xmrig | cced24d0f7e361e96afc06d60a9fc698ba99081c763c99337cd64617d6ba283d

Analysis

max time kernel
115s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3d06f6746bd9b27d1d0e03eb1fd48870N.exe
Size

2.7MB
MD5

3d06f6746bd9b27d1d0e03eb1fd48870
SHA1

827e33744da4c58bfce940c24fe0cc7c9a3f8c78
SHA256

cced24d0f7e361e96afc06d60a9fc698ba99081c763c99337cd64617d6ba283d
SHA512

bc3c34e66b4acbfbb229bc31cce212f32f1379e1b844e2013fde10b03ed74f5b414b9c064784b9aacc3117dcb52d9b864397c29c5d40656366ab44427d4112d4
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16clC3o6:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4608-0-0x00007FF66D570000-0x00007FF66D966000-memory.dmp	xmrig
behavioral2/files/0x00070000000234ed-20.dat	xmrig
behavioral2/memory/4640-27-0x00007FF7395B0000-0x00007FF7399A6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234f5-69.dat	xmrig
behavioral2/files/0x00070000000234f8-98.dat	xmrig
behavioral2/files/0x00070000000234fb-119.dat	xmrig
behavioral2/memory/2444-127-0x00007FF7B4810000-0x00007FF7B4C06000-memory.dmp	xmrig
behavioral2/memory/1048-133-0x00007FF7159D0000-0x00007FF715DC6000-memory.dmp	xmrig
behavioral2/memory/2196-136-0x00007FF6C12E0000-0x00007FF6C16D6000-memory.dmp	xmrig
behavioral2/memory/3708-140-0x00007FF6F6E80000-0x00007FF6F7276000-memory.dmp	xmrig
behavioral2/memory/2400-144-0x00007FF7641F0000-0x00007FF7645E6000-memory.dmp	xmrig
behavioral2/memory/4160-147-0x00007FF6FDD00000-0x00007FF6FE0F6000-memory.dmp	xmrig
behavioral2/memory/3300-146-0x00007FF6BCDA0000-0x00007FF6BD196000-memory.dmp	xmrig
behavioral2/memory/4964-145-0x00007FF700E00000-0x00007FF7011F6000-memory.dmp	xmrig
behavioral2/memory/4604-143-0x00007FF700F00000-0x00007FF7012F6000-memory.dmp	xmrig
behavioral2/memory/4348-142-0x00007FF77F9E0000-0x00007FF77FDD6000-memory.dmp	xmrig
behavioral2/memory/1636-141-0x00007FF6D2F00000-0x00007FF6D32F6000-memory.dmp	xmrig
behavioral2/memory/2180-139-0x00007FF787880000-0x00007FF787C76000-memory.dmp	xmrig
behavioral2/memory/692-138-0x00007FF604FA0000-0x00007FF605396000-memory.dmp	xmrig
behavioral2/memory/1508-137-0x00007FF789BC0000-0x00007FF789FB6000-memory.dmp	xmrig
behavioral2/memory/2104-135-0x00007FF6D4B70000-0x00007FF6D4F66000-memory.dmp	xmrig
behavioral2/memory/3340-134-0x00007FF795230000-0x00007FF795626000-memory.dmp	xmrig
behavioral2/memory/3248-130-0x00007FF721D20000-0x00007FF722116000-memory.dmp	xmrig
behavioral2/files/0x00070000000234fe-129.dat	xmrig
behavioral2/files/0x00070000000234fd-128.dat	xmrig
behavioral2/memory/2932-125-0x00007FF79DFA0000-0x00007FF79E396000-memory.dmp	xmrig
behavioral2/memory/2356-122-0x00007FF6BA910000-0x00007FF6BAD06000-memory.dmp	xmrig
behavioral2/files/0x00070000000234fc-121.dat	xmrig
behavioral2/files/0x00070000000234fa-103.dat	xmrig
behavioral2/files/0x00070000000234f9-101.dat	xmrig
behavioral2/files/0x00070000000234f7-96.dat	xmrig
behavioral2/files/0x00070000000234f6-94.dat	xmrig
behavioral2/files/0x00070000000234f3-92.dat	xmrig
behavioral2/files/0x00070000000234f4-83.dat	xmrig
behavioral2/files/0x00070000000234f1-73.dat	xmrig
behavioral2/files/0x00070000000234f2-63.dat	xmrig
behavioral2/files/0x00070000000234f0-62.dat	xmrig
behavioral2/files/0x00070000000234ee-52.dat	xmrig
behavioral2/files/0x00070000000234ef-58.dat	xmrig
behavioral2/files/0x00070000000234ec-38.dat	xmrig
behavioral2/files/0x00070000000234eb-28.dat	xmrig
behavioral2/files/0x00070000000234ea-25.dat	xmrig
behavioral2/memory/4188-21-0x00007FF6016B0000-0x00007FF601AA6000-memory.dmp	xmrig
behavioral2/files/0x000b0000000234de-13.dat	xmrig
behavioral2/memory/3688-8-0x00007FF7E76E0000-0x00007FF7E7AD6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023552-383.dat	xmrig
behavioral2/memory/4412-396-0x00007FF635760000-0x00007FF635B56000-memory.dmp	xmrig
behavioral2/files/0x0007000000023559-422.dat	xmrig
behavioral2/files/0x000700000002355e-428.dat	xmrig
behavioral2/files/0x000700000002355b-425.dat	xmrig
behavioral2/files/0x0007000000023557-419.dat	xmrig
behavioral2/files/0x0007000000023569-439.dat	xmrig
behavioral2/files/0x0007000000023561-436.dat	xmrig
behavioral2/files/0x0007000000023556-416.dat	xmrig
behavioral2/files/0x0007000000023554-413.dat	xmrig
behavioral2/memory/2328-408-0x00007FF7390E0000-0x00007FF7394D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023550-403.dat	xmrig
behavioral2/files/0x0007000000023501-386.dat	xmrig
behavioral2/memory/4608-990-0x00007FF66D570000-0x00007FF66D966000-memory.dmp	xmrig
behavioral2/memory/4188-1139-0x00007FF6016B0000-0x00007FF601AA6000-memory.dmp	xmrig
behavioral2/memory/3688-1135-0x00007FF7E76E0000-0x00007FF7E7AD6000-memory.dmp	xmrig
behavioral2/memory/4640-1288-0x00007FF7395B0000-0x00007FF7399A6000-memory.dmp	xmrig
behavioral2/memory/4412-1581-0x00007FF635760000-0x00007FF635B56000-memory.dmp	xmrig
behavioral2/memory/3688-2453-0x00007FF7E76E0000-0x00007FF7E7AD6000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
7	3256	powershell.exe
9	3256	powershell.exe
11	3256	powershell.exe
12	3256	powershell.exe
14	3256	powershell.exe
15	3256	powershell.exe
16	3256	powershell.exe
22	3256	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3256	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3688	oprpWeC.exe
4188	pZFzSbt.exe
4640	CslVrLn.exe
2400	DzvbNgs.exe
2356	gYFUjUv.exe
4964	LjKIzok.exe
2932	dQgzuzg.exe
2444	OZmMSsa.exe
3248	QWRqeJM.exe
1048	LYjWIxf.exe
3300	FfJYmDu.exe
3340	SqDNwqg.exe
2104	SJvYaFh.exe
2196	kFwahKm.exe
1508	yybSkad.exe
692	NqPPpBJ.exe
2180	DjHJICy.exe
3708	SPtQidO.exe
1636	bmbJrCA.exe
4348	goQlshr.exe
4160	cqPKszX.exe
4604	QHgYeHd.exe
2328	MTDZlCp.exe
4412	iNmZJpC.exe
2232	PTZAvqu.exe
812	WmFguHG.exe
4616	JeYSXjy.exe
2448	LEefLdf.exe
1580	FIlHufE.exe
4072	UhxECEH.exe
1112	yzeIhit.exe
2272	gECzpKx.exe
1600	BSQKdZq.exe
4800	FThBXNL.exe
4164	WvlbFOg.exe
4060	izPSpbg.exe
3812	PSaEFVz.exe
2844	nzkvPbZ.exe
3352	POPwGim.exe
1376	HTMBoBk.exe
824	JYjVspE.exe
3808	lzHDXTz.exe
3160	XKAnlrE.exe
4860	vjvKjXX.exe
3428	omcmyvt.exe
3312	zXDliEm.exe
4724	ZjcXkGa.exe
2268	dmSKZbv.exe
4780	yslNStb.exe
1424	swScybs.exe
3628	anFyWWK.exe
3592	SsMgYUc.exe
4468	lqtpAmC.exe
3672	aigaYOq.exe
1384	gkbIYAx.exe
2304	LKwUDfJ.exe
4716	IdbWKKW.exe
880	tSFbgBk.exe
4456	jSwnMZM.exe
3392	hlsmBVv.exe
3516	CXWqzsB.exe
2404	BqWoKwA.exe
3440	TltIYNT.exe
1148	KdmBZBn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4608-0-0x00007FF66D570000-0x00007FF66D966000-memory.dmp	upx
behavioral2/files/0x00070000000234ed-20.dat	upx
behavioral2/memory/4640-27-0x00007FF7395B0000-0x00007FF7399A6000-memory.dmp	upx
behavioral2/files/0x00070000000234f5-69.dat	upx
behavioral2/files/0x00070000000234f8-98.dat	upx
behavioral2/files/0x00070000000234fb-119.dat	upx
behavioral2/memory/2444-127-0x00007FF7B4810000-0x00007FF7B4C06000-memory.dmp	upx
behavioral2/memory/1048-133-0x00007FF7159D0000-0x00007FF715DC6000-memory.dmp	upx
behavioral2/memory/2196-136-0x00007FF6C12E0000-0x00007FF6C16D6000-memory.dmp	upx
behavioral2/memory/3708-140-0x00007FF6F6E80000-0x00007FF6F7276000-memory.dmp	upx
behavioral2/memory/2400-144-0x00007FF7641F0000-0x00007FF7645E6000-memory.dmp	upx
behavioral2/memory/4160-147-0x00007FF6FDD00000-0x00007FF6FE0F6000-memory.dmp	upx
behavioral2/memory/3300-146-0x00007FF6BCDA0000-0x00007FF6BD196000-memory.dmp	upx
behavioral2/memory/4964-145-0x00007FF700E00000-0x00007FF7011F6000-memory.dmp	upx
behavioral2/memory/4604-143-0x00007FF700F00000-0x00007FF7012F6000-memory.dmp	upx
behavioral2/memory/4348-142-0x00007FF77F9E0000-0x00007FF77FDD6000-memory.dmp	upx
behavioral2/memory/1636-141-0x00007FF6D2F00000-0x00007FF6D32F6000-memory.dmp	upx
behavioral2/memory/2180-139-0x00007FF787880000-0x00007FF787C76000-memory.dmp	upx
behavioral2/memory/692-138-0x00007FF604FA0000-0x00007FF605396000-memory.dmp	upx
behavioral2/memory/1508-137-0x00007FF789BC0000-0x00007FF789FB6000-memory.dmp	upx
behavioral2/memory/2104-135-0x00007FF6D4B70000-0x00007FF6D4F66000-memory.dmp	upx
behavioral2/memory/3340-134-0x00007FF795230000-0x00007FF795626000-memory.dmp	upx
behavioral2/memory/3248-130-0x00007FF721D20000-0x00007FF722116000-memory.dmp	upx
behavioral2/files/0x00070000000234fe-129.dat	upx
behavioral2/files/0x00070000000234fd-128.dat	upx
behavioral2/memory/2932-125-0x00007FF79DFA0000-0x00007FF79E396000-memory.dmp	upx
behavioral2/memory/2356-122-0x00007FF6BA910000-0x00007FF6BAD06000-memory.dmp	upx
behavioral2/files/0x00070000000234fc-121.dat	upx
behavioral2/files/0x00070000000234fa-103.dat	upx
behavioral2/files/0x00070000000234f9-101.dat	upx
behavioral2/files/0x00070000000234f7-96.dat	upx
behavioral2/files/0x00070000000234f6-94.dat	upx
behavioral2/files/0x00070000000234f3-92.dat	upx
behavioral2/files/0x00070000000234f4-83.dat	upx
behavioral2/files/0x00070000000234f1-73.dat	upx
behavioral2/files/0x00070000000234f2-63.dat	upx
behavioral2/files/0x00070000000234f0-62.dat	upx
behavioral2/files/0x00070000000234ee-52.dat	upx
behavioral2/files/0x00070000000234ef-58.dat	upx
behavioral2/files/0x00070000000234ec-38.dat	upx
behavioral2/files/0x00070000000234eb-28.dat	upx
behavioral2/files/0x00070000000234ea-25.dat	upx
behavioral2/memory/4188-21-0x00007FF6016B0000-0x00007FF601AA6000-memory.dmp	upx
behavioral2/files/0x000b0000000234de-13.dat	upx
behavioral2/memory/3688-8-0x00007FF7E76E0000-0x00007FF7E7AD6000-memory.dmp	upx
behavioral2/files/0x0007000000023552-383.dat	upx
behavioral2/memory/4412-396-0x00007FF635760000-0x00007FF635B56000-memory.dmp	upx
behavioral2/files/0x0007000000023559-422.dat	upx
behavioral2/files/0x000700000002355e-428.dat	upx
behavioral2/files/0x000700000002355b-425.dat	upx
behavioral2/files/0x0007000000023557-419.dat	upx
behavioral2/files/0x0007000000023569-439.dat	upx
behavioral2/files/0x0007000000023561-436.dat	upx
behavioral2/files/0x0007000000023556-416.dat	upx
behavioral2/files/0x0007000000023554-413.dat	upx
behavioral2/memory/2328-408-0x00007FF7390E0000-0x00007FF7394D6000-memory.dmp	upx
behavioral2/files/0x0007000000023550-403.dat	upx
behavioral2/files/0x0007000000023501-386.dat	upx
behavioral2/memory/4608-990-0x00007FF66D570000-0x00007FF66D966000-memory.dmp	upx
behavioral2/memory/4188-1139-0x00007FF6016B0000-0x00007FF601AA6000-memory.dmp	upx
behavioral2/memory/3688-1135-0x00007FF7E76E0000-0x00007FF7E7AD6000-memory.dmp	upx
behavioral2/memory/4640-1288-0x00007FF7395B0000-0x00007FF7399A6000-memory.dmp	upx
behavioral2/memory/4412-1581-0x00007FF635760000-0x00007FF635B56000-memory.dmp	upx
behavioral2/memory/3688-2453-0x00007FF7E76E0000-0x00007FF7E7AD6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HBxMlqX.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\nCrHSvV.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\oGsOIVi.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\CCfuAqx.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\QZwDUqN.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\sSWnEou.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\wttskyB.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\lSAWlVk.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\HbAFXcI.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\VOyNmzA.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\RzonQrj.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\OIwkJnB.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\McjoarA.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\LbsGTHw.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\fGHjJUY.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\HvhzipD.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\tfnpuXd.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\LYxakpF.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\lzSFbqj.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\UvnySVn.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\OAsdZyZ.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\axxPQvs.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\SuWEMxV.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\Inwguwa.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\NjMwhhC.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\KwIFOwV.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\SffoznL.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\MsKGMem.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\ebqzKBX.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\xPrBQTz.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\yZbMtsg.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\xRYwmzj.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\IzDfCqL.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\yciNFZw.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\zdzlFmA.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\eiuVenF.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\olcfmVp.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\WyWIIea.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\nAWruww.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\xMrjKEH.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\SHbxtpH.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\IeFpTRg.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\EPrJztd.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\rCTrmkJ.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\fcXKuKJ.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\LHWjPcb.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\TymFNLp.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\yslNStb.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\WolABAE.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\mDfSngz.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\ZsfVNFE.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\JRRhfIO.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\gxHJUKS.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\lNwBUcD.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\CFsMdNP.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\LYfOShe.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\ugCHUEN.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\SCcqaKV.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\xymsHgL.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\tLGDWxN.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\NqRzHbX.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\meRHSOH.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\pzUswCE.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
File created	C:\Windows\System\ShHmPbg.exe	3d06f6746bd9b27d1d0e03eb1fd48870N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3256	powershell.exe
Token: SeLockMemoryPrivilege	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe
Token: SeLockMemoryPrivilege	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3256	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	85
PID 4608 wrote to memory of 3256	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	85
PID 4608 wrote to memory of 3688	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	86
PID 4608 wrote to memory of 3688	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	86
PID 4608 wrote to memory of 4188	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	87
PID 4608 wrote to memory of 4188	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	87
PID 4608 wrote to memory of 4640	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	88
PID 4608 wrote to memory of 4640	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	88
PID 4608 wrote to memory of 2400	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	89
PID 4608 wrote to memory of 2400	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	89
PID 4608 wrote to memory of 2356	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	90
PID 4608 wrote to memory of 2356	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	90
PID 4608 wrote to memory of 4964	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	91
PID 4608 wrote to memory of 4964	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	91
PID 4608 wrote to memory of 2932	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	92
PID 4608 wrote to memory of 2932	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	92
PID 4608 wrote to memory of 2444	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	93
PID 4608 wrote to memory of 2444	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	93
PID 4608 wrote to memory of 3248	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	94
PID 4608 wrote to memory of 3248	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	94
PID 4608 wrote to memory of 1048	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	95
PID 4608 wrote to memory of 1048	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	95
PID 4608 wrote to memory of 2104	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	96
PID 4608 wrote to memory of 2104	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	96
PID 4608 wrote to memory of 3300	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	97
PID 4608 wrote to memory of 3300	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	97
PID 4608 wrote to memory of 3340	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	98
PID 4608 wrote to memory of 3340	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	98
PID 4608 wrote to memory of 2196	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	99
PID 4608 wrote to memory of 2196	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	99
PID 4608 wrote to memory of 1508	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	100
PID 4608 wrote to memory of 1508	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	100
PID 4608 wrote to memory of 692	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	101
PID 4608 wrote to memory of 692	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	101
PID 4608 wrote to memory of 2180	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	102
PID 4608 wrote to memory of 2180	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	102
PID 4608 wrote to memory of 3708	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	103
PID 4608 wrote to memory of 3708	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	103
PID 4608 wrote to memory of 1636	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	104
PID 4608 wrote to memory of 1636	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	104
PID 4608 wrote to memory of 4348	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	105
PID 4608 wrote to memory of 4348	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	105
PID 4608 wrote to memory of 4160	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	106
PID 4608 wrote to memory of 4160	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	106
PID 4608 wrote to memory of 4604	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	107
PID 4608 wrote to memory of 4604	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	107
PID 4608 wrote to memory of 2328	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	108
PID 4608 wrote to memory of 2328	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	108
PID 4608 wrote to memory of 4412	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	109
PID 4608 wrote to memory of 4412	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	109
PID 4608 wrote to memory of 2232	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	110
PID 4608 wrote to memory of 2232	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	110
PID 4608 wrote to memory of 812	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	111
PID 4608 wrote to memory of 812	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	111
PID 4608 wrote to memory of 4616	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	112
PID 4608 wrote to memory of 4616	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	112
PID 4608 wrote to memory of 2448	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	113
PID 4608 wrote to memory of 2448	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	113
PID 4608 wrote to memory of 1580	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	114
PID 4608 wrote to memory of 1580	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	114
PID 4608 wrote to memory of 4072	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	115
PID 4608 wrote to memory of 4072	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	115
PID 4608 wrote to memory of 1112	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	116
PID 4608 wrote to memory of 1112	4608	3d06f6746bd9b27d1d0e03eb1fd48870N.exe	116

C:\Users\Admin\AppData\Local\Temp\3d06f6746bd9b27d1d0e03eb1fd48870N.exe
"C:\Users\Admin\AppData\Local\Temp\3d06f6746bd9b27d1d0e03eb1fd48870N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3256
- C:\Windows\System\oprpWeC.exe
  C:\Windows\System\oprpWeC.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\pZFzSbt.exe
  C:\Windows\System\pZFzSbt.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\CslVrLn.exe
  C:\Windows\System\CslVrLn.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\DzvbNgs.exe
  C:\Windows\System\DzvbNgs.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\gYFUjUv.exe
  C:\Windows\System\gYFUjUv.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\LjKIzok.exe
  C:\Windows\System\LjKIzok.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\dQgzuzg.exe
  C:\Windows\System\dQgzuzg.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\OZmMSsa.exe
  C:\Windows\System\OZmMSsa.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\QWRqeJM.exe
  C:\Windows\System\QWRqeJM.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\LYjWIxf.exe
  C:\Windows\System\LYjWIxf.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\SJvYaFh.exe
  C:\Windows\System\SJvYaFh.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\FfJYmDu.exe
  C:\Windows\System\FfJYmDu.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\SqDNwqg.exe
  C:\Windows\System\SqDNwqg.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\kFwahKm.exe
  C:\Windows\System\kFwahKm.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\yybSkad.exe
  C:\Windows\System\yybSkad.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\NqPPpBJ.exe
  C:\Windows\System\NqPPpBJ.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\DjHJICy.exe
  C:\Windows\System\DjHJICy.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\SPtQidO.exe
  C:\Windows\System\SPtQidO.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\bmbJrCA.exe
  C:\Windows\System\bmbJrCA.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\goQlshr.exe
  C:\Windows\System\goQlshr.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\cqPKszX.exe
  C:\Windows\System\cqPKszX.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\QHgYeHd.exe
  C:\Windows\System\QHgYeHd.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\MTDZlCp.exe
  C:\Windows\System\MTDZlCp.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\iNmZJpC.exe
  C:\Windows\System\iNmZJpC.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\PTZAvqu.exe
  C:\Windows\System\PTZAvqu.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\WmFguHG.exe
  C:\Windows\System\WmFguHG.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\JeYSXjy.exe
  C:\Windows\System\JeYSXjy.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\LEefLdf.exe
  C:\Windows\System\LEefLdf.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\FIlHufE.exe
  C:\Windows\System\FIlHufE.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\UhxECEH.exe
  C:\Windows\System\UhxECEH.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\yzeIhit.exe
  C:\Windows\System\yzeIhit.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\gECzpKx.exe
  C:\Windows\System\gECzpKx.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\BSQKdZq.exe
  C:\Windows\System\BSQKdZq.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\FThBXNL.exe
  C:\Windows\System\FThBXNL.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\WvlbFOg.exe
  C:\Windows\System\WvlbFOg.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\izPSpbg.exe
  C:\Windows\System\izPSpbg.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\PSaEFVz.exe
  C:\Windows\System\PSaEFVz.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\nzkvPbZ.exe
  C:\Windows\System\nzkvPbZ.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\POPwGim.exe
  C:\Windows\System\POPwGim.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\HTMBoBk.exe
  C:\Windows\System\HTMBoBk.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\JYjVspE.exe
  C:\Windows\System\JYjVspE.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\lzHDXTz.exe
  C:\Windows\System\lzHDXTz.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\XKAnlrE.exe
  C:\Windows\System\XKAnlrE.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\vjvKjXX.exe
  C:\Windows\System\vjvKjXX.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\omcmyvt.exe
  C:\Windows\System\omcmyvt.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\zXDliEm.exe
  C:\Windows\System\zXDliEm.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\ZjcXkGa.exe
  C:\Windows\System\ZjcXkGa.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\dmSKZbv.exe
  C:\Windows\System\dmSKZbv.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\yslNStb.exe
  C:\Windows\System\yslNStb.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\swScybs.exe
  C:\Windows\System\swScybs.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\anFyWWK.exe
  C:\Windows\System\anFyWWK.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\SsMgYUc.exe
  C:\Windows\System\SsMgYUc.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\lqtpAmC.exe
  C:\Windows\System\lqtpAmC.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\aigaYOq.exe
  C:\Windows\System\aigaYOq.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\gkbIYAx.exe
  C:\Windows\System\gkbIYAx.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\LKwUDfJ.exe
  C:\Windows\System\LKwUDfJ.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\IdbWKKW.exe
  C:\Windows\System\IdbWKKW.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\tSFbgBk.exe
  C:\Windows\System\tSFbgBk.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\jSwnMZM.exe
  C:\Windows\System\jSwnMZM.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\hlsmBVv.exe
  C:\Windows\System\hlsmBVv.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\CXWqzsB.exe
  C:\Windows\System\CXWqzsB.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\BqWoKwA.exe
  C:\Windows\System\BqWoKwA.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\TltIYNT.exe
  C:\Windows\System\TltIYNT.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\KdmBZBn.exe
  C:\Windows\System\KdmBZBn.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\ePVybkd.exe
  C:\Windows\System\ePVybkd.exe
  2⤵
  PID:3776
- C:\Windows\System\PJsjsBG.exe
  C:\Windows\System\PJsjsBG.exe
  2⤵
  PID:5068
- C:\Windows\System\UHzVXHS.exe
  C:\Windows\System\UHzVXHS.exe
  2⤵
  PID:2340
- C:\Windows\System\OfAoEmS.exe
  C:\Windows\System\OfAoEmS.exe
  2⤵
  PID:2008
- C:\Windows\System\WgpbiLD.exe
  C:\Windows\System\WgpbiLD.exe
  2⤵
  PID:3556
- C:\Windows\System\zizZIbo.exe
  C:\Windows\System\zizZIbo.exe
  2⤵
  PID:208
- C:\Windows\System\AkZUzqP.exe
  C:\Windows\System\AkZUzqP.exe
  2⤵
  PID:3328
- C:\Windows\System\aTZAZCy.exe
  C:\Windows\System\aTZAZCy.exe
  2⤵
  PID:2376
- C:\Windows\System\nMhMRnY.exe
  C:\Windows\System\nMhMRnY.exe
  2⤵
  PID:2168
- C:\Windows\System\CcvRdrh.exe
  C:\Windows\System\CcvRdrh.exe
  2⤵
  PID:2540
- C:\Windows\System\BRGRkys.exe
  C:\Windows\System\BRGRkys.exe
  2⤵
  PID:4708
- C:\Windows\System\sfVQmOR.exe
  C:\Windows\System\sfVQmOR.exe
  2⤵
  PID:464
- C:\Windows\System\NaLMUxv.exe
  C:\Windows\System\NaLMUxv.exe
  2⤵
  PID:1876
- C:\Windows\System\UGDvfTz.exe
  C:\Windows\System\UGDvfTz.exe
  2⤵
  PID:228
- C:\Windows\System\uvPalfU.exe
  C:\Windows\System\uvPalfU.exe
  2⤵
  PID:1732
- C:\Windows\System\IUxygPX.exe
  C:\Windows\System\IUxygPX.exe
  2⤵
  PID:4916
- C:\Windows\System\XeePxRh.exe
  C:\Windows\System\XeePxRh.exe
  2⤵
  PID:3964
- C:\Windows\System\nUPZeJl.exe
  C:\Windows\System\nUPZeJl.exe
  2⤵
  PID:5132
- C:\Windows\System\fxPczZr.exe
  C:\Windows\System\fxPczZr.exe
  2⤵
  PID:5160
- C:\Windows\System\mqFwwSy.exe
  C:\Windows\System\mqFwwSy.exe
  2⤵
  PID:5208
- C:\Windows\System\pLKFjDg.exe
  C:\Windows\System\pLKFjDg.exe
  2⤵
  PID:5228
- C:\Windows\System\ODLJeTN.exe
  C:\Windows\System\ODLJeTN.exe
  2⤵
  PID:5288
- C:\Windows\System\YpNrTHN.exe
  C:\Windows\System\YpNrTHN.exe
  2⤵
  PID:5324
- C:\Windows\System\dpduCSp.exe
  C:\Windows\System\dpduCSp.exe
  2⤵
  PID:5340
- C:\Windows\System\kybfLhY.exe
  C:\Windows\System\kybfLhY.exe
  2⤵
  PID:5380
- C:\Windows\System\iELZqMS.exe
  C:\Windows\System\iELZqMS.exe
  2⤵
  PID:5408
- C:\Windows\System\FQstQWg.exe
  C:\Windows\System\FQstQWg.exe
  2⤵
  PID:5456
- C:\Windows\System\IeEtzKj.exe
  C:\Windows\System\IeEtzKj.exe
  2⤵
  PID:5488
- C:\Windows\System\PthLbYG.exe
  C:\Windows\System\PthLbYG.exe
  2⤵
  PID:5504
- C:\Windows\System\WdmewHA.exe
  C:\Windows\System\WdmewHA.exe
  2⤵
  PID:5544
- C:\Windows\System\EakkBEw.exe
  C:\Windows\System\EakkBEw.exe
  2⤵
  PID:5588
- C:\Windows\System\BeflpkV.exe
  C:\Windows\System\BeflpkV.exe
  2⤵
  PID:5612
- C:\Windows\System\IAXpUkX.exe
  C:\Windows\System\IAXpUkX.exe
  2⤵
  PID:5632
- C:\Windows\System\UMdlDFm.exe
  C:\Windows\System\UMdlDFm.exe
  2⤵
  PID:5656
- C:\Windows\System\VvoDeYh.exe
  C:\Windows\System\VvoDeYh.exe
  2⤵
  PID:5692
- C:\Windows\System\aqFiVNP.exe
  C:\Windows\System\aqFiVNP.exe
  2⤵
  PID:5724
- C:\Windows\System\kFOtvQP.exe
  C:\Windows\System\kFOtvQP.exe
  2⤵
  PID:5744
- C:\Windows\System\oiuGpjK.exe
  C:\Windows\System\oiuGpjK.exe
  2⤵
  PID:5760
- C:\Windows\System\vUqOKUF.exe
  C:\Windows\System\vUqOKUF.exe
  2⤵
  PID:5784
- C:\Windows\System\wWsFceH.exe
  C:\Windows\System\wWsFceH.exe
  2⤵
  PID:5820
- C:\Windows\System\OYZvydY.exe
  C:\Windows\System\OYZvydY.exe
  2⤵
  PID:5848
- C:\Windows\System\fWDQwBN.exe
  C:\Windows\System\fWDQwBN.exe
  2⤵
  PID:5868
- C:\Windows\System\NFOVXYc.exe
  C:\Windows\System\NFOVXYc.exe
  2⤵
  PID:5888
- C:\Windows\System\QZhvGEB.exe
  C:\Windows\System\QZhvGEB.exe
  2⤵
  PID:5912
- C:\Windows\System\PHJZHQL.exe
  C:\Windows\System\PHJZHQL.exe
  2⤵
  PID:5936
- C:\Windows\System\huZmvUK.exe
  C:\Windows\System\huZmvUK.exe
  2⤵
  PID:5984
- C:\Windows\System\VIJyWHO.exe
  C:\Windows\System\VIJyWHO.exe
  2⤵
  PID:6024
- C:\Windows\System\fDAWkhi.exe
  C:\Windows\System\fDAWkhi.exe
  2⤵
  PID:6072
- C:\Windows\System\KvNhQRv.exe
  C:\Windows\System\KvNhQRv.exe
  2⤵
  PID:6088
- C:\Windows\System\OjGYFtp.exe
  C:\Windows\System\OjGYFtp.exe
  2⤵
  PID:6116
- C:\Windows\System\XuGsgnv.exe
  C:\Windows\System\XuGsgnv.exe
  2⤵
  PID:6136
- C:\Windows\System\cqhKNad.exe
  C:\Windows\System\cqhKNad.exe
  2⤵
  PID:5184
- C:\Windows\System\tlHVoSA.exe
  C:\Windows\System\tlHVoSA.exe
  2⤵
  PID:5276
- C:\Windows\System\USsVhbL.exe
  C:\Windows\System\USsVhbL.exe
  2⤵
  PID:5360
- C:\Windows\System\OsJjJgR.exe
  C:\Windows\System\OsJjJgR.exe
  2⤵
  PID:5424
- C:\Windows\System\ngpoyRC.exe
  C:\Windows\System\ngpoyRC.exe
  2⤵
  PID:5524
- C:\Windows\System\nyoiZsz.exe
  C:\Windows\System\nyoiZsz.exe
  2⤵
  PID:5624
- C:\Windows\System\YCmNsGt.exe
  C:\Windows\System\YCmNsGt.exe
  2⤵
  PID:5620
- C:\Windows\System\aUEvldb.exe
  C:\Windows\System\aUEvldb.exe
  2⤵
  PID:5756
- C:\Windows\System\AdAvBVj.exe
  C:\Windows\System\AdAvBVj.exe
  2⤵
  PID:5812
- C:\Windows\System\lKAVPbp.exe
  C:\Windows\System\lKAVPbp.exe
  2⤵
  PID:5860
- C:\Windows\System\pjSCreJ.exe
  C:\Windows\System\pjSCreJ.exe
  2⤵
  PID:5924
- C:\Windows\System\ZuEjxnA.exe
  C:\Windows\System\ZuEjxnA.exe
  2⤵
  PID:5960
- C:\Windows\System\aCCRcPT.exe
  C:\Windows\System\aCCRcPT.exe
  2⤵
  PID:6080
- C:\Windows\System\pxEcjTj.exe
  C:\Windows\System\pxEcjTj.exe
  2⤵
  PID:6132
- C:\Windows\System\fPiGHbT.exe
  C:\Windows\System\fPiGHbT.exe
  2⤵
  PID:5332
- C:\Windows\System\RMcQfOp.exe
  C:\Windows\System\RMcQfOp.exe
  2⤵
  PID:5604
- C:\Windows\System\FyDPoxH.exe
  C:\Windows\System\FyDPoxH.exe
  2⤵
  PID:5652
- C:\Windows\System\nKQpclU.exe
  C:\Windows\System\nKQpclU.exe
  2⤵
  PID:5844
- C:\Windows\System\YxCvfXb.exe
  C:\Windows\System\YxCvfXb.exe
  2⤵
  PID:5792
- C:\Windows\System\avPGmie.exe
  C:\Windows\System\avPGmie.exe
  2⤵
  PID:5224
- C:\Windows\System\XkcLbAM.exe
  C:\Windows\System\XkcLbAM.exe
  2⤵
  PID:5672
- C:\Windows\System\WZHePFM.exe
  C:\Windows\System\WZHePFM.exe
  2⤵
  PID:5516
- C:\Windows\System\ABzvqlX.exe
  C:\Windows\System\ABzvqlX.exe
  2⤵
  PID:6100
- C:\Windows\System\HYlICOw.exe
  C:\Windows\System\HYlICOw.exe
  2⤵
  PID:6172
- C:\Windows\System\suBsDeP.exe
  C:\Windows\System\suBsDeP.exe
  2⤵
  PID:6196
- C:\Windows\System\JUmVsQY.exe
  C:\Windows\System\JUmVsQY.exe
  2⤵
  PID:6224
- C:\Windows\System\wHDYvmW.exe
  C:\Windows\System\wHDYvmW.exe
  2⤵
  PID:6256
- C:\Windows\System\vclLUBm.exe
  C:\Windows\System\vclLUBm.exe
  2⤵
  PID:6272
- C:\Windows\System\FrXIbwP.exe
  C:\Windows\System\FrXIbwP.exe
  2⤵
  PID:6316
- C:\Windows\System\XBmcIiL.exe
  C:\Windows\System\XBmcIiL.exe
  2⤵
  PID:6344
- C:\Windows\System\aTxhCNV.exe
  C:\Windows\System\aTxhCNV.exe
  2⤵
  PID:6360
- C:\Windows\System\NqCRbwj.exe
  C:\Windows\System\NqCRbwj.exe
  2⤵
  PID:6384
- C:\Windows\System\xkPdeZF.exe
  C:\Windows\System\xkPdeZF.exe
  2⤵
  PID:6416
- C:\Windows\System\YpvmPzK.exe
  C:\Windows\System\YpvmPzK.exe
  2⤵
  PID:6444
- C:\Windows\System\MvPzdlj.exe
  C:\Windows\System\MvPzdlj.exe
  2⤵
  PID:6460
- C:\Windows\System\dHJuLqd.exe
  C:\Windows\System\dHJuLqd.exe
  2⤵
  PID:6484
- C:\Windows\System\TTHyOON.exe
  C:\Windows\System\TTHyOON.exe
  2⤵
  PID:6516
- C:\Windows\System\hhPbwrQ.exe
  C:\Windows\System\hhPbwrQ.exe
  2⤵
  PID:6556
- C:\Windows\System\MQfxacY.exe
  C:\Windows\System\MQfxacY.exe
  2⤵
  PID:6584
- C:\Windows\System\rxYqZJz.exe
  C:\Windows\System\rxYqZJz.exe
  2⤵
  PID:6628
- C:\Windows\System\BAemxVC.exe
  C:\Windows\System\BAemxVC.exe
  2⤵
  PID:6652
- C:\Windows\System\DJDhpVE.exe
  C:\Windows\System\DJDhpVE.exe
  2⤵
  PID:6668
- C:\Windows\System\gUZwoMo.exe
  C:\Windows\System\gUZwoMo.exe
  2⤵
  PID:6700
- C:\Windows\System\JjUpkTK.exe
  C:\Windows\System\JjUpkTK.exe
  2⤵
  PID:6728
- C:\Windows\System\MGLfUGy.exe
  C:\Windows\System\MGLfUGy.exe
  2⤵
  PID:6764
- C:\Windows\System\HxSBRca.exe
  C:\Windows\System\HxSBRca.exe
  2⤵
  PID:6780
- C:\Windows\System\BuRDgFO.exe
  C:\Windows\System\BuRDgFO.exe
  2⤵
  PID:6812
- C:\Windows\System\XxrxQkT.exe
  C:\Windows\System\XxrxQkT.exe
  2⤵
  PID:6840
- C:\Windows\System\llsWXKi.exe
  C:\Windows\System\llsWXKi.exe
  2⤵
  PID:6880
- C:\Windows\System\XWooWaF.exe
  C:\Windows\System\XWooWaF.exe
  2⤵
  PID:6900
- C:\Windows\System\BUSyRYP.exe
  C:\Windows\System\BUSyRYP.exe
  2⤵
  PID:6924
- C:\Windows\System\MiOEUwA.exe
  C:\Windows\System\MiOEUwA.exe
  2⤵
  PID:6952
- C:\Windows\System\TkcjpRT.exe
  C:\Windows\System\TkcjpRT.exe
  2⤵
  PID:6980
- C:\Windows\System\HaduyTw.exe
  C:\Windows\System\HaduyTw.exe
  2⤵
  PID:7008
- C:\Windows\System\wmjDqXE.exe
  C:\Windows\System\wmjDqXE.exe
  2⤵
  PID:7036
- C:\Windows\System\emYqxsc.exe
  C:\Windows\System\emYqxsc.exe
  2⤵
  PID:7076
- C:\Windows\System\arAcqkb.exe
  C:\Windows\System\arAcqkb.exe
  2⤵
  PID:7104
- C:\Windows\System\lhyCBVS.exe
  C:\Windows\System\lhyCBVS.exe
  2⤵
  PID:7132
- C:\Windows\System\MJbritV.exe
  C:\Windows\System\MJbritV.exe
  2⤵
  PID:7148
- C:\Windows\System\KNAxWuS.exe
  C:\Windows\System\KNAxWuS.exe
  2⤵
  PID:6156
- C:\Windows\System\WNhhPeC.exe
  C:\Windows\System\WNhhPeC.exe
  2⤵
  PID:6220
- C:\Windows\System\SNNxlCX.exe
  C:\Windows\System\SNNxlCX.exe
  2⤵
  PID:6292
- C:\Windows\System\DvJPvHQ.exe
  C:\Windows\System\DvJPvHQ.exe
  2⤵
  PID:6392
- C:\Windows\System\aYvFaMW.exe
  C:\Windows\System\aYvFaMW.exe
  2⤵
  PID:6452
- C:\Windows\System\zwfFAqC.exe
  C:\Windows\System\zwfFAqC.exe
  2⤵
  PID:6540
- C:\Windows\System\eCAgshf.exe
  C:\Windows\System\eCAgshf.exe
  2⤵
  PID:6572
- C:\Windows\System\WOkBJJU.exe
  C:\Windows\System\WOkBJJU.exe
  2⤵
  PID:6620
- C:\Windows\System\AvTmkuk.exe
  C:\Windows\System\AvTmkuk.exe
  2⤵
  PID:6696
- C:\Windows\System\dCwXoTR.exe
  C:\Windows\System\dCwXoTR.exe
  2⤵
  PID:6772
- C:\Windows\System\mTSWNwk.exe
  C:\Windows\System\mTSWNwk.exe
  2⤵
  PID:6804
- C:\Windows\System\xZKmZSc.exe
  C:\Windows\System\xZKmZSc.exe
  2⤵
  PID:6908
- C:\Windows\System\PHHVjLW.exe
  C:\Windows\System\PHHVjLW.exe
  2⤵
  PID:6996
- C:\Windows\System\AcpZSrN.exe
  C:\Windows\System\AcpZSrN.exe
  2⤵
  PID:7048
- C:\Windows\System\tCETPhe.exe
  C:\Windows\System\tCETPhe.exe
  2⤵
  PID:7116
- C:\Windows\System\ysjJWeJ.exe
  C:\Windows\System\ysjJWeJ.exe
  2⤵
  PID:7140
- C:\Windows\System\WgUupkg.exe
  C:\Windows\System\WgUupkg.exe
  2⤵
  PID:6264
- C:\Windows\System\sNmfYJF.exe
  C:\Windows\System\sNmfYJF.exe
  2⤵
  PID:6404
- C:\Windows\System\EaQCFgt.exe
  C:\Windows\System\EaQCFgt.exe
  2⤵
  PID:6536
- C:\Windows\System\JanQOou.exe
  C:\Windows\System\JanQOou.exe
  2⤵
  PID:6748
- C:\Windows\System\rbZSXYu.exe
  C:\Windows\System\rbZSXYu.exe
  2⤵
  PID:6232
- C:\Windows\System\ZBqdvWY.exe
  C:\Windows\System\ZBqdvWY.exe
  2⤵
  PID:7096
- C:\Windows\System\xaaWPHK.exe
  C:\Windows\System\xaaWPHK.exe
  2⤵
  PID:6180
- C:\Windows\System\dYOFBxx.exe
  C:\Windows\System\dYOFBxx.exe
  2⤵
  PID:6736
- C:\Windows\System\YDpYoEP.exe
  C:\Windows\System\YDpYoEP.exe
  2⤵
  PID:7060
- C:\Windows\System\HeVVeaO.exe
  C:\Windows\System\HeVVeaO.exe
  2⤵
  PID:6836
- C:\Windows\System\uVdlOGP.exe
  C:\Windows\System\uVdlOGP.exe
  2⤵
  PID:7020
- C:\Windows\System\DwuoDmP.exe
  C:\Windows\System\DwuoDmP.exe
  2⤵
  PID:7180
- C:\Windows\System\yDyCEat.exe
  C:\Windows\System\yDyCEat.exe
  2⤵
  PID:7220
- C:\Windows\System\juKNjAR.exe
  C:\Windows\System\juKNjAR.exe
  2⤵
  PID:7248
- C:\Windows\System\jrMtQuN.exe
  C:\Windows\System\jrMtQuN.exe
  2⤵
  PID:7272
- C:\Windows\System\UstyQCF.exe
  C:\Windows\System\UstyQCF.exe
  2⤵
  PID:7292
- C:\Windows\System\TUcslNr.exe
  C:\Windows\System\TUcslNr.exe
  2⤵
  PID:7328
- C:\Windows\System\zkjYVpI.exe
  C:\Windows\System\zkjYVpI.exe
  2⤵
  PID:7344
- C:\Windows\System\jvHjiNA.exe
  C:\Windows\System\jvHjiNA.exe
  2⤵
  PID:7372
- C:\Windows\System\wAKzToW.exe
  C:\Windows\System\wAKzToW.exe
  2⤵
  PID:7392
- C:\Windows\System\lcEqvfk.exe
  C:\Windows\System\lcEqvfk.exe
  2⤵
  PID:7420
- C:\Windows\System\jdZGHRT.exe
  C:\Windows\System\jdZGHRT.exe
  2⤵
  PID:7436
- C:\Windows\System\ZNwaTux.exe
  C:\Windows\System\ZNwaTux.exe
  2⤵
  PID:7480
- C:\Windows\System\uPIhSQN.exe
  C:\Windows\System\uPIhSQN.exe
  2⤵
  PID:7496
- C:\Windows\System\tYCGhHD.exe
  C:\Windows\System\tYCGhHD.exe
  2⤵
  PID:7528
- C:\Windows\System\iaoEnhe.exe
  C:\Windows\System\iaoEnhe.exe
  2⤵
  PID:7552
- C:\Windows\System\yAMnoyE.exe
  C:\Windows\System\yAMnoyE.exe
  2⤵
  PID:7588
- C:\Windows\System\sFnHThP.exe
  C:\Windows\System\sFnHThP.exe
  2⤵
  PID:7624
- C:\Windows\System\bbaWKow.exe
  C:\Windows\System\bbaWKow.exe
  2⤵
  PID:7668
- C:\Windows\System\zFGNuOo.exe
  C:\Windows\System\zFGNuOo.exe
  2⤵
  PID:7700
- C:\Windows\System\tttqzJA.exe
  C:\Windows\System\tttqzJA.exe
  2⤵
  PID:7752
- C:\Windows\System\WTkgGrH.exe
  C:\Windows\System\WTkgGrH.exe
  2⤵
  PID:7776
- C:\Windows\System\XRwKYMk.exe
  C:\Windows\System\XRwKYMk.exe
  2⤵
  PID:7812
- C:\Windows\System\eDSCgUA.exe
  C:\Windows\System\eDSCgUA.exe
  2⤵
  PID:7836
- C:\Windows\System\iLzeQmW.exe
  C:\Windows\System\iLzeQmW.exe
  2⤵
  PID:7876
- C:\Windows\System\MPsAMps.exe
  C:\Windows\System\MPsAMps.exe
  2⤵
  PID:7908
- C:\Windows\System\yhRSiJS.exe
  C:\Windows\System\yhRSiJS.exe
  2⤵
  PID:7932
- C:\Windows\System\tcIkSQA.exe
  C:\Windows\System\tcIkSQA.exe
  2⤵
  PID:7952
- C:\Windows\System\ogWuRoz.exe
  C:\Windows\System\ogWuRoz.exe
  2⤵
  PID:7984
- C:\Windows\System\ufyTXKy.exe
  C:\Windows\System\ufyTXKy.exe
  2⤵
  PID:8004
- C:\Windows\System\wvAzVhN.exe
  C:\Windows\System\wvAzVhN.exe
  2⤵
  PID:8048
- C:\Windows\System\wrzweFw.exe
  C:\Windows\System\wrzweFw.exe
  2⤵
  PID:8072
- C:\Windows\System\ddmdZaL.exe
  C:\Windows\System\ddmdZaL.exe
  2⤵
  PID:8088
- C:\Windows\System\mLVFLAc.exe
  C:\Windows\System\mLVFLAc.exe
  2⤵
  PID:8128
- C:\Windows\System\ZgZBMHi.exe
  C:\Windows\System\ZgZBMHi.exe
  2⤵
  PID:8144
- C:\Windows\System\zoEhJJA.exe
  C:\Windows\System\zoEhJJA.exe
  2⤵
  PID:8180
- C:\Windows\System\oVGFQJh.exe
  C:\Windows\System\oVGFQJh.exe
  2⤵
  PID:7188
- C:\Windows\System\SUTNmAc.exe
  C:\Windows\System\SUTNmAc.exe
  2⤵
  PID:7268
- C:\Windows\System\zlnAMut.exe
  C:\Windows\System\zlnAMut.exe
  2⤵
  PID:7320
- C:\Windows\System\AZtrqes.exe
  C:\Windows\System\AZtrqes.exe
  2⤵
  PID:7364
- C:\Windows\System\KXHafpi.exe
  C:\Windows\System\KXHafpi.exe
  2⤵
  PID:7428
- C:\Windows\System\yoEZGQL.exe
  C:\Windows\System\yoEZGQL.exe
  2⤵
  PID:7540
- C:\Windows\System\oDPsgkR.exe
  C:\Windows\System\oDPsgkR.exe
  2⤵
  PID:7612
- C:\Windows\System\mxmcefJ.exe
  C:\Windows\System\mxmcefJ.exe
  2⤵
  PID:7688
- C:\Windows\System\SpEZQIC.exe
  C:\Windows\System\SpEZQIC.exe
  2⤵
  PID:7696
- C:\Windows\System\MBiSfZX.exe
  C:\Windows\System\MBiSfZX.exe
  2⤵
  PID:7772
- C:\Windows\System\feXaRlW.exe
  C:\Windows\System\feXaRlW.exe
  2⤵
  PID:7892
- C:\Windows\System\iyzVvUk.exe
  C:\Windows\System\iyzVvUk.exe
  2⤵
  PID:7940
- C:\Windows\System\ivhGIqj.exe
  C:\Windows\System\ivhGIqj.exe
  2⤵
  PID:7992
- C:\Windows\System\khmGJiL.exe
  C:\Windows\System\khmGJiL.exe
  2⤵
  PID:8084
- C:\Windows\System\mIZSgmP.exe
  C:\Windows\System\mIZSgmP.exe
  2⤵
  PID:8160
- C:\Windows\System\XPIAlSP.exe
  C:\Windows\System\XPIAlSP.exe
  2⤵
  PID:7300
- C:\Windows\System\EcTjXrF.exe
  C:\Windows\System\EcTjXrF.exe
  2⤵
  PID:7284
- C:\Windows\System\awlkovk.exe
  C:\Windows\System\awlkovk.exe
  2⤵
  PID:7492
- C:\Windows\System\sZdZqSW.exe
  C:\Windows\System\sZdZqSW.exe
  2⤵
  PID:7644
- C:\Windows\System\NdpIAzY.exe
  C:\Windows\System\NdpIAzY.exe
  2⤵
  PID:7792
- C:\Windows\System\vnuRxbx.exe
  C:\Windows\System\vnuRxbx.exe
  2⤵
  PID:7960
- C:\Windows\System\VzvcYqW.exe
  C:\Windows\System\VzvcYqW.exe
  2⤵
  PID:8064
- C:\Windows\System\sjoufCM.exe
  C:\Windows\System\sjoufCM.exe
  2⤵
  PID:8168
- C:\Windows\System\FTDpYlb.exe
  C:\Windows\System\FTDpYlb.exe
  2⤵
  PID:7516
- C:\Windows\System\NzrdiJx.exe
  C:\Windows\System\NzrdiJx.exe
  2⤵
  PID:7680
- C:\Windows\System\eGmTIEi.exe
  C:\Windows\System\eGmTIEi.exe
  2⤵
  PID:8196
- C:\Windows\System\HmtbLIQ.exe
  C:\Windows\System\HmtbLIQ.exe
  2⤵
  PID:8220
- C:\Windows\System\NqVZcfm.exe
  C:\Windows\System\NqVZcfm.exe
  2⤵
  PID:8236
- C:\Windows\System\dSdFTke.exe
  C:\Windows\System\dSdFTke.exe
  2⤵
  PID:8256
- C:\Windows\System\lIkjhzM.exe
  C:\Windows\System\lIkjhzM.exe
  2⤵
  PID:8288
- C:\Windows\System\IJXjzRL.exe
  C:\Windows\System\IJXjzRL.exe
  2⤵
  PID:8312
- C:\Windows\System\GBZPtUR.exe
  C:\Windows\System\GBZPtUR.exe
  2⤵
  PID:8328
- C:\Windows\System\QwmkYsL.exe
  C:\Windows\System\QwmkYsL.exe
  2⤵
  PID:8380
- C:\Windows\System\xhHdooe.exe
  C:\Windows\System\xhHdooe.exe
  2⤵
  PID:8408
- C:\Windows\System\QwRewWw.exe
  C:\Windows\System\QwRewWw.exe
  2⤵
  PID:8432
- C:\Windows\System\QzrnoCG.exe
  C:\Windows\System\QzrnoCG.exe
  2⤵
  PID:8456
- C:\Windows\System\Lduells.exe
  C:\Windows\System\Lduells.exe
  2⤵
  PID:8488
- C:\Windows\System\gHHEALM.exe
  C:\Windows\System\gHHEALM.exe
  2⤵
  PID:8512
- C:\Windows\System\vIqIfFq.exe
  C:\Windows\System\vIqIfFq.exe
  2⤵
  PID:8544
- C:\Windows\System\iblIFvM.exe
  C:\Windows\System\iblIFvM.exe
  2⤵
  PID:8576
- C:\Windows\System\YeUJvkW.exe
  C:\Windows\System\YeUJvkW.exe
  2⤵
  PID:8608
- C:\Windows\System\YimkJJS.exe
  C:\Windows\System\YimkJJS.exe
  2⤵
  PID:8636
- C:\Windows\System\edUGBBR.exe
  C:\Windows\System\edUGBBR.exe
  2⤵
  PID:8704
- C:\Windows\System\MnUBkYr.exe
  C:\Windows\System\MnUBkYr.exe
  2⤵
  PID:8752
- C:\Windows\System\QuGoaun.exe
  C:\Windows\System\QuGoaun.exe
  2⤵
  PID:8772
- C:\Windows\System\OMiMLoT.exe
  C:\Windows\System\OMiMLoT.exe
  2⤵
  PID:8828
- C:\Windows\System\xvPIYyd.exe
  C:\Windows\System\xvPIYyd.exe
  2⤵
  PID:8856
- C:\Windows\System\UmTYwMB.exe
  C:\Windows\System\UmTYwMB.exe
  2⤵
  PID:8876
- C:\Windows\System\JgSJWdF.exe
  C:\Windows\System\JgSJWdF.exe
  2⤵
  PID:8900
- C:\Windows\System\FJZXjfG.exe
  C:\Windows\System\FJZXjfG.exe
  2⤵
  PID:8920
- C:\Windows\System\pmNILXs.exe
  C:\Windows\System\pmNILXs.exe
  2⤵
  PID:8944
- C:\Windows\System\tyNVsuE.exe
  C:\Windows\System\tyNVsuE.exe
  2⤵
  PID:8984
- C:\Windows\System\xchXBtE.exe
  C:\Windows\System\xchXBtE.exe
  2⤵
  PID:9024
- C:\Windows\System\FlOolYS.exe
  C:\Windows\System\FlOolYS.exe
  2⤵
  PID:9040
- C:\Windows\System\wSOVQpj.exe
  C:\Windows\System\wSOVQpj.exe
  2⤵
  PID:9060
- C:\Windows\System\FCiOArR.exe
  C:\Windows\System\FCiOArR.exe
  2⤵
  PID:9096
- C:\Windows\System\gQKDYmT.exe
  C:\Windows\System\gQKDYmT.exe
  2⤵
  PID:9116
- C:\Windows\System\XtHAfvN.exe
  C:\Windows\System\XtHAfvN.exe
  2⤵
  PID:9132
- C:\Windows\System\ZzCiHnu.exe
  C:\Windows\System\ZzCiHnu.exe
  2⤵
  PID:9148
- C:\Windows\System\rLFcqMr.exe
  C:\Windows\System\rLFcqMr.exe
  2⤵
  PID:9164
- C:\Windows\System\qfdZtzx.exe
  C:\Windows\System\qfdZtzx.exe
  2⤵
  PID:9196
- C:\Windows\System\fXHmhYO.exe
  C:\Windows\System\fXHmhYO.exe
  2⤵
  PID:7384
- C:\Windows\System\xMaPmPF.exe
  C:\Windows\System\xMaPmPF.exe
  2⤵
  PID:7572
- C:\Windows\System\NZZDGzU.exe
  C:\Windows\System\NZZDGzU.exe
  2⤵
  PID:8252
- C:\Windows\System\GLoLqVn.exe
  C:\Windows\System\GLoLqVn.exe
  2⤵
  PID:8404
- C:\Windows\System\kagQdNR.exe
  C:\Windows\System\kagQdNR.exe
  2⤵
  PID:8388
- C:\Windows\System\cZAAoEf.exe
  C:\Windows\System\cZAAoEf.exe
  2⤵
  PID:8448
- C:\Windows\System\wmwbpDu.exe
  C:\Windows\System\wmwbpDu.exe
  2⤵
  PID:8556
- C:\Windows\System\OliDACQ.exe
  C:\Windows\System\OliDACQ.exe
  2⤵
  PID:8620
- C:\Windows\System\eTWtFZY.exe
  C:\Windows\System\eTWtFZY.exe
  2⤵
  PID:8748
- C:\Windows\System\nThOqoa.exe
  C:\Windows\System\nThOqoa.exe
  2⤵
  PID:8784
- C:\Windows\System\wuvMdOE.exe
  C:\Windows\System\wuvMdOE.exe
  2⤵
  PID:8848
- C:\Windows\System\ENISYvT.exe
  C:\Windows\System\ENISYvT.exe
  2⤵
  PID:8884
- C:\Windows\System\aoxfPTR.exe
  C:\Windows\System\aoxfPTR.exe
  2⤵
  PID:8940
- C:\Windows\System\BVXiouU.exe
  C:\Windows\System\BVXiouU.exe
  2⤵
  PID:8996
- C:\Windows\System\sQQRuNY.exe
  C:\Windows\System\sQQRuNY.exe
  2⤵
  PID:9080
- C:\Windows\System\ZHSzxFO.exe
  C:\Windows\System\ZHSzxFO.exe
  2⤵
  PID:9124
- C:\Windows\System\NnEMOes.exe
  C:\Windows\System\NnEMOes.exe
  2⤵
  PID:9104
- C:\Windows\System\knaSNUK.exe
  C:\Windows\System\knaSNUK.exe
  2⤵
  PID:7920
- C:\Windows\System\HizXPbM.exe
  C:\Windows\System\HizXPbM.exe
  2⤵
  PID:8112
- C:\Windows\System\tDGODZw.exe
  C:\Windows\System\tDGODZw.exe
  2⤵
  PID:8300
- C:\Windows\System\SMMIrWK.exe
  C:\Windows\System\SMMIrWK.exe
  2⤵
  PID:8440
- C:\Windows\System\eijmOlI.exe
  C:\Windows\System\eijmOlI.exe
  2⤵
  PID:8632
- C:\Windows\System\rrqsgAw.exe
  C:\Windows\System\rrqsgAw.exe
  2⤵
  PID:8676
- C:\Windows\System\rMcsPrN.exe
  C:\Windows\System\rMcsPrN.exe
  2⤵
  PID:8744
- C:\Windows\System\kWzzfCj.exe
  C:\Windows\System\kWzzfCj.exe
  2⤵
  PID:8820
- C:\Windows\System\PhXljsL.exe
  C:\Windows\System\PhXljsL.exe
  2⤵
  PID:9128
- C:\Windows\System\tlNNTuN.exe
  C:\Windows\System\tlNNTuN.exe
  2⤵
  PID:8596
- C:\Windows\System\oVrTFrZ.exe
  C:\Windows\System\oVrTFrZ.exe
  2⤵
  PID:7720
- C:\Windows\System\csRrZxm.exe
  C:\Windows\System\csRrZxm.exe
  2⤵
  PID:9224
- C:\Windows\System\xcKnxGw.exe
  C:\Windows\System\xcKnxGw.exe
  2⤵
  PID:9260
- C:\Windows\System\hPxwTkH.exe
  C:\Windows\System\hPxwTkH.exe
  2⤵
  PID:9292
- C:\Windows\System\JFeRXYj.exe
  C:\Windows\System\JFeRXYj.exe
  2⤵
  PID:9324
- C:\Windows\System\lmtxzIe.exe
  C:\Windows\System\lmtxzIe.exe
  2⤵
  PID:9348
- C:\Windows\System\ojCqRMX.exe
  C:\Windows\System\ojCqRMX.exe
  2⤵
  PID:9380
- C:\Windows\System\SfsmdhE.exe
  C:\Windows\System\SfsmdhE.exe
  2⤵
  PID:9436
- C:\Windows\System\WrqeQOv.exe
  C:\Windows\System\WrqeQOv.exe
  2⤵
  PID:9468
- C:\Windows\System\pBOsqUj.exe
  C:\Windows\System\pBOsqUj.exe
  2⤵
  PID:9508
- C:\Windows\System\tUegpls.exe
  C:\Windows\System\tUegpls.exe
  2⤵
  PID:9548
- C:\Windows\System\kzpwwWZ.exe
  C:\Windows\System\kzpwwWZ.exe
  2⤵
  PID:9576
- C:\Windows\System\TjttnuM.exe
  C:\Windows\System\TjttnuM.exe
  2⤵
  PID:9604
- C:\Windows\System\xLCclqc.exe
  C:\Windows\System\xLCclqc.exe
  2⤵
  PID:9648
- C:\Windows\System\rteScah.exe
  C:\Windows\System\rteScah.exe
  2⤵
  PID:9688
- C:\Windows\System\ZPySank.exe
  C:\Windows\System\ZPySank.exe
  2⤵
  PID:9716
- C:\Windows\System\JWfvPjD.exe
  C:\Windows\System\JWfvPjD.exe
  2⤵
  PID:9772
- C:\Windows\System\eINnqfO.exe
  C:\Windows\System\eINnqfO.exe
  2⤵
  PID:9800
- C:\Windows\System\aBcDjxK.exe
  C:\Windows\System\aBcDjxK.exe
  2⤵
  PID:9848
- C:\Windows\System\rOsMhff.exe
  C:\Windows\System\rOsMhff.exe
  2⤵
  PID:9880
- C:\Windows\System\JUNZiIa.exe
  C:\Windows\System\JUNZiIa.exe
  2⤵
  PID:9916
- C:\Windows\System\OFkDkwt.exe
  C:\Windows\System\OFkDkwt.exe
  2⤵
  PID:9956
- C:\Windows\System\KkkpFgs.exe
  C:\Windows\System\KkkpFgs.exe
  2⤵
  PID:9976
- C:\Windows\System\WfBPdIe.exe
  C:\Windows\System\WfBPdIe.exe
  2⤵
  PID:10008
- C:\Windows\System\XQCgUwK.exe
  C:\Windows\System\XQCgUwK.exe
  2⤵
  PID:10048
- C:\Windows\System\bTyotlQ.exe
  C:\Windows\System\bTyotlQ.exe
  2⤵
  PID:10092
- C:\Windows\System\zCYPrTn.exe
  C:\Windows\System\zCYPrTn.exe
  2⤵
  PID:10124
- C:\Windows\System\XrCKYXU.exe
  C:\Windows\System\XrCKYXU.exe
  2⤵
  PID:10144
- C:\Windows\System\kkDNwel.exe
  C:\Windows\System\kkDNwel.exe
  2⤵
  PID:10164
- C:\Windows\System\gYXequu.exe
  C:\Windows\System\gYXequu.exe
  2⤵
  PID:10200
- C:\Windows\System\cFuHXUZ.exe
  C:\Windows\System\cFuHXUZ.exe
  2⤵
  PID:8396
- C:\Windows\System\hIoolUh.exe
  C:\Windows\System\hIoolUh.exe
  2⤵
  PID:8656
- C:\Windows\System\KeeqLDM.exe
  C:\Windows\System\KeeqLDM.exe
  2⤵
  PID:9252
- C:\Windows\System\IyeZqVz.exe
  C:\Windows\System\IyeZqVz.exe
  2⤵
  PID:9344
- C:\Windows\System\JIRmwMZ.exe
  C:\Windows\System\JIRmwMZ.exe
  2⤵
  PID:8244
- C:\Windows\System\MJeuPHO.exe
  C:\Windows\System\MJeuPHO.exe
  2⤵
  PID:9404
- C:\Windows\System\UREhYmt.exe
  C:\Windows\System\UREhYmt.exe
  2⤵
  PID:9516
- C:\Windows\System\akENyxM.exe
  C:\Windows\System\akENyxM.exe
  2⤵
  PID:9632
- C:\Windows\System\AWBAFVB.exe
  C:\Windows\System\AWBAFVB.exe
  2⤵
  PID:9628
- C:\Windows\System\qFrqtjf.exe
  C:\Windows\System\qFrqtjf.exe
  2⤵
  PID:9748
- C:\Windows\System\lrKIEAd.exe
  C:\Windows\System\lrKIEAd.exe
  2⤵
  PID:9896
- C:\Windows\System\jICUevl.exe
  C:\Windows\System\jICUevl.exe
  2⤵
  PID:9872
- C:\Windows\System\RRmVacZ.exe
  C:\Windows\System\RRmVacZ.exe
  2⤵
  PID:10024
- C:\Windows\System\iZeigja.exe
  C:\Windows\System\iZeigja.exe
  2⤵
  PID:10020
- C:\Windows\System\SDLlaZR.exe
  C:\Windows\System\SDLlaZR.exe
  2⤵
  PID:10132
- C:\Windows\System\pADYASi.exe
  C:\Windows\System\pADYASi.exe
  2⤵
  PID:10220
- C:\Windows\System\QlXLEII.exe
  C:\Windows\System\QlXLEII.exe
  2⤵
  PID:9220
- C:\Windows\System\LrERrDq.exe
  C:\Windows\System\LrERrDq.exe
  2⤵
  PID:9364
- C:\Windows\System\xviIEJZ.exe
  C:\Windows\System\xviIEJZ.exe
  2⤵
  PID:9572
- C:\Windows\System\orxZNuX.exe
  C:\Windows\System\orxZNuX.exe
  2⤵
  PID:9708
- C:\Windows\System\ALZLNBk.exe
  C:\Windows\System\ALZLNBk.exe
  2⤵
  PID:9860
- C:\Windows\System\VINsxGm.exe
  C:\Windows\System\VINsxGm.exe
  2⤵
  PID:9968
- C:\Windows\System\ZzjRpiX.exe
  C:\Windows\System\ZzjRpiX.exe
  2⤵
  PID:10156
- C:\Windows\System\pqNxutm.exe
  C:\Windows\System\pqNxutm.exe
  2⤵
  PID:9372
- C:\Windows\System\PzaATOB.exe
  C:\Windows\System\PzaATOB.exe
  2⤵
  PID:9864
- C:\Windows\System\mUgrGac.exe
  C:\Windows\System\mUgrGac.exe
  2⤵
  PID:8980
- C:\Windows\System\ZwADQyY.exe
  C:\Windows\System\ZwADQyY.exe
  2⤵
  PID:9984
- C:\Windows\System\HEApBzz.exe
  C:\Windows\System\HEApBzz.exe
  2⤵
  PID:10252
- C:\Windows\System\AWyHwyp.exe
  C:\Windows\System\AWyHwyp.exe
  2⤵
  PID:10268
- C:\Windows\System\gCTDZJd.exe
  C:\Windows\System\gCTDZJd.exe
  2⤵
  PID:10300
- C:\Windows\System\yQfwPlg.exe
  C:\Windows\System\yQfwPlg.exe
  2⤵
  PID:10336
- C:\Windows\System\IyKYqDC.exe
  C:\Windows\System\IyKYqDC.exe
  2⤵
  PID:10368
- C:\Windows\System\kFECvmL.exe
  C:\Windows\System\kFECvmL.exe
  2⤵
  PID:10392
- C:\Windows\System\ZGrWoMD.exe
  C:\Windows\System\ZGrWoMD.exe
  2⤵
  PID:10428
- C:\Windows\System\VCbfUkn.exe
  C:\Windows\System\VCbfUkn.exe
  2⤵
  PID:10456
- C:\Windows\System\RNkflYG.exe
  C:\Windows\System\RNkflYG.exe
  2⤵
  PID:10476
- C:\Windows\System\gOUvtRE.exe
  C:\Windows\System\gOUvtRE.exe
  2⤵
  PID:10492
- C:\Windows\System\jGsNqoE.exe
  C:\Windows\System\jGsNqoE.exe
  2⤵
  PID:10528
- C:\Windows\System\cNnaNFM.exe
  C:\Windows\System\cNnaNFM.exe
  2⤵
  PID:10568
- C:\Windows\System\zOWmQQl.exe
  C:\Windows\System\zOWmQQl.exe
  2⤵
  PID:10616
- C:\Windows\System\ugFsEXz.exe
  C:\Windows\System\ugFsEXz.exe
  2⤵
  PID:10632
- C:\Windows\System\OSdNfMj.exe
  C:\Windows\System\OSdNfMj.exe
  2⤵
  PID:10664
- C:\Windows\System\XTtKVDE.exe
  C:\Windows\System\XTtKVDE.exe
  2⤵
  PID:10688
- C:\Windows\System\KMnUqJf.exe
  C:\Windows\System\KMnUqJf.exe
  2⤵
  PID:10720
- C:\Windows\System\iDBzIqm.exe
  C:\Windows\System\iDBzIqm.exe
  2⤵
  PID:10744
- C:\Windows\System\dZfoXlB.exe
  C:\Windows\System\dZfoXlB.exe
  2⤵
  PID:10780
- C:\Windows\System\wAKyvai.exe
  C:\Windows\System\wAKyvai.exe
  2⤵
  PID:10800
- C:\Windows\System\ZgYemAU.exe
  C:\Windows\System\ZgYemAU.exe
  2⤵
  PID:10824
- C:\Windows\System\KUVOwkC.exe
  C:\Windows\System\KUVOwkC.exe
  2⤵
  PID:10860
- C:\Windows\System\EwNJcRg.exe
  C:\Windows\System\EwNJcRg.exe
  2⤵
  PID:10884
- C:\Windows\System\gSFLDRO.exe
  C:\Windows\System\gSFLDRO.exe
  2⤵
  PID:10908
- C:\Windows\System\NHOwNHJ.exe
  C:\Windows\System\NHOwNHJ.exe
  2⤵
  PID:10936
- C:\Windows\System\nRgcXbO.exe
  C:\Windows\System\nRgcXbO.exe
  2⤵
  PID:10968
- C:\Windows\System\FKCziin.exe
  C:\Windows\System\FKCziin.exe
  2⤵
  PID:11012
- C:\Windows\System\LNprlMP.exe
  C:\Windows\System\LNprlMP.exe
  2⤵
  PID:11040
- C:\Windows\System\FPhSFTD.exe
  C:\Windows\System\FPhSFTD.exe
  2⤵
  PID:11060
- C:\Windows\System\gfvovCE.exe
  C:\Windows\System\gfvovCE.exe
  2⤵
  PID:11076
- C:\Windows\System\IXgQQVV.exe
  C:\Windows\System\IXgQQVV.exe
  2⤵
  PID:11096
- C:\Windows\System\rKyQCHN.exe
  C:\Windows\System\rKyQCHN.exe
  2⤵
  PID:11120
- C:\Windows\System\CsRpCdY.exe
  C:\Windows\System\CsRpCdY.exe
  2⤵
  PID:11164
- C:\Windows\System\tXUaipa.exe
  C:\Windows\System\tXUaipa.exe
  2⤵
  PID:11196
- C:\Windows\System\GpjKBvS.exe
  C:\Windows\System\GpjKBvS.exe
  2⤵
  PID:11228
- C:\Windows\System\scXvddx.exe
  C:\Windows\System\scXvddx.exe
  2⤵
  PID:11256
- C:\Windows\System\idXvDcH.exe
  C:\Windows\System\idXvDcH.exe
  2⤵
  PID:10284
- C:\Windows\System\aVyUJon.exe
  C:\Windows\System\aVyUJon.exe
  2⤵
  PID:10360
- C:\Windows\System\ZdzPjHE.exe
  C:\Windows\System\ZdzPjHE.exe
  2⤵
  PID:10380
- C:\Windows\System\NplwOAq.exe
  C:\Windows\System\NplwOAq.exe
  2⤵
  PID:10448
- C:\Windows\System\ucecfsw.exe
  C:\Windows\System\ucecfsw.exe
  2⤵
  PID:10488
- C:\Windows\System\WMOmHWA.exe
  C:\Windows\System\WMOmHWA.exe
  2⤵
  PID:10580
- C:\Windows\System\DJuHgFy.exe
  C:\Windows\System\DJuHgFy.exe
  2⤵
  PID:10656
- C:\Windows\System\OikLZSR.exe
  C:\Windows\System\OikLZSR.exe
  2⤵
  PID:10708
- C:\Windows\System\nCkPglc.exe
  C:\Windows\System\nCkPglc.exe
  2⤵
  PID:10768
- C:\Windows\System\dBPnLse.exe
  C:\Windows\System\dBPnLse.exe
  2⤵
  PID:10856
- C:\Windows\System\AlfinRV.exe
  C:\Windows\System\AlfinRV.exe
  2⤵
  PID:10924
- C:\Windows\System\DgTvzLE.exe
  C:\Windows\System\DgTvzLE.exe
  2⤵
  PID:10992
- C:\Windows\System\mZJIaXV.exe
  C:\Windows\System\mZJIaXV.exe
  2⤵
  PID:11072
- C:\Windows\System\KkFmHBt.exe
  C:\Windows\System\KkFmHBt.exe
  2⤵
  PID:11176
- C:\Windows\System\jiobcuL.exe
  C:\Windows\System\jiobcuL.exe
  2⤵
  PID:11192
- C:\Windows\System\bYMzrBp.exe
  C:\Windows\System\bYMzrBp.exe
  2⤵
  PID:10296
- C:\Windows\System\qPTNPqh.exe
  C:\Windows\System\qPTNPqh.exe
  2⤵
  PID:10444
- C:\Windows\System\YZIavPn.exe
  C:\Windows\System\YZIavPn.exe
  2⤵
  PID:10560
- C:\Windows\System\fjHOzNy.exe
  C:\Windows\System\fjHOzNy.exe
  2⤵
  PID:10604
- C:\Windows\System\TrMCguF.exe
  C:\Windows\System\TrMCguF.exe
  2⤵
  PID:10892
- C:\Windows\System\TRKvJjQ.exe
  C:\Windows\System\TRKvJjQ.exe
  2⤵
  PID:10920
- C:\Windows\System\HVMdNdr.exe
  C:\Windows\System\HVMdNdr.exe
  2⤵
  PID:11224
- C:\Windows\System\zJRdAex.exe
  C:\Windows\System\zJRdAex.exe
  2⤵
  PID:10436
- C:\Windows\System\IWmXetM.exe
  C:\Windows\System\IWmXetM.exe
  2⤵
  PID:10676
- C:\Windows\System\WfqxzoN.exe
  C:\Windows\System\WfqxzoN.exe
  2⤵
  PID:11068
- C:\Windows\System\ZBRhNLx.exe
  C:\Windows\System\ZBRhNLx.exe
  2⤵
  PID:10348
- C:\Windows\System\WWhEMOT.exe
  C:\Windows\System\WWhEMOT.exe
  2⤵
  PID:10952
- C:\Windows\System\GWhnAPm.exe
  C:\Windows\System\GWhnAPm.exe
  2⤵
  PID:11284
- C:\Windows\System\AwmGMWX.exe
  C:\Windows\System\AwmGMWX.exe
  2⤵
  PID:11304
- C:\Windows\System\eqOggxp.exe
  C:\Windows\System\eqOggxp.exe
  2⤵
  PID:11348
- C:\Windows\System\XjwMBBj.exe
  C:\Windows\System\XjwMBBj.exe
  2⤵
  PID:11372
- C:\Windows\System\eYUxlVe.exe
  C:\Windows\System\eYUxlVe.exe
  2⤵
  PID:11404
- C:\Windows\System\qcfslfN.exe
  C:\Windows\System\qcfslfN.exe
  2⤵
  PID:11424
- C:\Windows\System\vSRSILV.exe
  C:\Windows\System\vSRSILV.exe
  2⤵
  PID:11456
- C:\Windows\System\FbAjIXT.exe
  C:\Windows\System\FbAjIXT.exe
  2⤵
  PID:11488
- C:\Windows\System\nkNCskp.exe
  C:\Windows\System\nkNCskp.exe
  2⤵
  PID:11516
- C:\Windows\System\WyInvMw.exe
  C:\Windows\System\WyInvMw.exe
  2⤵
  PID:11544
- C:\Windows\System\TUDAHWi.exe
  C:\Windows\System\TUDAHWi.exe
  2⤵
  PID:11584
- C:\Windows\System\wOBCZBz.exe
  C:\Windows\System\wOBCZBz.exe
  2⤵
  PID:11612
- C:\Windows\System\MwWQJAT.exe
  C:\Windows\System\MwWQJAT.exe
  2⤵
  PID:11640
- C:\Windows\System\vHdhKsl.exe
  C:\Windows\System\vHdhKsl.exe
  2⤵
  PID:11668
- C:\Windows\System\iePVfxx.exe
  C:\Windows\System\iePVfxx.exe
  2⤵
  PID:11696
- C:\Windows\System\OkHVwtl.exe
  C:\Windows\System\OkHVwtl.exe
  2⤵
  PID:11712
- C:\Windows\System\WJcYNwG.exe
  C:\Windows\System\WJcYNwG.exe
  2⤵
  PID:11732
- C:\Windows\System\OblYcHC.exe
  C:\Windows\System\OblYcHC.exe
  2⤵
  PID:11768
- C:\Windows\System\feUfesE.exe
  C:\Windows\System\feUfesE.exe
  2⤵
  PID:11800
- C:\Windows\System\MkkHShf.exe
  C:\Windows\System\MkkHShf.exe
  2⤵
  PID:11824
- C:\Windows\System\kRgaUzA.exe
  C:\Windows\System\kRgaUzA.exe
  2⤵
  PID:11860
- C:\Windows\System\vsiyfme.exe
  C:\Windows\System\vsiyfme.exe
  2⤵
  PID:11896
- C:\Windows\System\nhQkglL.exe
  C:\Windows\System\nhQkglL.exe
  2⤵
  PID:11920
- C:\Windows\System\DwMMFoi.exe
  C:\Windows\System\DwMMFoi.exe
  2⤵
  PID:11940
- C:\Windows\System\NxbCfaK.exe
  C:\Windows\System\NxbCfaK.exe
  2⤵
  PID:11960
- C:\Windows\System\jVgYuhH.exe
  C:\Windows\System\jVgYuhH.exe
  2⤵
  PID:11984
- C:\Windows\System\EplGWSt.exe
  C:\Windows\System\EplGWSt.exe
  2⤵
  PID:12024
- C:\Windows\System\RYkfzMs.exe
  C:\Windows\System\RYkfzMs.exe
  2⤵
  PID:12052
- C:\Windows\System\pKCatFH.exe
  C:\Windows\System\pKCatFH.exe
  2⤵
  PID:12080
- C:\Windows\System\FuhvilD.exe
  C:\Windows\System\FuhvilD.exe
  2⤵
  PID:12108
- C:\Windows\System\NEWXZfF.exe
  C:\Windows\System\NEWXZfF.exe
  2⤵
  PID:12140
- C:\Windows\System\eXURwYs.exe
  C:\Windows\System\eXURwYs.exe
  2⤵
  PID:12164
- C:\Windows\System\hxQMFSy.exe
  C:\Windows\System\hxQMFSy.exe
  2⤵
  PID:12184
- C:\Windows\System\JCBqcqs.exe
  C:\Windows\System\JCBqcqs.exe
  2⤵
  PID:12216
- C:\Windows\System\rCtGTRw.exe
  C:\Windows\System\rCtGTRw.exe
  2⤵
  PID:12264
- C:\Windows\System\gpWkNDc.exe
  C:\Windows\System\gpWkNDc.exe
  2⤵
  PID:12280
- C:\Windows\System\fQVSEtd.exe
  C:\Windows\System\fQVSEtd.exe
  2⤵
  PID:11300
- C:\Windows\System\yYXyBuY.exe
  C:\Windows\System\yYXyBuY.exe
  2⤵
  PID:11368
- C:\Windows\System\irgrgff.exe
  C:\Windows\System\irgrgff.exe
  2⤵
  PID:11388
- C:\Windows\System\dagnLYK.exe
  C:\Windows\System\dagnLYK.exe
  2⤵
  PID:11432
- C:\Windows\System\Xyvsltx.exe
  C:\Windows\System\Xyvsltx.exe
  2⤵
  PID:11556
- C:\Windows\System\jJnedhk.exe
  C:\Windows\System\jJnedhk.exe
  2⤵
  PID:11624
- C:\Windows\System\HfIrIFq.exe
  C:\Windows\System\HfIrIFq.exe
  2⤵
  PID:11704
- C:\Windows\System\QyVGOXk.exe
  C:\Windows\System\QyVGOXk.exe
  2⤵
  PID:11728
- C:\Windows\System\vnipwkh.exe
  C:\Windows\System\vnipwkh.exe
  2⤵
  PID:11812
- C:\Windows\System\qaHkqAF.exe
  C:\Windows\System\qaHkqAF.exe
  2⤵
  PID:11880
- C:\Windows\System\EeZhyec.exe
  C:\Windows\System\EeZhyec.exe
  2⤵
  PID:11956
- C:\Windows\System\uhDayUf.exe
  C:\Windows\System\uhDayUf.exe
  2⤵
  PID:11996
- C:\Windows\System\HfvRlmU.exe
  C:\Windows\System\HfvRlmU.exe
  2⤵
  PID:12092
- C:\Windows\System\Aillzdo.exe
  C:\Windows\System\Aillzdo.exe
  2⤵
  PID:12152
- C:\Windows\System\TTVIlYR.exe
  C:\Windows\System\TTVIlYR.exe
  2⤵
  PID:12172
- C:\Windows\System\xowbnJJ.exe
  C:\Windows\System\xowbnJJ.exe
  2⤵
  PID:12276
- C:\Windows\System\bsqXePQ.exe
  C:\Windows\System\bsqXePQ.exe
  2⤵
  PID:11400
- C:\Windows\System\xvOFmOh.exe
  C:\Windows\System\xvOFmOh.exe
  2⤵
  PID:11564
- C:\Windows\System\GrsAJWX.exe
  C:\Windows\System\GrsAJWX.exe
  2⤵
  PID:11720
- C:\Windows\System\afnAFdi.exe
  C:\Windows\System\afnAFdi.exe
  2⤵
  PID:11908
- C:\Windows\System\bctWMsx.exe
  C:\Windows\System\bctWMsx.exe
  2⤵
  PID:11980
- C:\Windows\System\dGsOXho.exe
  C:\Windows\System\dGsOXho.exe
  2⤵
  PID:12100
- C:\Windows\System\mKcjmre.exe
  C:\Windows\System\mKcjmre.exe
  2⤵
  PID:12248
- C:\Windows\System\AMVtPmt.exe
  C:\Windows\System\AMVtPmt.exe
  2⤵
  PID:11364
- C:\Windows\System\oZmyBhI.exe
  C:\Windows\System\oZmyBhI.exe
  2⤵
  PID:11808
- C:\Windows\System\GxSvwnp.exe
  C:\Windows\System\GxSvwnp.exe
  2⤵
  PID:12104
- C:\Windows\System\sgLlHIT.exe
  C:\Windows\System\sgLlHIT.exe
  2⤵
  PID:12296
- C:\Windows\System\CYMNsMl.exe
  C:\Windows\System\CYMNsMl.exe
  2⤵
  PID:12328
- C:\Windows\System\lbVCRgF.exe
  C:\Windows\System\lbVCRgF.exe
  2⤵
  PID:12356
- C:\Windows\System\AXEoaqr.exe
  C:\Windows\System\AXEoaqr.exe
  2⤵
  PID:12384
- C:\Windows\System\QyoOCJF.exe
  C:\Windows\System\QyoOCJF.exe
  2⤵
  PID:12412
- C:\Windows\System\sqzLFxK.exe
  C:\Windows\System\sqzLFxK.exe
  2⤵
  PID:12440
- C:\Windows\System\ZkCOWiH.exe
  C:\Windows\System\ZkCOWiH.exe
  2⤵
  PID:12472
- C:\Windows\System\fIwrxfR.exe
  C:\Windows\System\fIwrxfR.exe
  2⤵
  PID:12508
- C:\Windows\System\ExBlMPf.exe
  C:\Windows\System\ExBlMPf.exe
  2⤵
  PID:12524
- C:\Windows\System\VYJFRoz.exe
  C:\Windows\System\VYJFRoz.exe
  2⤵
  PID:12560
- C:\Windows\System\oDDcXpV.exe
  C:\Windows\System\oDDcXpV.exe
  2⤵
  PID:12580
- C:\Windows\System\sPpBbKu.exe
  C:\Windows\System\sPpBbKu.exe
  2⤵
  PID:12608
- C:\Windows\System\ytQpnYL.exe
  C:\Windows\System\ytQpnYL.exe
  2⤵
  PID:12636
- C:\Windows\System\mZaUlsA.exe
  C:\Windows\System\mZaUlsA.exe
  2⤵
  PID:12664
- C:\Windows\System\wXeWyYm.exe
  C:\Windows\System\wXeWyYm.exe
  2⤵
  PID:12680
- C:\Windows\System\hGwTIbD.exe
  C:\Windows\System\hGwTIbD.exe
  2⤵
  PID:12712
- C:\Windows\System\oWscGHU.exe
  C:\Windows\System\oWscGHU.exe
  2⤵
  PID:12736
- C:\Windows\System\GFqRuni.exe
  C:\Windows\System\GFqRuni.exe
  2⤵
  PID:12776
- C:\Windows\System\PRmOGdZ.exe
  C:\Windows\System\PRmOGdZ.exe
  2⤵
  PID:12804
- C:\Windows\System\fqThlIt.exe
  C:\Windows\System\fqThlIt.exe
  2⤵
  PID:12832
- C:\Windows\System\NdRzhMx.exe
  C:\Windows\System\NdRzhMx.exe
  2⤵
  PID:12872
- C:\Windows\System\tmgUqsF.exe
  C:\Windows\System\tmgUqsF.exe
  2⤵
  PID:12892
- C:\Windows\System\hJfUEZx.exe
  C:\Windows\System\hJfUEZx.exe
  2⤵
  PID:12916
- C:\Windows\System\kxDKgQp.exe
  C:\Windows\System\kxDKgQp.exe
  2⤵
  PID:12944
- C:\Windows\System\FHSOhVq.exe
  C:\Windows\System\FHSOhVq.exe
  2⤵
  PID:12960
- C:\Windows\System\KoopMgs.exe
  C:\Windows\System\KoopMgs.exe
  2⤵
  PID:12980
- C:\Windows\System\NdnbAbD.exe
  C:\Windows\System\NdnbAbD.exe
  2⤵
  PID:13012
- C:\Windows\System\iqeihwF.exe
  C:\Windows\System\iqeihwF.exe
  2⤵
  PID:13052
- C:\Windows\System\JAoNSfT.exe
  C:\Windows\System\JAoNSfT.exe
  2⤵
  PID:13084
- C:\Windows\System\jIMPMdS.exe
  C:\Windows\System\jIMPMdS.exe
  2⤵
  PID:13100
- C:\Windows\System\vntZXQf.exe
  C:\Windows\System\vntZXQf.exe
  2⤵
  PID:13120
- C:\Windows\System\YUEyfsn.exe
  C:\Windows\System\YUEyfsn.exe
  2⤵
  PID:13148
- C:\Windows\System\MiEELgP.exe
  C:\Windows\System\MiEELgP.exe
  2⤵
  PID:13176
- C:\Windows\System\YGlabRB.exe
  C:\Windows\System\YGlabRB.exe
  2⤵
  PID:13212
- C:\Windows\System\mWGRkln.exe
  C:\Windows\System\mWGRkln.exe
  2⤵
  PID:13236
- C:\Windows\System\zqOoBJz.exe
  C:\Windows\System\zqOoBJz.exe
  2⤵
  PID:13264
- C:\Windows\System\hmTCSCk.exe
  C:\Windows\System\hmTCSCk.exe
  2⤵
  PID:13292
- C:\Windows\System\gfhVejk.exe
  C:\Windows\System\gfhVejk.exe
  2⤵
  PID:12308
- C:\Windows\System\nYfemzI.exe
  C:\Windows\System\nYfemzI.exe
  2⤵
  PID:12340
- C:\Windows\System\PUNEiwr.exe
  C:\Windows\System\PUNEiwr.exe
  2⤵
  PID:12428
- C:\Windows\System\hXVJiJQ.exe
  C:\Windows\System\hXVJiJQ.exe
  2⤵
  PID:12500
- C:\Windows\System\leaHWGr.exe
  C:\Windows\System\leaHWGr.exe
  2⤵
  PID:12540
- C:\Windows\System\bEkHFxV.exe
  C:\Windows\System\bEkHFxV.exe
  2⤵
  PID:12624
- C:\Windows\System\JJlmuYr.exe
  C:\Windows\System\JJlmuYr.exe
  2⤵
  PID:12700
- C:\Windows\System\gKrVPuX.exe
  C:\Windows\System\gKrVPuX.exe
  2⤵
  PID:12728
- C:\Windows\System\gFQErxX.exe
  C:\Windows\System\gFQErxX.exe
  2⤵
  PID:12788
- C:\Windows\System\lQsflzD.exe
  C:\Windows\System\lQsflzD.exe
  2⤵
  PID:12868
- C:\Windows\System\DApXArv.exe
  C:\Windows\System\DApXArv.exe
  2⤵
  PID:12932
- C:\Windows\System\OFdNtwk.exe
  C:\Windows\System\OFdNtwk.exe
  2⤵
  PID:13004
- C:\Windows\System\YIdectP.exe
  C:\Windows\System\YIdectP.exe
  2⤵
  PID:13040
- C:\Windows\System\xXjuskS.exe
  C:\Windows\System\xXjuskS.exe
  2⤵
  PID:13096
- C:\Windows\System\fjbuaUV.exe
  C:\Windows\System\fjbuaUV.exe
  2⤵
  PID:13184
- C:\Windows\System\QZvvmZz.exe
  C:\Windows\System\QZvvmZz.exe
  2⤵
  PID:13256
- C:\Windows\System\iMkuLYo.exe
  C:\Windows\System\iMkuLYo.exe
  2⤵
  PID:12396
- C:\Windows\System\IlOizqT.exe
  C:\Windows\System\IlOizqT.exe
  2⤵
  PID:12316
- C:\Windows\System\jhwMeRP.exe
  C:\Windows\System\jhwMeRP.exe
  2⤵
  PID:4516
- C:\Windows\System\JqQFQsY.exe
  C:\Windows\System\JqQFQsY.exe
  2⤵
  PID:12552
- C:\Windows\System\hqgmxKS.exe
  C:\Windows\System\hqgmxKS.exe
  2⤵
  PID:12796
- C:\Windows\System\WnBhFtW.exe
  C:\Windows\System\WnBhFtW.exe
  2⤵
  PID:12968
- C:\Windows\System\gEbKcOP.exe
  C:\Windows\System\gEbKcOP.exe
  2⤵
  PID:12888
- C:\Windows\System\ZzBaqPY.exe
  C:\Windows\System\ZzBaqPY.exe
  2⤵
  PID:13232
- C:\Windows\System\jobAeya.exe
  C:\Windows\System\jobAeya.exe
  2⤵
  PID:12404
- C:\Windows\System\kwnGnrL.exe
  C:\Windows\System\kwnGnrL.exe
  2⤵
  PID:12576
- C:\Windows\System\oaBUNBa.exe
  C:\Windows\System\oaBUNBa.exe
  2⤵
  PID:12756
- C:\Windows\System\OppLNxJ.exe
  C:\Windows\System\OppLNxJ.exe
  2⤵
  PID:13036
- C:\Windows\System\WtkXSHm.exe
  C:\Windows\System\WtkXSHm.exe
  2⤵
  PID:12988
- C:\Windows\System\TUEbqcc.exe
  C:\Windows\System\TUEbqcc.exe
  2⤵
  PID:2088
- C:\Windows\System\xpMXKzy.exe
  C:\Windows\System\xpMXKzy.exe
  2⤵
  PID:13340
- C:\Windows\System\nVuBqbn.exe
  C:\Windows\System\nVuBqbn.exe
  2⤵
  PID:13372
- C:\Windows\System\bileCFH.exe
  C:\Windows\System\bileCFH.exe
  2⤵
  PID:13400
- C:\Windows\System\xDkgthr.exe
  C:\Windows\System\xDkgthr.exe
  2⤵
  PID:13428
- C:\Windows\System\elsxAaj.exe
  C:\Windows\System\elsxAaj.exe
  2⤵
  PID:13456
- C:\Windows\System\jJMOZoC.exe
  C:\Windows\System\jJMOZoC.exe
  2⤵
  PID:13484
- C:\Windows\System\VZLApbi.exe
  C:\Windows\System\VZLApbi.exe
  2⤵
  PID:13516
- C:\Windows\System\nprYqhZ.exe
  C:\Windows\System\nprYqhZ.exe
  2⤵
  PID:13552
- C:\Windows\System\ijUONin.exe
  C:\Windows\System\ijUONin.exe
  2⤵
  PID:13568
- C:\Windows\System\xKZrZEg.exe
  C:\Windows\System\xKZrZEg.exe
  2⤵
  PID:13596
- C:\Windows\System\DQuawUJ.exe
  C:\Windows\System\DQuawUJ.exe
  2⤵
  PID:13628
- C:\Windows\System\cJMtvjA.exe
  C:\Windows\System\cJMtvjA.exe
  2⤵
  PID:13652
- C:\Windows\System\RXZvjmN.exe
  C:\Windows\System\RXZvjmN.exe
  2⤵
  PID:13680
- C:\Windows\System\BfweFkg.exe
  C:\Windows\System\BfweFkg.exe
  2⤵
  PID:13696
- C:\Windows\System\SGyizTG.exe
  C:\Windows\System\SGyizTG.exe
  2⤵
  PID:13728
- C:\Windows\System\GuvdTNN.exe
  C:\Windows\System\GuvdTNN.exe
  2⤵
  PID:13760
- C:\Windows\System\hszIpKx.exe
  C:\Windows\System\hszIpKx.exe
  2⤵
  PID:13804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z35qwm5l.0pn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BSQKdZq.exe

Filesize
2.7MB

MD5
dd5abc5d097012aeb83e421d9d8f06d9

SHA1
039ea70c20ef43c170ff92c2d5e343079f87b43e

SHA256
ffcb3940c3255711d4fe2f596160e29daf5c9ceed62455425d0ac6715678147e

SHA512
d6c1831b7c210f0c9c471d5c19fd699e89c787c41c51999fc2cbfa05e5a56b1514a5ebbb7232d913369710a990abc006f4b3829fa5ac25ec7d3ba353f92547b1

Download Submit
C:\Windows\System\CslVrLn.exe

Filesize
2.7MB

MD5
d6fd53ae1cfbd403f8d548ed30aa4ba3

SHA1
b3279644a4d013bf3863257a8ca228b428c46255

SHA256
87432ae661a101d2028a653fbaa09856e9d89f4f9128057eef5547404361585c

SHA512
77999a41434202e1f4965d3b2ce382baa38c34a96aa7eba066034c42c344e6bbcbecebf5f1fe5da21f2abc2d336388a2200184717423a5d20276d6c89f8bb5ff

Download Submit
C:\Windows\System\DjHJICy.exe

Filesize
2.7MB

MD5
01fbc7de0150abe8f6ff403577e04436

SHA1
5595b3f5ff6628250f6d07c671242654096600cc

SHA256
c73297594130ad63b8e3d582f1159919593e39efe906ddea24189056d6aa0e6e

SHA512
c876bbfcd20f5a888eedd97760eb6dbf22f3eb7d92033bf73386f1f282172434e1dcbbc2c70db20e2f8b00588d33ba959e693358fa1d01fb096e3d1fbb2b5538

Download Submit
C:\Windows\System\DzvbNgs.exe

Filesize
2.7MB

MD5
9631b97394e10c6694b4a23cd181c0b5

SHA1
599d26a8a6f1a9d353546f65acd355877f0d10bf

SHA256
1b0497ee0a8e868afe9a954eaf680de635102557891d560fc40c781f20a950c0

SHA512
4811d8d76bb889ae9b52ca2c0ecfd49a644151a40785c82ab3b50afdd89344b6379eeec04944a7e33b9fcf6acbd5ec87ca270dfd39445260be62ce26c7c09bcf

Download Submit
C:\Windows\System\FIlHufE.exe

Filesize
2.7MB

MD5
d0fe1a56a2940842979090a128b0b056

SHA1
edf11be502b31e2490e0af38f98be85379103aeb

SHA256
5df02d48aeb490a76520c30bcbe368fd55da502cc537a4b95ddc2fac86624e47

SHA512
b8fe146d29ba6ce58c049b81220db069bbfffc79a2a71e3343c07f556459540a81036ac9dfb96667f3500ee5f118e1745f99ef5a520044a34b20fbca948b91b4

Download Submit
C:\Windows\System\FfJYmDu.exe

Filesize
2.7MB

MD5
ea940a55493d7df1d0153688620a6d9b

SHA1
aca6f7a16bf6773d5f74fc03c473cad5e34d562b

SHA256
1d236f1cc103bab4e0d9b3a8666c2bf9014c5a6616cb94b3350f1b5d42715fe7

SHA512
a4910c6d1008fd23975b6efe56c9e78dc20787a98532e8c49c4bef2fd31abbefa8b763213a5f8837f99e400d311a99b1269ba23b9795adfd3ab4eafa2a086fca

Download Submit
C:\Windows\System\JeYSXjy.exe

Filesize
2.7MB

MD5
d1a60e1065e350451cc69c4b4d388707

SHA1
b7614834d8339053410b3f3b5c99dacd3d4a0842

SHA256
f67f87ba9ee8944afdb4e836154877824b51b613718a507b52386c685a7f8317

SHA512
ab7219670454aa905006ec0a493d919c2e39bffc90474bc5d9c61d718f690a1bb895de1d82871d50c05e37139a8e1f71b8843af18dbbcc741a9963a23a8ce607

Download Submit
C:\Windows\System\LEefLdf.exe

Filesize
2.7MB

MD5
179fb97d6d8bf3a31c402f2026c4893d

SHA1
7817f82637c1d3ab3ac05f262408ba0e3239be20

SHA256
cedd04f754734eeb66f511d1e9c3d8c11f94cb67d2a64aabe73c80e4020c1d9b

SHA512
fdd7937695f5c60dda1678d2aed64ca0d988b8848c233b8b16beda86a9dbd3b52b6251eaa0addd1a7520ecf06ec1b5894aecd2ff010382bf81342e7f6b05b512

Download Submit
C:\Windows\System\LYjWIxf.exe

Filesize
2.7MB

MD5
ffae5887c95da8ead5b4f959aebd1c5a

SHA1
cc1be0071462907f2121ecac4bcc2be46b84caa9

SHA256
62020394468524a269a8199477b6b32dd18d7db0b4b5511140555cfe940724c0

SHA512
890f924615fc79d18bef6d10eed62ac521462bd376412b974d29a2a5b649192087450be0041b48d061d935d9fd2e277871fd8e87bec72b4494f63730d1f3f968

Download Submit
C:\Windows\System\LjKIzok.exe

Filesize
2.7MB

MD5
6320651adab68287e6235839d7ea99b5

SHA1
ebf7b59fb01dd1e9aaa15baf7227eb63b20fd409

SHA256
5c16ed6f4f685be0c504f72935a7d56ca2f7afc77c7b21dd68b461ad24e43a85

SHA512
f69cabe3852c071f5ec0724f141e533bb4dde3f41a55e7f372f0a4f4ec77b106ac903f5bb9fdac4a2c0cbd6d7ecc00ccf3dcb70715c260394e0ca178c5512480

Download Submit
C:\Windows\System\MTDZlCp.exe

Filesize
2.7MB

MD5
5b1b98dc7f7849d215837fa368ab40de

SHA1
fc944501e5ecad14fae379455cf089561e158717

SHA256
1a243a1e503a93b9114544bca33468aeae5314a5c344a915103e0e0ddb13756f

SHA512
e64d9b8d7da47e72636f1095b2d212cde534c8cd9e4b5dbd09be88d1ea0a996f950bd582f86c661225cb6093b998c9e1672ac757419b2e341398a84d8309cf0b

Download Submit
C:\Windows\System\NqPPpBJ.exe

Filesize
2.7MB

MD5
f03f6a816cc82cb2e92e456c12eb5e80

SHA1
c70f35face5bbbab169daf123763201d6602878e

SHA256
716ff3ea2beae0c5504b3910c96f4e8a5af8beb06dffb355dff49020b4cf11d7

SHA512
23a377807848ec0cbe6f52b1dc1d211b333916879d0316be64d657dcfd44c0a580c79f015f8f0c1731bfe7538ff0ace9ee55ac8158c08c6b5a1a1b82627094df

Download Submit
C:\Windows\System\OZmMSsa.exe

Filesize
2.7MB

MD5
d334ec63950c8a8e959d5834799384c8

SHA1
9efdd3b952e6bb73e5bc73f9232a79d010e91b50

SHA256
a71a67e7436922bfdacad1f469a92a3b118d85b40f59cc47c9efdec862bc3bf9

SHA512
b2985ed8c9e96e33cfdc9300240884d5b518b47dfb2f72c297d27c11231e50b5a8d941e3ec879a3a3fac5bda60a714ed3a3633e1017360adf7aad1b2d2c9ea96

Download Submit
C:\Windows\System\PTZAvqu.exe

Filesize
2.7MB

MD5
84dab06497280de341cbbf9e76126ee8

SHA1
98a3a78e4cd13d8b26c7033b7846d98b1301da3d

SHA256
2ca633f5d11d37f44b9b3d321a36452d9c27d5382928469a5f73ebcd14e99abb

SHA512
02ab07b0a19fb16389a6802f86a3d64798ee31ff9908d4e76d6dc5a28823d2386eac08e14f259b8442be7986b20fb718647b694b129b356919c0509ebfc08a66

Download Submit
C:\Windows\System\QHgYeHd.exe

Filesize
2.7MB

MD5
e04185054088a716c5a58ba74c408ab6

SHA1
1445a161460fc5c362927d11c0f2d6610e9bfdca

SHA256
8ac08ce25dac13d0a4212d422341cea6cf40450f0dec15ef86f0725bf17e4c38

SHA512
692034d0de57bc54b2632b53b32f58a63ab6390721f84bdbab36fdf85f38793574eda6fbac5952dd9001667fd3dbb0e6d6eaa44b67bd41bb61a46f7f5c792072

Download Submit
C:\Windows\System\QWRqeJM.exe

Filesize
2.7MB

MD5
b905334455015bb7d5e8f6ff7cc4f09b

SHA1
bc190f396e34d8d4ce1131e8e3dbef40a88aad63

SHA256
34d4db1d6ec430db0fbac5e442e6b67f1082dea80ae8b995888d3a46e1d2618f

SHA512
3ffae6e66b538a505ab4ccea82689d47ef4af25673365ab3879ef83f2ea7eff04d169531917468b2119e2be48cd23f42517b48d49f126d93ae25602a549266de

Download Submit
C:\Windows\System\SJvYaFh.exe

Filesize
2.7MB

MD5
50ce6367111c9ab4deaae99f5f9ab460

SHA1
205539bcad971e9a4dccba7d95fd90165b88df7c

SHA256
c5c3d29aaf6f93823a430ebdd4f477cc83e060d329e834bc0195dce558dd286e

SHA512
a400b1133bac90ea6891960c1e9596d2c4ac4d4c73d6a8f7b6018d0340b5540c1a71942125f15df7000f86ee2a8cb16534f53231994d898a801d6c658ae6e6f4

Download Submit
C:\Windows\System\SPtQidO.exe

Filesize
2.7MB

MD5
f05288ab3e8a106ef1733eedb1a93ecb

SHA1
81f8a3f2aa71f3da0e616551b897ab78300b2aab

SHA256
f1e0c2783ef4d37251cb808805266b1fac0191cf89fc2341735e32cffc4f9a65

SHA512
59bddbbd7bddd3ad8ca6f62afdff5446894e2e444ecbd34f0a7dbbd0f67afce634b67c62ef24d51320ad5b4fba7d4ea7ae8d4fe4901cd2a06d783f3a8dcda15b

Download Submit
C:\Windows\System\SqDNwqg.exe

Filesize
2.7MB

MD5
f08851d192b8f2daeab669e770439737

SHA1
62c6e900741ece5d55c6be6af0e1c02a4a20b120

SHA256
b5d939bed645392fb252d65677f8905c710748b67f2f8377c58abd1def84a1ea

SHA512
991f539090a6602b06da8c1d132762493d3f8db7f21db0d020088b99084fa4373d20cf01c4884e86b68c770321e8f638c584310596be266799e73944aebbd5c6

Download Submit
C:\Windows\System\UhxECEH.exe

Filesize
2.7MB

MD5
ac8fb0e462dc7fbc810fa8d43299942a

SHA1
8b90d9ed57e18cb3fb4fe0c40cafd1bc3585579b

SHA256
c84f574f4f88a832b28fd0bf913c0ca67590e776095fe6d4454985653554127a

SHA512
c08bb7bf835a0bd279f6f10b53fc1a6c08649b5e0761d63064e4206446309eee79be9c53139b0d32f6b767474ca8c6d9c21a829986ea43ecbadc71450088ccc6

Download Submit
C:\Windows\System\WmFguHG.exe

Filesize
2.7MB

MD5
dac78fa084f93d8c99014601f74b4ec0

SHA1
87824fcba3e7ee51160595d73acb160401be5823

SHA256
829eb6012f2ec1e96b1e5baed51ac04e605f5aebc8244e6b5d242b70a4d6eae6

SHA512
da7a11856ad230cb78a6d3c6dc354c1df8567cf2ec1529a0fa312003b32ded24c4d1c85ae8c326a9a12cfbd538aa9a93e159d3a8e51fa0e9e00335935f61da80

Download Submit
C:\Windows\System\bmbJrCA.exe

Filesize
2.7MB

MD5
5784019425eac21afdb127a15c1a3f30

SHA1
10d7de9e4b60e0b993539fee21e117f0a6a153a7

SHA256
7ca61992840aee780ca304f225aab90591cb93800ecf08935b1d552a2262526b

SHA512
b7d5ba1d01e1afae97476ccc8df05ea93a14d0251293aa95b1ca518778a5c564a62e1dd1c58f245817ecd59c2901b0f239b27db04d717bdad1ed49c59ef873ba

Download Submit
C:\Windows\System\cqPKszX.exe

Filesize
2.7MB

MD5
2c9055f58ea405358417724c3b059f61

SHA1
cb19c356b7bbe993b10ff920db24cdb354da212c

SHA256
7726d1e1770032ffd2a396169ff8c7bd6d342b4b394d92c77a50d0349186c737

SHA512
7253ca5d4e348dd4e4f7c4f9df34b7f82d9a1357565bba3c104d4a870fb0a088ae60c23bc4a5411e587852498ad4abec7d03a908b19eb405dedcc08b10d12b83

Download Submit
C:\Windows\System\dQgzuzg.exe

Filesize
2.7MB

MD5
dda1b9bc5280a7c517b154daed2fa68c

SHA1
21201ea5cfa3e01e9d4ac9371988932a45c8e77b

SHA256
7fc2cba928deaca23bd2d93947276ee74e8ae6b861cbc8a03a2c04e717c120ce

SHA512
e5aaa0b454d6d17877c08581f57e0f07ee3eb792f0fa81696e95ca360217635d08cd9ef8f0854c9c63a63e2e9db150b7848c7658dcd664c34b610ff2bc360f19

Download Submit
C:\Windows\System\gECzpKx.exe

Filesize
2.7MB

MD5
dad8ef9d1c901176f5e3ac2cf35f52b9

SHA1
ecaf9897c1c5c1cc5b9bd4bbbbfde3bbec1d4704

SHA256
b369beeb74087523401fe664e2e5fec57175bd24eb93826318a8a695cac40baf

SHA512
998484a81d0ccdb38ee91541d2ebff75738f6ecc9d71aa852faf9e7c639e6d026a01d97c987df467960c1d05f0a2996790768dc564b6e49b5da52e105beabcf3

Download Submit
C:\Windows\System\gYFUjUv.exe

Filesize
2.7MB

MD5
60469e5f72bf92022d051c761a39fab0

SHA1
70a2dad2edeb0a4a844945a0d7ab65f064ff1ca6

SHA256
c4217993a45fcc4dbc78d8784ab5c3bd780321fad4c3a0861c177d36865006b3

SHA512
19134fe3bd6825141f801660b98780a5ad59874d14a68b2aca131586f3639cf0550ef60d3cca8f64511de36c2f773f3034f96c9a30a0d2087a0caf544857b396

Download Submit
C:\Windows\System\goQlshr.exe

Filesize
2.7MB

MD5
a123a973e6274dab3700ef36c80a222f

SHA1
7bfa4b805c2b5c6709a3380bcd8410221925fa1d

SHA256
eca0abacdde1fe89a23dd1499cfa8bf45cbf511fb102a82a5471f1d9f6bab43f

SHA512
a43be90eda5d8f8d3b5ac0cb1aaedb53a9e483e8ff8ef9f5084cd6f68328504b31f97a2cc688ed50d043b17e53cc4b4765bb25a76a413a00cdf2289d4b9e4490

Download Submit
C:\Windows\System\iNmZJpC.exe

Filesize
2.7MB

MD5
d12c21c3a085ed2c1cf5d2619cd552b5

SHA1
ccfb06c02d8ae745a1c9d657d723c951ee85eb3d

SHA256
bd8dce637eefe5138d6b591d7f5a419eab29a9e51389d3e79d3c76faf270cbe8

SHA512
d069f13f9a3b2a95cac31555bd95935df3f3ccdb58655d775949924a65270c8c7b7649c06caaafe3b253ea269828f679c26423b5f68158c90af3a36a79bba67b

Download Submit
C:\Windows\System\kFwahKm.exe

Filesize
2.7MB

MD5
10e9c7d1d7189d84d76226dc9828513a

SHA1
9fbc3012a24986a1d59dfe75fc6e518673bf9b91

SHA256
d6a7de7cfd6ab8899f882d8a13471249aa5db51aa1c67c726a5df7e0f5d3cfe3

SHA512
b8cee6e8ee839546ec0a8acabe05b72e744767bb6a7d619c8b966bc2a1c71eaac3350e9c99445487f443982700ede43cb161010a68e30da0009b7e1e767c3665

Download Submit
C:\Windows\System\mLUvlNY.exe

Filesize
8B

MD5
e71397695bfc95ac5fe1d82687725659

SHA1
45272317203fb987b8952f41b0170bd5a78944b0

SHA256
593106c260dc81c57565b84dcf164e3aba348716b31b67ed996f84e8eb33a8f2

SHA512
b0a8d0ea3899c2bbb7c006edeeb2ecf2f4894f56db8d8ff247c4e6fc5083c186ab234b2494615de540e99bc5dda8055b1dfec22d34c5a32a9febff889f810e0e

Download Submit
C:\Windows\System\oprpWeC.exe

Filesize
2.7MB

MD5
34a1a9505cd7798243bdcd34b3775802

SHA1
8fb9ed069bb9c1994f1d9d585d281320c5a96fbf

SHA256
0b1a5ef8f678849957abc45752828c63f88e5e25af5bb1bef4737fe84973b08e

SHA512
039d048ab64fe5a7dbb23b88743eb5a7df672500506044bc0b21c52c9139f17c562c996819e5e6b283b1f745262d865e1380cc8228308a6ee6d03f173d282fec

Download Submit
C:\Windows\System\pZFzSbt.exe

Filesize
2.7MB

MD5
bd902e76050c58a477ae3e86eb0f837e

SHA1
e07fcc9bf380c5a3eabff33ba003fbb752a538f2

SHA256
0996c4a9540ca94e671e118b1c813938a81d06a5f3cf68ca3a6951b9037fdd2d

SHA512
d167901733d13e7f0d852b3bd98ddda2f579aaf3b54417acb5a28eae65cc91ffc0bf3c8d465cc0a472f97bf5cb97492a8980fc1313aeca86bbafa94bcd9197e7

Download Submit
C:\Windows\System\yybSkad.exe

Filesize
2.7MB

MD5
5625497c9167a2b5e3fa56431719609a

SHA1
4f80cd783f93082529c46644e702da7e8e194a76

SHA256
49d26e4ce5815ddeb6ae5c60edd98a88942773f4984e451a916ad57a39c6e30d

SHA512
fc6bc48c15e0de361f7b3ba6df4a24742ccfaafd882ddfca6f54f15c92e274b56716d06e733b776fb260d204f235ebf3753737eb96b8265cadaa492232e1bd0a

Download Submit
C:\Windows\System\yzeIhit.exe

Filesize
2.7MB

MD5
88be1321bedc0b9c412b676b305c4be6

SHA1
3c5c06601ed3d36134eadfe4d7ac61e1e4052df9

SHA256
42db045094830226c92d2f1b109a4dd4588e4e15ca2af8c178c219cc1024f852

SHA512
5a193b46a122735bec0bf0529ee63a1db8a3fb85c9b204e1091c6797b90b43cd062e2e060b3511855976274bea601715595d3845a10e1e0001fbbb7e81c5b03b

Download Submit
memory/692-2465-0x00007FF604FA0000-0x00007FF605396000-memory.dmp

Filesize
4.0MB

Download
memory/692-138-0x00007FF604FA0000-0x00007FF605396000-memory.dmp

Filesize
4.0MB

Download
memory/1048-133-0x00007FF7159D0000-0x00007FF715DC6000-memory.dmp

Filesize
4.0MB

Download
memory/1048-2471-0x00007FF7159D0000-0x00007FF715DC6000-memory.dmp

Filesize
4.0MB

Download
memory/1508-2466-0x00007FF789BC0000-0x00007FF789FB6000-memory.dmp

Filesize
4.0MB

Download
memory/1508-137-0x00007FF789BC0000-0x00007FF789FB6000-memory.dmp

Filesize
4.0MB

Download
memory/1636-141-0x00007FF6D2F00000-0x00007FF6D32F6000-memory.dmp

Filesize
4.0MB

Download
memory/1636-2462-0x00007FF6D2F00000-0x00007FF6D32F6000-memory.dmp

Filesize
4.0MB

Download
memory/2104-2468-0x00007FF6D4B70000-0x00007FF6D4F66000-memory.dmp

Filesize
4.0MB

Download
memory/2104-135-0x00007FF6D4B70000-0x00007FF6D4F66000-memory.dmp

Filesize
4.0MB

Download
memory/2180-2464-0x00007FF787880000-0x00007FF787C76000-memory.dmp

Filesize
4.0MB

Download
memory/2180-139-0x00007FF787880000-0x00007FF787C76000-memory.dmp

Filesize
4.0MB

Download
memory/2196-2467-0x00007FF6C12E0000-0x00007FF6C16D6000-memory.dmp

Filesize
4.0MB

Download
memory/2196-136-0x00007FF6C12E0000-0x00007FF6C16D6000-memory.dmp

Filesize
4.0MB

Download
memory/2328-408-0x00007FF7390E0000-0x00007FF7394D6000-memory.dmp

Filesize
4.0MB

Download
memory/2328-2475-0x00007FF7390E0000-0x00007FF7394D6000-memory.dmp

Filesize
4.0MB

Download
memory/2356-2456-0x00007FF6BA910000-0x00007FF6BAD06000-memory.dmp

Filesize
4.0MB

Download
memory/2356-122-0x00007FF6BA910000-0x00007FF6BAD06000-memory.dmp

Filesize
4.0MB

Download
memory/2400-144-0x00007FF7641F0000-0x00007FF7645E6000-memory.dmp

Filesize
4.0MB

Download
memory/2400-2457-0x00007FF7641F0000-0x00007FF7645E6000-memory.dmp

Filesize
4.0MB

Download
memory/2444-2472-0x00007FF7B4810000-0x00007FF7B4C06000-memory.dmp

Filesize
4.0MB

Download
memory/2444-127-0x00007FF7B4810000-0x00007FF7B4C06000-memory.dmp

Filesize
4.0MB

Download
memory/2932-2473-0x00007FF79DFA0000-0x00007FF79E396000-memory.dmp

Filesize
4.0MB

Download
memory/2932-125-0x00007FF79DFA0000-0x00007FF79E396000-memory.dmp

Filesize
4.0MB

Download
memory/3248-2470-0x00007FF721D20000-0x00007FF722116000-memory.dmp

Filesize
4.0MB

Download
memory/3248-130-0x00007FF721D20000-0x00007FF722116000-memory.dmp

Filesize
4.0MB

Download
memory/3256-22-0x00007FFCEE413000-0x00007FFCEE415000-memory.dmp

Filesize
8KB

Download
memory/3256-373-0x000001FC7DB40000-0x000001FC7DD5C000-memory.dmp

Filesize
2.1MB

Download
memory/3256-61-0x00007FFCEE410000-0x00007FFCEEED1000-memory.dmp

Filesize
10.8MB

Download
memory/3256-116-0x000001FC7DE90000-0x000001FC7DEB2000-memory.dmp

Filesize
136KB

Download
memory/3256-148-0x000001FC7EAA0000-0x000001FC7F246000-memory.dmp

Filesize
7.6MB

Download
memory/3256-1153-0x00007FFCEE410000-0x00007FFCEEED1000-memory.dmp

Filesize
10.8MB

Download
memory/3256-100-0x00007FFCEE410000-0x00007FFCEEED1000-memory.dmp

Filesize
10.8MB

Download
memory/3256-1280-0x00007FFCEE413000-0x00007FFCEE415000-memory.dmp

Filesize
8KB

Download
memory/3300-2474-0x00007FF6BCDA0000-0x00007FF6BD196000-memory.dmp

Filesize
4.0MB

Download
memory/3300-146-0x00007FF6BCDA0000-0x00007FF6BD196000-memory.dmp

Filesize
4.0MB

Download
memory/3340-2469-0x00007FF795230000-0x00007FF795626000-memory.dmp

Filesize
4.0MB

Download
memory/3340-134-0x00007FF795230000-0x00007FF795626000-memory.dmp

Filesize
4.0MB

Download
memory/3688-2453-0x00007FF7E76E0000-0x00007FF7E7AD6000-memory.dmp

Filesize
4.0MB

Download
memory/3688-1135-0x00007FF7E76E0000-0x00007FF7E7AD6000-memory.dmp

Filesize
4.0MB

Download
memory/3688-8-0x00007FF7E76E0000-0x00007FF7E7AD6000-memory.dmp

Filesize
4.0MB

Download
memory/3708-140-0x00007FF6F6E80000-0x00007FF6F7276000-memory.dmp

Filesize
4.0MB

Download
memory/3708-2463-0x00007FF6F6E80000-0x00007FF6F7276000-memory.dmp

Filesize
4.0MB

Download
memory/4160-147-0x00007FF6FDD00000-0x00007FF6FE0F6000-memory.dmp

Filesize
4.0MB

Download
memory/4160-2460-0x00007FF6FDD00000-0x00007FF6FE0F6000-memory.dmp

Filesize
4.0MB

Download
memory/4188-1139-0x00007FF6016B0000-0x00007FF601AA6000-memory.dmp

Filesize
4.0MB

Download
memory/4188-2454-0x00007FF6016B0000-0x00007FF601AA6000-memory.dmp

Filesize
4.0MB

Download
memory/4188-21-0x00007FF6016B0000-0x00007FF601AA6000-memory.dmp

Filesize
4.0MB

Download
memory/4348-2461-0x00007FF77F9E0000-0x00007FF77FDD6000-memory.dmp

Filesize
4.0MB

Download
memory/4348-142-0x00007FF77F9E0000-0x00007FF77FDD6000-memory.dmp

Filesize
4.0MB

Download
memory/4412-1581-0x00007FF635760000-0x00007FF635B56000-memory.dmp

Filesize
4.0MB

Download
memory/4412-396-0x00007FF635760000-0x00007FF635B56000-memory.dmp

Filesize
4.0MB

Download
memory/4412-2476-0x00007FF635760000-0x00007FF635B56000-memory.dmp

Filesize
4.0MB

Download
memory/4604-143-0x00007FF700F00000-0x00007FF7012F6000-memory.dmp

Filesize
4.0MB

Download
memory/4604-2459-0x00007FF700F00000-0x00007FF7012F6000-memory.dmp

Filesize
4.0MB

Download
memory/4608-990-0x00007FF66D570000-0x00007FF66D966000-memory.dmp

Filesize
4.0MB

Download
memory/4608-0-0x00007FF66D570000-0x00007FF66D966000-memory.dmp

Filesize
4.0MB

Download
memory/4608-1-0x0000020090A10000-0x0000020090A20000-memory.dmp

Filesize
64KB

Download
memory/4640-1288-0x00007FF7395B0000-0x00007FF7399A6000-memory.dmp

Filesize
4.0MB

Download
memory/4640-27-0x00007FF7395B0000-0x00007FF7399A6000-memory.dmp

Filesize
4.0MB

Download
memory/4640-2455-0x00007FF7395B0000-0x00007FF7399A6000-memory.dmp

Filesize
4.0MB

Download
memory/4964-145-0x00007FF700E00000-0x00007FF7011F6000-memory.dmp

Filesize
4.0MB

Download
memory/4964-2458-0x00007FF700E00000-0x00007FF7011F6000-memory.dmp

Filesize
4.0MB

Download