.9MB

Download
memory/2804-2673-0x00007FF7D3090000-0x00007FF7D3482000-memory.dmp

Filesize
3.9MB

Download
memory/2864-558-0x00007FF7805E0000-0x00007FF7809D2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-2664-0x00007FF7805E0000-0x00007FF7809D2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-125-0x00007FF6D5120000-0x00007FF6D5512000-memory.dmp

Filesize
3.9MB

Download
memory/3192-2656-0x00007FF6D5120000-0x00007FF6D5512000-memory.dmp

Filesize
3.9MB

Download
memory/3488-561-0x00007FF7AC400000-0x00007FF7AC7F2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-2659-0x00007FF7AC400000-0x00007FF7AC7F2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-2662-0x00007FF603030000-0x00007FF603422000-memory.dmp

Filesize
3.9MB

Download
memory/3540-559-0x00007FF603030000-0x00007FF603422000-memory.dmp

Filesize
3.9MB

Download
memory/3648-2639-0x00007FF787DE0000-0x00007FF7881D2000-memory.dmp

Filesize
3.9MB

Download
memory/3648-175-0x00007FF787DE0000-0x00007FF7881D2000-memory.dmp

Filesize
3.9MB

Download
memory/4212-2635-0x00007FF6DC120000-0x00007FF6DC512000-memory.dmp

Filesize
3.9MB

Download
memory/4212-12-0x00007FF6DC120000-0x00007FF6DC512000-memory.dmp

Filesize
3.9MB

Download
memory/4244-821-0x00007FF7B9540000-0x00007FF7B9932000-memory.dmp

Filesize
3.9MB

Download
memory/4244-2702-0x00007FF7B9540000-0x00007FF7B9932000-memory.dmp

Filesize
3.9MB

Download
memory/4424-2669-0x00007FF6D2050000-0x00007FF6D2442000-memory.dmp

Filesize
3.9MB

Download
memory/4424-383-0x00007FF6D2050000-0x00007FF6D2442000-memory.dmp

Filesize
3.9MB

Download
memory/4928-2653-0x00007FF6370D0000-0x00007FF6374C2000-memory.dmp

Filesize
3.9MB

Download
memory/4928-396-0x00007FF6370D0000-0x00007FF6374C2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-2671-0x00007FF639E60000-0x00007FF63A252000-memory.dmp

Filesize
3.9MB

Download
memory/4992-566-0x00007FF639E60000-0x00007FF63A252000-memory.dmp

Filesize
3.9MB

Download
memory/5008-2675-0x00007FF71C9C0000-0x00007FF71CDB2000-memory.dmp

Filesize
3.9MB

Download
memory/5008-589-0x00007FF71C9C0000-0x00007FF71CDB2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-555-0x00007FFA0FF60000-0x00007FFA10A21000-memory.dmp

Filesize
10.8MB

Download
memory/5016-87-0x00007FFA0FF60000-0x00007FFA10A21000-memory.dmp

Filesize
10.8MB

Download
memory/5016-15-0x00007FFA0FF63000-0x00007FFA0FF65000-memory.dmp

Filesize
8KB

Download
memory/5016-798-0x000001C1B2D70000-0x000001C1B2D92000-memory.dmp

Filesize
136KB

Download