xmrig | 6e25de4bfdc53db4470e54870660601fffd9a106e28aa294cfdb8cb4f1521fd0

Analysis

max time kernel
111s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1cbca49c859a8d7e1a703015295bb70N.exe
Size

2.8MB
MD5

b1cbca49c859a8d7e1a703015295bb70
SHA1

816f8980e035766670c7870795acfac0fd0510f5
SHA256

6e25de4bfdc53db4470e54870660601fffd9a106e28aa294cfdb8cb4f1521fd0
SHA512

818d4d44f8ee1bd2a05db6d59819b8f7dbbe9933948b0ac6a45141c03f366bc1d91d85e5c6799afe178330e88242b27e245cf16f1539bc815cd418f8a2adef5f
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BWgac+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RK

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2256-0-0x00007FF726360000-0x00007FF726756000-memory.dmp	xmrig
behavioral2/files/0x00080000000234c3-5.dat	xmrig
behavioral2/memory/3776-9-0x00007FF7E54D0000-0x00007FF7E58C6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234c5-14.dat	xmrig
behavioral2/files/0x00070000000234c7-29.dat	xmrig
behavioral2/files/0x00070000000234c9-48.dat	xmrig
behavioral2/files/0x00070000000234c8-50.dat	xmrig
behavioral2/memory/1064-57-0x00007FF6723B0000-0x00007FF6727A6000-memory.dmp	xmrig
behavioral2/memory/1700-59-0x00007FF644EF0000-0x00007FF6452E6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234cc-61.dat	xmrig
behavioral2/memory/320-63-0x00007FF655890000-0x00007FF655C86000-memory.dmp	xmrig
behavioral2/memory/684-60-0x00007FF7AD950000-0x00007FF7ADD46000-memory.dmp	xmrig
behavioral2/memory/2920-54-0x00007FF7E61F0000-0x00007FF7E65E6000-memory.dmp	xmrig
behavioral2/memory/3844-30-0x00007FF672AB0000-0x00007FF672EA6000-memory.dmp	xmrig
behavioral2/memory/3412-28-0x00007FF61C6C0000-0x00007FF61CAB6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234c6-22.dat	xmrig
behavioral2/files/0x00070000000234c4-19.dat	xmrig
behavioral2/files/0x00080000000234cb-68.dat	xmrig
behavioral2/memory/4980-72-0x00007FF6789B0000-0x00007FF678DA6000-memory.dmp	xmrig
behavioral2/files/0x00080000000234c1-75.dat	xmrig
behavioral2/memory/4700-84-0x00007FF6B2CD0000-0x00007FF6B30C6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234cd-89.dat	xmrig
behavioral2/files/0x00070000000234cf-95.dat	xmrig
behavioral2/files/0x00070000000234ce-97.dat	xmrig
behavioral2/memory/2748-96-0x00007FF7013B0000-0x00007FF7017A6000-memory.dmp	xmrig
behavioral2/memory/1388-92-0x00007FF617240000-0x00007FF617636000-memory.dmp	xmrig
behavioral2/files/0x00080000000234ca-87.dat	xmrig
behavioral2/memory/2592-77-0x00007FF7FA820000-0x00007FF7FAC16000-memory.dmp	xmrig
behavioral2/memory/2256-206-0x00007FF726360000-0x00007FF726756000-memory.dmp	xmrig
behavioral2/memory/3776-207-0x00007FF7E54D0000-0x00007FF7E58C6000-memory.dmp	xmrig
behavioral2/memory/2904-209-0x00007FF65EC50000-0x00007FF65F046000-memory.dmp	xmrig
behavioral2/files/0x00070000000234f7-231.dat	xmrig
behavioral2/files/0x00070000000234fd-289.dat	xmrig
behavioral2/files/0x0007000000023509-309.dat	xmrig
behavioral2/files/0x000700000002350d-318.dat	xmrig
behavioral2/memory/4396-348-0x00007FF772650000-0x00007FF772A46000-memory.dmp	xmrig
behavioral2/memory/4980-355-0x00007FF6789B0000-0x00007FF678DA6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023513-353.dat	xmrig
behavioral2/memory/4908-352-0x00007FF79F040000-0x00007FF79F436000-memory.dmp	xmrig
behavioral2/files/0x0007000000023510-344.dat	xmrig
behavioral2/memory/3204-336-0x00007FF7794F0000-0x00007FF7798E6000-memory.dmp	xmrig
behavioral2/memory/320-329-0x00007FF655890000-0x00007FF655C86000-memory.dmp	xmrig
behavioral2/memory/32-324-0x00007FF64A760000-0x00007FF64AB56000-memory.dmp	xmrig
behavioral2/memory/5080-317-0x00007FF69BAC0000-0x00007FF69BEB6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023507-311.dat	xmrig
behavioral2/memory/4360-305-0x00007FF7747F0000-0x00007FF774BE6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023502-303.dat	xmrig
behavioral2/memory/2836-302-0x00007FF783150000-0x00007FF783546000-memory.dmp	xmrig
behavioral2/files/0x00070000000234ff-291.dat	xmrig
behavioral2/files/0x00070000000234f9-288.dat	xmrig
behavioral2/memory/1892-272-0x00007FF6E0330000-0x00007FF6E0726000-memory.dmp	xmrig
behavioral2/memory/2208-266-0x00007FF77B5A0000-0x00007FF77B996000-memory.dmp	xmrig
behavioral2/memory/3320-262-0x00007FF7B9790000-0x00007FF7B9B86000-memory.dmp	xmrig
behavioral2/files/0x00070000000234d0-235.dat	xmrig
behavioral2/memory/2592-441-0x00007FF7FA820000-0x00007FF7FAC16000-memory.dmp	xmrig
behavioral2/files/0x0007000000023516-439.dat	xmrig
behavioral2/files/0x0007000000023550-448.dat	xmrig
behavioral2/files/0x000700000002354f-445.dat	xmrig
behavioral2/memory/4700-444-0x00007FF6B2CD0000-0x00007FF6B30C6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023551-455.dat	xmrig
behavioral2/files/0x0007000000023552-459.dat	xmrig
behavioral2/files/0x0007000000023553-468.dat	xmrig
behavioral2/files/0x0007000000023554-474.dat	xmrig
behavioral2/memory/1388-467-0x00007FF617240000-0x00007FF617636000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
7	3136	powershell.exe
9	3136	powershell.exe
14	3136	powershell.exe
15	3136	powershell.exe
17	3136	powershell.exe
23	3136	powershell.exe
24	3136	powershell.exe
33	3136	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3136	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3776	PtFSlzq.exe
2920	VXlJeZk.exe
3412	wvkbhtg.exe
3844	vJHGRFo.exe
1064	rEFjOXU.exe
684	UeXygAh.exe
1700	ffyoVKL.exe
320	wHzYcDU.exe
4980	gdEUXPR.exe
2592	GWMtNwP.exe
4700	GwVzxXk.exe
1388	uuassxv.exe
2748	ojAYUbn.exe
2904	FRkDHUf.exe
3320	BYCallF.exe
2836	HkGgiVG.exe
4360	hZwYvJp.exe
2208	CyuGlNu.exe
1892	hsjovCO.exe
32	vxMVGum.exe
5080	vUdGZzw.exe
3204	oqipQWU.exe
4396	IAMXYNE.exe
4908	DRFGcoa.exe
2752	csMmaEw.exe
1900	UwaIQSH.exe
764	TSNFcbm.exe
1312	duiRLHX.exe
4676	DdsvbCm.exe
3476	mFsVhtr.exe
2152	WRDDswF.exe
324	XsurDxH.exe
5004	JIQibux.exe
540	wbysvQt.exe
4500	SxrFnWE.exe
460	GuRMeNC.exe
1624	gvuIXvU.exe
2616	keJjSoL.exe
624	gcEbnrU.exe
4792	LPZaqeF.exe
1380	xuwFbaM.exe
3572	baGHfKe.exe
3660	KrnPDJP.exe
4728	RBTuZVk.exe
3288	zajpWWb.exe
4856	fHRoTLH.exe
3248	GROsmcA.exe
2988	xOExmFO.exe
1356	DFjAFoT.exe
3232	tvvSTnZ.exe
4300	tLvAykR.exe
228	DMRgfDJ.exe
4024	KPPXLhc.exe
3192	xfZuNOt.exe
4784	urRzMTj.exe
4176	zOjpmag.exe
2024	VVhtmub.exe
4316	RXwZXOc.exe
2288	TLDhkjb.exe
2896	MBJttOD.exe
2076	GUiGFQQ.exe
4628	ZVZjMBJ.exe
4052	ssJmZPU.exe
2304	uaoctEn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2256-0-0x00007FF726360000-0x00007FF726756000-memory.dmp	upx
behavioral2/files/0x00080000000234c3-5.dat	upx
behavioral2/memory/3776-9-0x00007FF7E54D0000-0x00007FF7E58C6000-memory.dmp	upx
behavioral2/files/0x00070000000234c5-14.dat	upx
behavioral2/files/0x00070000000234c7-29.dat	upx
behavioral2/files/0x00070000000234c9-48.dat	upx
behavioral2/files/0x00070000000234c8-50.dat	upx
behavioral2/memory/1064-57-0x00007FF6723B0000-0x00007FF6727A6000-memory.dmp	upx
behavioral2/memory/1700-59-0x00007FF644EF0000-0x00007FF6452E6000-memory.dmp	upx
behavioral2/files/0x00070000000234cc-61.dat	upx
behavioral2/memory/320-63-0x00007FF655890000-0x00007FF655C86000-memory.dmp	upx
behavioral2/memory/684-60-0x00007FF7AD950000-0x00007FF7ADD46000-memory.dmp	upx
behavioral2/memory/2920-54-0x00007FF7E61F0000-0x00007FF7E65E6000-memory.dmp	upx
behavioral2/memory/3844-30-0x00007FF672AB0000-0x00007FF672EA6000-memory.dmp	upx
behavioral2/memory/3412-28-0x00007FF61C6C0000-0x00007FF61CAB6000-memory.dmp	upx
behavioral2/files/0x00070000000234c6-22.dat	upx
behavioral2/files/0x00070000000234c4-19.dat	upx
behavioral2/files/0x00080000000234cb-68.dat	upx
behavioral2/memory/4980-72-0x00007FF6789B0000-0x00007FF678DA6000-memory.dmp	upx
behavioral2/files/0x00080000000234c1-75.dat	upx
behavioral2/memory/4700-84-0x00007FF6B2CD0000-0x00007FF6B30C6000-memory.dmp	upx
behavioral2/files/0x00070000000234cd-89.dat	upx
behavioral2/files/0x00070000000234cf-95.dat	upx
behavioral2/files/0x00070000000234ce-97.dat	upx
behavioral2/memory/2748-96-0x00007FF7013B0000-0x00007FF7017A6000-memory.dmp	upx
behavioral2/memory/1388-92-0x00007FF617240000-0x00007FF617636000-memory.dmp	upx
behavioral2/files/0x00080000000234ca-87.dat	upx
behavioral2/memory/2592-77-0x00007FF7FA820000-0x00007FF7FAC16000-memory.dmp	upx
behavioral2/memory/2256-206-0x00007FF726360000-0x00007FF726756000-memory.dmp	upx
behavioral2/memory/3776-207-0x00007FF7E54D0000-0x00007FF7E58C6000-memory.dmp	upx
behavioral2/memory/2904-209-0x00007FF65EC50000-0x00007FF65F046000-memory.dmp	upx
behavioral2/files/0x00070000000234f7-231.dat	upx
behavioral2/files/0x00070000000234fd-289.dat	upx
behavioral2/files/0x0007000000023509-309.dat	upx
behavioral2/files/0x000700000002350d-318.dat	upx
behavioral2/memory/4396-348-0x00007FF772650000-0x00007FF772A46000-memory.dmp	upx
behavioral2/memory/4980-355-0x00007FF6789B0000-0x00007FF678DA6000-memory.dmp	upx
behavioral2/files/0x0007000000023513-353.dat	upx
behavioral2/memory/4908-352-0x00007FF79F040000-0x00007FF79F436000-memory.dmp	upx
behavioral2/files/0x0007000000023510-344.dat	upx
behavioral2/memory/3204-336-0x00007FF7794F0000-0x00007FF7798E6000-memory.dmp	upx
behavioral2/memory/320-329-0x00007FF655890000-0x00007FF655C86000-memory.dmp	upx
behavioral2/memory/32-324-0x00007FF64A760000-0x00007FF64AB56000-memory.dmp	upx
behavioral2/memory/5080-317-0x00007FF69BAC0000-0x00007FF69BEB6000-memory.dmp	upx
behavioral2/files/0x0007000000023507-311.dat	upx
behavioral2/memory/4360-305-0x00007FF7747F0000-0x00007FF774BE6000-memory.dmp	upx
behavioral2/files/0x0007000000023502-303.dat	upx
behavioral2/memory/2836-302-0x00007FF783150000-0x00007FF783546000-memory.dmp	upx
behavioral2/files/0x00070000000234ff-291.dat	upx
behavioral2/files/0x00070000000234f9-288.dat	upx
behavioral2/memory/1892-272-0x00007FF6E0330000-0x00007FF6E0726000-memory.dmp	upx
behavioral2/memory/2208-266-0x00007FF77B5A0000-0x00007FF77B996000-memory.dmp	upx
behavioral2/memory/3320-262-0x00007FF7B9790000-0x00007FF7B9B86000-memory.dmp	upx
behavioral2/files/0x00070000000234d0-235.dat	upx
behavioral2/memory/2592-441-0x00007FF7FA820000-0x00007FF7FAC16000-memory.dmp	upx
behavioral2/files/0x0007000000023516-439.dat	upx
behavioral2/files/0x0007000000023550-448.dat	upx
behavioral2/files/0x000700000002354f-445.dat	upx
behavioral2/memory/4700-444-0x00007FF6B2CD0000-0x00007FF6B30C6000-memory.dmp	upx
behavioral2/files/0x0007000000023551-455.dat	upx
behavioral2/files/0x0007000000023552-459.dat	upx
behavioral2/files/0x0007000000023553-468.dat	upx
behavioral2/files/0x0007000000023554-474.dat	upx
behavioral2/memory/1388-467-0x00007FF617240000-0x00007FF617636000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vKCVeza.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\lKNNDan.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\oqipQWU.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\SUyQzfb.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\zfWJRJi.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\vIVAbRS.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\gfBtVJC.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\mnxfRTQ.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\ACoBDZN.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\EinHcoV.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\UJKjOHH.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\glUzBDG.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\KAYHIFT.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\nZKRzIJ.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\DkDENIa.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\BovRJPz.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\jtmyajB.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\nGWufUK.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\ZImRlhK.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\gDnFxYA.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\mJrlicE.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\wytpBBu.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\mcyoVFC.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\XzqScat.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\bBcccBK.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\wbysvQt.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\ncjIpOV.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\hYDGgUx.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\kTdvNMy.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\cHTRYfK.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\PYtIFxU.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\ogzgmWH.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\GwVzxXk.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\xuwFbaM.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\ZTJvleI.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\pdVRfqb.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\QPHugnh.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\jjYftak.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\uhGKUvt.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\torhtiv.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\lXeKMYL.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\hhhhibN.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\kKVFFGV.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\penfith.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\GXQzAgU.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\fLnXeJT.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\HHKmlNR.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\SwHgXcM.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\tqfoVTE.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\wBMDumT.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\xXxUZQN.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\XAHvPQJ.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\kRnOJFp.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\zajpWWb.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\IiCxZII.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\mrBVyqS.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\caLnacc.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\exQIOxN.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\FTKveoP.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\vYHOIoW.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\UofiAZj.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\jCXCtLN.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\lDZhlea.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\DcxMHqR.exe	b1cbca49c859a8d7e1a703015295bb70N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3136	powershell.exe
3136	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2256	b1cbca49c859a8d7e1a703015295bb70N.exe
Token: SeLockMemoryPrivilege	2256	b1cbca49c859a8d7e1a703015295bb70N.exe
Token: SeDebugPrivilege	3136	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3136	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	85
PID 2256 wrote to memory of 3136	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	85
PID 2256 wrote to memory of 3776	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	86
PID 2256 wrote to memory of 3776	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	86
PID 2256 wrote to memory of 2920	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	87
PID 2256 wrote to memory of 2920	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	87
PID 2256 wrote to memory of 3412	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	88
PID 2256 wrote to memory of 3412	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	88
PID 2256 wrote to memory of 3844	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	89
PID 2256 wrote to memory of 3844	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	89
PID 2256 wrote to memory of 1064	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	90
PID 2256 wrote to memory of 1064	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	90
PID 2256 wrote to memory of 684	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	91
PID 2256 wrote to memory of 684	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	91
PID 2256 wrote to memory of 1700	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	92
PID 2256 wrote to memory of 1700	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	92
PID 2256 wrote to memory of 320	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	93
PID 2256 wrote to memory of 320	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	93
PID 2256 wrote to memory of 4980	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	94
PID 2256 wrote to memory of 4980	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	94
PID 2256 wrote to memory of 2592	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	95
PID 2256 wrote to memory of 2592	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	95
PID 2256 wrote to memory of 4700	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	96
PID 2256 wrote to memory of 4700	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	96
PID 2256 wrote to memory of 1388	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	97
PID 2256 wrote to memory of 1388	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	97
PID 2256 wrote to memory of 2748	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	98
PID 2256 wrote to memory of 2748	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	98
PID 2256 wrote to memory of 2904	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	99
PID 2256 wrote to memory of 2904	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	99
PID 2256 wrote to memory of 3320	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	100
PID 2256 wrote to memory of 3320	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	100
PID 2256 wrote to memory of 2836	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	101
PID 2256 wrote to memory of 2836	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	101
PID 2256 wrote to memory of 4360	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	102
PID 2256 wrote to memory of 4360	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	102
PID 2256 wrote to memory of 2208	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	104
PID 2256 wrote to memory of 2208	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	104
PID 2256 wrote to memory of 1892	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	105
PID 2256 wrote to memory of 1892	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	105
PID 2256 wrote to memory of 32	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	106
PID 2256 wrote to memory of 32	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	106
PID 2256 wrote to memory of 5080	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	107
PID 2256 wrote to memory of 5080	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	107
PID 2256 wrote to memory of 3204	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	108
PID 2256 wrote to memory of 3204	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	108
PID 2256 wrote to memory of 4396	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	109
PID 2256 wrote to memory of 4396	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	109
PID 2256 wrote to memory of 4908	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	110
PID 2256 wrote to memory of 4908	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	110
PID 2256 wrote to memory of 2752	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	111
PID 2256 wrote to memory of 2752	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	111
PID 2256 wrote to memory of 1900	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	112
PID 2256 wrote to memory of 1900	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	112
PID 2256 wrote to memory of 764	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	116
PID 2256 wrote to memory of 764	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	116
PID 2256 wrote to memory of 1312	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	118
PID 2256 wrote to memory of 1312	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	118
PID 2256 wrote to memory of 4676	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	119
PID 2256 wrote to memory of 4676	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	119
PID 2256 wrote to memory of 3476	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	120
PID 2256 wrote to memory of 3476	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	120
PID 2256 wrote to memory of 2152	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	121
PID 2256 wrote to memory of 2152	2256	b1cbca49c859a8d7e1a703015295bb70N.exe	121

C:\Users\Admin\AppData\Local\Temp\b1cbca49c859a8d7e1a703015295bb70N.exe
"C:\Users\Admin\AppData\Local\Temp\b1cbca49c859a8d7e1a703015295bb70N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Windows\System\PtFSlzq.exe
  C:\Windows\System\PtFSlzq.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\VXlJeZk.exe
  C:\Windows\System\VXlJeZk.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\wvkbhtg.exe
  C:\Windows\System\wvkbhtg.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\vJHGRFo.exe
  C:\Windows\System\vJHGRFo.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\rEFjOXU.exe
  C:\Windows\System\rEFjOXU.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\UeXygAh.exe
  C:\Windows\System\UeXygAh.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\ffyoVKL.exe
  C:\Windows\System\ffyoVKL.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\wHzYcDU.exe
  C:\Windows\System\wHzYcDU.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\gdEUXPR.exe
  C:\Windows\System\gdEUXPR.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\GWMtNwP.exe
  C:\Windows\System\GWMtNwP.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\GwVzxXk.exe
  C:\Windows\System\GwVzxXk.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\uuassxv.exe
  C:\Windows\System\uuassxv.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\ojAYUbn.exe
  C:\Windows\System\ojAYUbn.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\FRkDHUf.exe
  C:\Windows\System\FRkDHUf.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\BYCallF.exe
  C:\Windows\System\BYCallF.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\HkGgiVG.exe
  C:\Windows\System\HkGgiVG.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\hZwYvJp.exe
  C:\Windows\System\hZwYvJp.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\CyuGlNu.exe
  C:\Windows\System\CyuGlNu.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\hsjovCO.exe
  C:\Windows\System\hsjovCO.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\vxMVGum.exe
  C:\Windows\System\vxMVGum.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\vUdGZzw.exe
  C:\Windows\System\vUdGZzw.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\oqipQWU.exe
  C:\Windows\System\oqipQWU.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\IAMXYNE.exe
  C:\Windows\System\IAMXYNE.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\DRFGcoa.exe
  C:\Windows\System\DRFGcoa.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\csMmaEw.exe
  C:\Windows\System\csMmaEw.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\UwaIQSH.exe
  C:\Windows\System\UwaIQSH.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\TSNFcbm.exe
  C:\Windows\System\TSNFcbm.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\duiRLHX.exe
  C:\Windows\System\duiRLHX.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\DdsvbCm.exe
  C:\Windows\System\DdsvbCm.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\mFsVhtr.exe
  C:\Windows\System\mFsVhtr.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\WRDDswF.exe
  C:\Windows\System\WRDDswF.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\XsurDxH.exe
  C:\Windows\System\XsurDxH.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\JIQibux.exe
  C:\Windows\System\JIQibux.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\wbysvQt.exe
  C:\Windows\System\wbysvQt.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\SxrFnWE.exe
  C:\Windows\System\SxrFnWE.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\GuRMeNC.exe
  C:\Windows\System\GuRMeNC.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\gvuIXvU.exe
  C:\Windows\System\gvuIXvU.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\keJjSoL.exe
  C:\Windows\System\keJjSoL.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\gcEbnrU.exe
  C:\Windows\System\gcEbnrU.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\LPZaqeF.exe
  C:\Windows\System\LPZaqeF.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\xuwFbaM.exe
  C:\Windows\System\xuwFbaM.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\baGHfKe.exe
  C:\Windows\System\baGHfKe.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\KrnPDJP.exe
  C:\Windows\System\KrnPDJP.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\RBTuZVk.exe
  C:\Windows\System\RBTuZVk.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\zajpWWb.exe
  C:\Windows\System\zajpWWb.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\fHRoTLH.exe
  C:\Windows\System\fHRoTLH.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\GROsmcA.exe
  C:\Windows\System\GROsmcA.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\xOExmFO.exe
  C:\Windows\System\xOExmFO.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\DFjAFoT.exe
  C:\Windows\System\DFjAFoT.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\tvvSTnZ.exe
  C:\Windows\System\tvvSTnZ.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\tLvAykR.exe
  C:\Windows\System\tLvAykR.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\DMRgfDJ.exe
  C:\Windows\System\DMRgfDJ.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\KPPXLhc.exe
  C:\Windows\System\KPPXLhc.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\xfZuNOt.exe
  C:\Windows\System\xfZuNOt.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\urRzMTj.exe
  C:\Windows\System\urRzMTj.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\zOjpmag.exe
  C:\Windows\System\zOjpmag.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\VVhtmub.exe
  C:\Windows\System\VVhtmub.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\RXwZXOc.exe
  C:\Windows\System\RXwZXOc.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\TLDhkjb.exe
  C:\Windows\System\TLDhkjb.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\MBJttOD.exe
  C:\Windows\System\MBJttOD.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\GUiGFQQ.exe
  C:\Windows\System\GUiGFQQ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\ZVZjMBJ.exe
  C:\Windows\System\ZVZjMBJ.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\ssJmZPU.exe
  C:\Windows\System\ssJmZPU.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\uaoctEn.exe
  C:\Windows\System\uaoctEn.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\fNNCViQ.exe
  C:\Windows\System\fNNCViQ.exe
  2⤵
  PID:3276
- C:\Windows\System\gdsyunQ.exe
  C:\Windows\System\gdsyunQ.exe
  2⤵
  PID:2056
- C:\Windows\System\ugjaugl.exe
  C:\Windows\System\ugjaugl.exe
  2⤵
  PID:3180
- C:\Windows\System\CGDHTBw.exe
  C:\Windows\System\CGDHTBw.exe
  2⤵
  PID:3300
- C:\Windows\System\qHVfDJo.exe
  C:\Windows\System\qHVfDJo.exe
  2⤵
  PID:5136
- C:\Windows\System\pdLpxKW.exe
  C:\Windows\System\pdLpxKW.exe
  2⤵
  PID:5164
- C:\Windows\System\bvgjUYR.exe
  C:\Windows\System\bvgjUYR.exe
  2⤵
  PID:5196
- C:\Windows\System\ebmRvew.exe
  C:\Windows\System\ebmRvew.exe
  2⤵
  PID:5228
- C:\Windows\System\zbffobU.exe
  C:\Windows\System\zbffobU.exe
  2⤵
  PID:5244
- C:\Windows\System\pxNSoOb.exe
  C:\Windows\System\pxNSoOb.exe
  2⤵
  PID:5272
- C:\Windows\System\NePOjiq.exe
  C:\Windows\System\NePOjiq.exe
  2⤵
  PID:5308
- C:\Windows\System\fLnXeJT.exe
  C:\Windows\System\fLnXeJT.exe
  2⤵
  PID:5328
- C:\Windows\System\IiCxZII.exe
  C:\Windows\System\IiCxZII.exe
  2⤵
  PID:5368
- C:\Windows\System\hpabipI.exe
  C:\Windows\System\hpabipI.exe
  2⤵
  PID:5396
- C:\Windows\System\mrBVyqS.exe
  C:\Windows\System\mrBVyqS.exe
  2⤵
  PID:5428
- C:\Windows\System\dzzWYCh.exe
  C:\Windows\System\dzzWYCh.exe
  2⤵
  PID:5456
- C:\Windows\System\riMCams.exe
  C:\Windows\System\riMCams.exe
  2⤵
  PID:5484
- C:\Windows\System\DOfgHXX.exe
  C:\Windows\System\DOfgHXX.exe
  2⤵
  PID:5500
- C:\Windows\System\DNBKsgL.exe
  C:\Windows\System\DNBKsgL.exe
  2⤵
  PID:5536
- C:\Windows\System\CvDzHna.exe
  C:\Windows\System\CvDzHna.exe
  2⤵
  PID:5560
- C:\Windows\System\nZKRzIJ.exe
  C:\Windows\System\nZKRzIJ.exe
  2⤵
  PID:5584
- C:\Windows\System\jpPOeGV.exe
  C:\Windows\System\jpPOeGV.exe
  2⤵
  PID:5624
- C:\Windows\System\mJrlicE.exe
  C:\Windows\System\mJrlicE.exe
  2⤵
  PID:5652
- C:\Windows\System\QAardUT.exe
  C:\Windows\System\QAardUT.exe
  2⤵
  PID:5680
- C:\Windows\System\iIBkWzh.exe
  C:\Windows\System\iIBkWzh.exe
  2⤵
  PID:5700
- C:\Windows\System\SatifVl.exe
  C:\Windows\System\SatifVl.exe
  2⤵
  PID:5724
- C:\Windows\System\hHNKKoa.exe
  C:\Windows\System\hHNKKoa.exe
  2⤵
  PID:5760
- C:\Windows\System\MQtMNLh.exe
  C:\Windows\System\MQtMNLh.exe
  2⤵
  PID:5788
- C:\Windows\System\UyzSLUI.exe
  C:\Windows\System\UyzSLUI.exe
  2⤵
  PID:5824
- C:\Windows\System\cGEgfey.exe
  C:\Windows\System\cGEgfey.exe
  2⤵
  PID:5852
- C:\Windows\System\xNKpDMH.exe
  C:\Windows\System\xNKpDMH.exe
  2⤵
  PID:5876
- C:\Windows\System\twiNfZX.exe
  C:\Windows\System\twiNfZX.exe
  2⤵
  PID:5908
- C:\Windows\System\tqfoVTE.exe
  C:\Windows\System\tqfoVTE.exe
  2⤵
  PID:5932
- C:\Windows\System\dYWkBlP.exe
  C:\Windows\System\dYWkBlP.exe
  2⤵
  PID:5964
- C:\Windows\System\HVfPOpP.exe
  C:\Windows\System\HVfPOpP.exe
  2⤵
  PID:5992
- C:\Windows\System\boxvYnf.exe
  C:\Windows\System\boxvYnf.exe
  2⤵
  PID:6024
- C:\Windows\System\XPcsoSg.exe
  C:\Windows\System\XPcsoSg.exe
  2⤵
  PID:6048
- C:\Windows\System\XTpYFxA.exe
  C:\Windows\System\XTpYFxA.exe
  2⤵
  PID:6076
- C:\Windows\System\TIrueyM.exe
  C:\Windows\System\TIrueyM.exe
  2⤵
  PID:6104
- C:\Windows\System\brlurBq.exe
  C:\Windows\System\brlurBq.exe
  2⤵
  PID:6128
- C:\Windows\System\HEoQnGl.exe
  C:\Windows\System\HEoQnGl.exe
  2⤵
  PID:5124
- C:\Windows\System\ZepxfOJ.exe
  C:\Windows\System\ZepxfOJ.exe
  2⤵
  PID:5188
- C:\Windows\System\ppvbGld.exe
  C:\Windows\System\ppvbGld.exe
  2⤵
  PID:5264
- C:\Windows\System\gWhlbuZ.exe
  C:\Windows\System\gWhlbuZ.exe
  2⤵
  PID:5324
- C:\Windows\System\lDplWyF.exe
  C:\Windows\System\lDplWyF.exe
  2⤵
  PID:5384
- C:\Windows\System\xyoxvym.exe
  C:\Windows\System\xyoxvym.exe
  2⤵
  PID:5476
- C:\Windows\System\UCZVIUq.exe
  C:\Windows\System\UCZVIUq.exe
  2⤵
  PID:5528
- C:\Windows\System\aOzwhgk.exe
  C:\Windows\System\aOzwhgk.exe
  2⤵
  PID:5604
- C:\Windows\System\NjrQNcK.exe
  C:\Windows\System\NjrQNcK.exe
  2⤵
  PID:5676
- C:\Windows\System\QmYXfNI.exe
  C:\Windows\System\QmYXfNI.exe
  2⤵
  PID:5752
- C:\Windows\System\RHNFhSb.exe
  C:\Windows\System\RHNFhSb.exe
  2⤵
  PID:5808
- C:\Windows\System\ncjIpOV.exe
  C:\Windows\System\ncjIpOV.exe
  2⤵
  PID:5900
- C:\Windows\System\exefqAZ.exe
  C:\Windows\System\exefqAZ.exe
  2⤵
  PID:5928
- C:\Windows\System\Avlpedn.exe
  C:\Windows\System\Avlpedn.exe
  2⤵
  PID:6004
- C:\Windows\System\QbiMqWa.exe
  C:\Windows\System\QbiMqWa.exe
  2⤵
  PID:6068
- C:\Windows\System\xUwxVCz.exe
  C:\Windows\System\xUwxVCz.exe
  2⤵
  PID:6112
- C:\Windows\System\uAnspxX.exe
  C:\Windows\System\uAnspxX.exe
  2⤵
  PID:5180
- C:\Windows\System\qdeZHzh.exe
  C:\Windows\System\qdeZHzh.exe
  2⤵
  PID:5420
- C:\Windows\System\yNZTCxX.exe
  C:\Windows\System\yNZTCxX.exe
  2⤵
  PID:5468
- C:\Windows\System\arlEKmb.exe
  C:\Windows\System\arlEKmb.exe
  2⤵
  PID:5692
- C:\Windows\System\xLavgNH.exe
  C:\Windows\System\xLavgNH.exe
  2⤵
  PID:5784
- C:\Windows\System\StiGeHm.exe
  C:\Windows\System\StiGeHm.exe
  2⤵
  PID:5868
- C:\Windows\System\rFUdWGH.exe
  C:\Windows\System\rFUdWGH.exe
  2⤵
  PID:6084
- C:\Windows\System\YjDPRuW.exe
  C:\Windows\System\YjDPRuW.exe
  2⤵
  PID:5288
- C:\Windows\System\wBMDumT.exe
  C:\Windows\System\wBMDumT.exe
  2⤵
  PID:5848
- C:\Windows\System\HwAdGUW.exe
  C:\Windows\System\HwAdGUW.exe
  2⤵
  PID:5356
- C:\Windows\System\QTTwQud.exe
  C:\Windows\System\QTTwQud.exe
  2⤵
  PID:6092
- C:\Windows\System\slPtffy.exe
  C:\Windows\System\slPtffy.exe
  2⤵
  PID:5648
- C:\Windows\System\cIqIyWj.exe
  C:\Windows\System\cIqIyWj.exe
  2⤵
  PID:6160
- C:\Windows\System\YcCEhtf.exe
  C:\Windows\System\YcCEhtf.exe
  2⤵
  PID:6180
- C:\Windows\System\tGZVPML.exe
  C:\Windows\System\tGZVPML.exe
  2⤵
  PID:6224
- C:\Windows\System\INiEbRi.exe
  C:\Windows\System\INiEbRi.exe
  2⤵
  PID:6256
- C:\Windows\System\YVVzkEM.exe
  C:\Windows\System\YVVzkEM.exe
  2⤵
  PID:6280
- C:\Windows\System\PFSlNnF.exe
  C:\Windows\System\PFSlNnF.exe
  2⤵
  PID:6304
- C:\Windows\System\htSnqUf.exe
  C:\Windows\System\htSnqUf.exe
  2⤵
  PID:6340
- C:\Windows\System\hcPjorT.exe
  C:\Windows\System\hcPjorT.exe
  2⤵
  PID:6356
- C:\Windows\System\KJxxswH.exe
  C:\Windows\System\KJxxswH.exe
  2⤵
  PID:6388
- C:\Windows\System\DkDENIa.exe
  C:\Windows\System\DkDENIa.exe
  2⤵
  PID:6408
- C:\Windows\System\pamViNo.exe
  C:\Windows\System\pamViNo.exe
  2⤵
  PID:6444
- C:\Windows\System\unELwaa.exe
  C:\Windows\System\unELwaa.exe
  2⤵
  PID:6468
- C:\Windows\System\OlApAFz.exe
  C:\Windows\System\OlApAFz.exe
  2⤵
  PID:6500
- C:\Windows\System\wQInSBn.exe
  C:\Windows\System\wQInSBn.exe
  2⤵
  PID:6536
- C:\Windows\System\poYCCNS.exe
  C:\Windows\System\poYCCNS.exe
  2⤵
  PID:6552
- C:\Windows\System\vIVAbRS.exe
  C:\Windows\System\vIVAbRS.exe
  2⤵
  PID:6580
- C:\Windows\System\jbXmPFR.exe
  C:\Windows\System\jbXmPFR.exe
  2⤵
  PID:6636
- C:\Windows\System\MnKvkHc.exe
  C:\Windows\System\MnKvkHc.exe
  2⤵
  PID:6668
- C:\Windows\System\uhGKUvt.exe
  C:\Windows\System\uhGKUvt.exe
  2⤵
  PID:6708
- C:\Windows\System\bEXDoHf.exe
  C:\Windows\System\bEXDoHf.exe
  2⤵
  PID:6740
- C:\Windows\System\FugHITT.exe
  C:\Windows\System\FugHITT.exe
  2⤵
  PID:6756
- C:\Windows\System\bVpSnge.exe
  C:\Windows\System\bVpSnge.exe
  2⤵
  PID:6796
- C:\Windows\System\AhSkowF.exe
  C:\Windows\System\AhSkowF.exe
  2⤵
  PID:6824
- C:\Windows\System\tJXjNMj.exe
  C:\Windows\System\tJXjNMj.exe
  2⤵
  PID:6840
- C:\Windows\System\hYDGgUx.exe
  C:\Windows\System\hYDGgUx.exe
  2⤵
  PID:6880
- C:\Windows\System\oGbQdQZ.exe
  C:\Windows\System\oGbQdQZ.exe
  2⤵
  PID:6896
- C:\Windows\System\uwliNdS.exe
  C:\Windows\System\uwliNdS.exe
  2⤵
  PID:6936
- C:\Windows\System\fOrhkxR.exe
  C:\Windows\System\fOrhkxR.exe
  2⤵
  PID:6964
- C:\Windows\System\UYpLHiK.exe
  C:\Windows\System\UYpLHiK.exe
  2⤵
  PID:6996
- C:\Windows\System\aOrStOO.exe
  C:\Windows\System\aOrStOO.exe
  2⤵
  PID:7020
- C:\Windows\System\bGvgfXX.exe
  C:\Windows\System\bGvgfXX.exe
  2⤵
  PID:7040
- C:\Windows\System\xVgXvPx.exe
  C:\Windows\System\xVgXvPx.exe
  2⤵
  PID:7060
- C:\Windows\System\ewoOgVf.exe
  C:\Windows\System\ewoOgVf.exe
  2⤵
  PID:7084
- C:\Windows\System\jjntnqe.exe
  C:\Windows\System\jjntnqe.exe
  2⤵
  PID:7104
- C:\Windows\System\TmxBtPl.exe
  C:\Windows\System\TmxBtPl.exe
  2⤵
  PID:6152
- C:\Windows\System\XHyoWjZ.exe
  C:\Windows\System\XHyoWjZ.exe
  2⤵
  PID:6192
- C:\Windows\System\LhTsyQM.exe
  C:\Windows\System\LhTsyQM.exe
  2⤵
  PID:6276
- C:\Windows\System\wytpBBu.exe
  C:\Windows\System\wytpBBu.exe
  2⤵
  PID:6316
- C:\Windows\System\kQctSpE.exe
  C:\Windows\System\kQctSpE.exe
  2⤵
  PID:6376
- C:\Windows\System\OHDVFYI.exe
  C:\Windows\System\OHDVFYI.exe
  2⤵
  PID:6480
- C:\Windows\System\RldgMZi.exe
  C:\Windows\System\RldgMZi.exe
  2⤵
  PID:6548
- C:\Windows\System\iZCWdhi.exe
  C:\Windows\System\iZCWdhi.exe
  2⤵
  PID:3200
- C:\Windows\System\gjuzrKA.exe
  C:\Windows\System\gjuzrKA.exe
  2⤵
  PID:6664
- C:\Windows\System\HHKmlNR.exe
  C:\Windows\System\HHKmlNR.exe
  2⤵
  PID:6728
- C:\Windows\System\ZYKJVpG.exe
  C:\Windows\System\ZYKJVpG.exe
  2⤵
  PID:6792
- C:\Windows\System\fZWBtDR.exe
  C:\Windows\System\fZWBtDR.exe
  2⤵
  PID:6876
- C:\Windows\System\lsxJfPH.exe
  C:\Windows\System\lsxJfPH.exe
  2⤵
  PID:6952
- C:\Windows\System\ViVEUOW.exe
  C:\Windows\System\ViVEUOW.exe
  2⤵
  PID:7056
- C:\Windows\System\pfJtDLQ.exe
  C:\Windows\System\pfJtDLQ.exe
  2⤵
  PID:7120
- C:\Windows\System\iDURCMe.exe
  C:\Windows\System\iDURCMe.exe
  2⤵
  PID:6168
- C:\Windows\System\XzqScat.exe
  C:\Windows\System\XzqScat.exe
  2⤵
  PID:6352
- C:\Windows\System\TmqkvBk.exe
  C:\Windows\System\TmqkvBk.exe
  2⤵
  PID:7028
- C:\Windows\System\gaUOYab.exe
  C:\Windows\System\gaUOYab.exe
  2⤵
  PID:6644
- C:\Windows\System\AVIeEgZ.exe
  C:\Windows\System\AVIeEgZ.exe
  2⤵
  PID:6704
- C:\Windows\System\cnMGJjh.exe
  C:\Windows\System\cnMGJjh.exe
  2⤵
  PID:6856
- C:\Windows\System\ljsLXYc.exe
  C:\Windows\System\ljsLXYc.exe
  2⤵
  PID:7076
- C:\Windows\System\sMOHAta.exe
  C:\Windows\System\sMOHAta.exe
  2⤵
  PID:7048
- C:\Windows\System\NwWGvBA.exe
  C:\Windows\System\NwWGvBA.exe
  2⤵
  PID:2108
- C:\Windows\System\BJxYuFu.exe
  C:\Windows\System\BJxYuFu.exe
  2⤵
  PID:6976
- C:\Windows\System\WNDVzXn.exe
  C:\Windows\System\WNDVzXn.exe
  2⤵
  PID:6836
- C:\Windows\System\jtpkpHi.exe
  C:\Windows\System\jtpkpHi.exe
  2⤵
  PID:6464
- C:\Windows\System\FItydcn.exe
  C:\Windows\System\FItydcn.exe
  2⤵
  PID:7192
- C:\Windows\System\aiXzPAH.exe
  C:\Windows\System\aiXzPAH.exe
  2⤵
  PID:7208
- C:\Windows\System\nIFuMlc.exe
  C:\Windows\System\nIFuMlc.exe
  2⤵
  PID:7228
- C:\Windows\System\rZknyWN.exe
  C:\Windows\System\rZknyWN.exe
  2⤵
  PID:7276
- C:\Windows\System\ZJjDZRp.exe
  C:\Windows\System\ZJjDZRp.exe
  2⤵
  PID:7304
- C:\Windows\System\QVMEuWi.exe
  C:\Windows\System\QVMEuWi.exe
  2⤵
  PID:7320
- C:\Windows\System\torhtiv.exe
  C:\Windows\System\torhtiv.exe
  2⤵
  PID:7364
- C:\Windows\System\HxNbfyk.exe
  C:\Windows\System\HxNbfyk.exe
  2⤵
  PID:7388
- C:\Windows\System\aGouvbV.exe
  C:\Windows\System\aGouvbV.exe
  2⤵
  PID:7404
- C:\Windows\System\oMtOXFu.exe
  C:\Windows\System\oMtOXFu.exe
  2⤵
  PID:7444
- C:\Windows\System\ZTJvleI.exe
  C:\Windows\System\ZTJvleI.exe
  2⤵
  PID:7476
- C:\Windows\System\ZyMTJjV.exe
  C:\Windows\System\ZyMTJjV.exe
  2⤵
  PID:7504
- C:\Windows\System\aWetkgs.exe
  C:\Windows\System\aWetkgs.exe
  2⤵
  PID:7528
- C:\Windows\System\qsnIGRv.exe
  C:\Windows\System\qsnIGRv.exe
  2⤵
  PID:7556
- C:\Windows\System\mphiVFK.exe
  C:\Windows\System\mphiVFK.exe
  2⤵
  PID:7584
- C:\Windows\System\mUxcuUY.exe
  C:\Windows\System\mUxcuUY.exe
  2⤵
  PID:7616
- C:\Windows\System\siCRnaa.exe
  C:\Windows\System\siCRnaa.exe
  2⤵
  PID:7640
- C:\Windows\System\rTTwyOn.exe
  C:\Windows\System\rTTwyOn.exe
  2⤵
  PID:7672
- C:\Windows\System\thimnrf.exe
  C:\Windows\System\thimnrf.exe
  2⤵
  PID:7696
- C:\Windows\System\qiVBVZY.exe
  C:\Windows\System\qiVBVZY.exe
  2⤵
  PID:7724
- C:\Windows\System\Ggwpula.exe
  C:\Windows\System\Ggwpula.exe
  2⤵
  PID:7756
- C:\Windows\System\AMrIajG.exe
  C:\Windows\System\AMrIajG.exe
  2⤵
  PID:7788
- C:\Windows\System\nKFlIqW.exe
  C:\Windows\System\nKFlIqW.exe
  2⤵
  PID:7808
- C:\Windows\System\CoqyfBK.exe
  C:\Windows\System\CoqyfBK.exe
  2⤵
  PID:7840
- C:\Windows\System\kKVFFGV.exe
  C:\Windows\System\kKVFFGV.exe
  2⤵
  PID:7868
- C:\Windows\System\BovRJPz.exe
  C:\Windows\System\BovRJPz.exe
  2⤵
  PID:7892
- C:\Windows\System\HeHOKaK.exe
  C:\Windows\System\HeHOKaK.exe
  2⤵
  PID:7924
- C:\Windows\System\xvAFngt.exe
  C:\Windows\System\xvAFngt.exe
  2⤵
  PID:7960
- C:\Windows\System\hQoMKPW.exe
  C:\Windows\System\hQoMKPW.exe
  2⤵
  PID:7980
- C:\Windows\System\MyuLTTO.exe
  C:\Windows\System\MyuLTTO.exe
  2⤵
  PID:8008
- C:\Windows\System\BMhrjwh.exe
  C:\Windows\System\BMhrjwh.exe
  2⤵
  PID:8040
- C:\Windows\System\okleRZi.exe
  C:\Windows\System\okleRZi.exe
  2⤵
  PID:8068
- C:\Windows\System\iQIGKiZ.exe
  C:\Windows\System\iQIGKiZ.exe
  2⤵
  PID:8096
- C:\Windows\System\ywXrpwb.exe
  C:\Windows\System\ywXrpwb.exe
  2⤵
  PID:8124
- C:\Windows\System\lVBvpoX.exe
  C:\Windows\System\lVBvpoX.exe
  2⤵
  PID:8152
- C:\Windows\System\AasHozA.exe
  C:\Windows\System\AasHozA.exe
  2⤵
  PID:8176
- C:\Windows\System\UWPXYBw.exe
  C:\Windows\System\UWPXYBw.exe
  2⤵
  PID:7188
- C:\Windows\System\RgRzvwv.exe
  C:\Windows\System\RgRzvwv.exe
  2⤵
  PID:7296
- C:\Windows\System\SwHgXcM.exe
  C:\Windows\System\SwHgXcM.exe
  2⤵
  PID:7336
- C:\Windows\System\QthXOGa.exe
  C:\Windows\System\QthXOGa.exe
  2⤵
  PID:7380
- C:\Windows\System\mYZzkuq.exe
  C:\Windows\System\mYZzkuq.exe
  2⤵
  PID:7440
- C:\Windows\System\LVRCYwX.exe
  C:\Windows\System\LVRCYwX.exe
  2⤵
  PID:7512
- C:\Windows\System\oyqlSYP.exe
  C:\Windows\System\oyqlSYP.exe
  2⤵
  PID:7604
- C:\Windows\System\WVIZvYZ.exe
  C:\Windows\System\WVIZvYZ.exe
  2⤵
  PID:7664
- C:\Windows\System\IKvLERm.exe
  C:\Windows\System\IKvLERm.exe
  2⤵
  PID:7720
- C:\Windows\System\aOBkJUj.exe
  C:\Windows\System\aOBkJUj.exe
  2⤵
  PID:7800
- C:\Windows\System\EFeubuI.exe
  C:\Windows\System\EFeubuI.exe
  2⤵
  PID:7856
- C:\Windows\System\axXmhTj.exe
  C:\Windows\System\axXmhTj.exe
  2⤵
  PID:7936
- C:\Windows\System\NPUCNLJ.exe
  C:\Windows\System\NPUCNLJ.exe
  2⤵
  PID:8000
- C:\Windows\System\AmAGiTS.exe
  C:\Windows\System\AmAGiTS.exe
  2⤵
  PID:8060
- C:\Windows\System\wgcMOQD.exe
  C:\Windows\System\wgcMOQD.exe
  2⤵
  PID:8116
- C:\Windows\System\wuVxVJN.exe
  C:\Windows\System\wuVxVJN.exe
  2⤵
  PID:7200
- C:\Windows\System\plaANlh.exe
  C:\Windows\System\plaANlh.exe
  2⤵
  PID:7312
- C:\Windows\System\juocJzw.exe
  C:\Windows\System\juocJzw.exe
  2⤵
  PID:7484
- C:\Windows\System\EiQRmqY.exe
  C:\Windows\System\EiQRmqY.exe
  2⤵
  PID:7636
- C:\Windows\System\UfXZWkw.exe
  C:\Windows\System\UfXZWkw.exe
  2⤵
  PID:7772
- C:\Windows\System\QCeKCEo.exe
  C:\Windows\System\QCeKCEo.exe
  2⤵
  PID:7912
- C:\Windows\System\xDEUPLz.exe
  C:\Windows\System\xDEUPLz.exe
  2⤵
  PID:8048
- C:\Windows\System\SjaODHp.exe
  C:\Windows\System\SjaODHp.exe
  2⤵
  PID:7372
- C:\Windows\System\GaXEigm.exe
  C:\Windows\System\GaXEigm.exe
  2⤵
  PID:7972
- C:\Windows\System\lqoqtJe.exe
  C:\Windows\System\lqoqtJe.exe
  2⤵
  PID:8200
- C:\Windows\System\IpaEqSu.exe
  C:\Windows\System\IpaEqSu.exe
  2⤵
  PID:8236
- C:\Windows\System\DEDsrwz.exe
  C:\Windows\System\DEDsrwz.exe
  2⤵
  PID:8272
- C:\Windows\System\gfBtVJC.exe
  C:\Windows\System\gfBtVJC.exe
  2⤵
  PID:8316
- C:\Windows\System\DefxJfj.exe
  C:\Windows\System\DefxJfj.exe
  2⤵
  PID:8360
- C:\Windows\System\THYptsP.exe
  C:\Windows\System\THYptsP.exe
  2⤵
  PID:8396
- C:\Windows\System\vFdYEtK.exe
  C:\Windows\System\vFdYEtK.exe
  2⤵
  PID:8428
- C:\Windows\System\loOxgSu.exe
  C:\Windows\System\loOxgSu.exe
  2⤵
  PID:8460
- C:\Windows\System\QhzTZqL.exe
  C:\Windows\System\QhzTZqL.exe
  2⤵
  PID:8492
- C:\Windows\System\lSarUci.exe
  C:\Windows\System\lSarUci.exe
  2⤵
  PID:8516
- C:\Windows\System\XQMMdnD.exe
  C:\Windows\System\XQMMdnD.exe
  2⤵
  PID:8544
- C:\Windows\System\XJMKWJy.exe
  C:\Windows\System\XJMKWJy.exe
  2⤵
  PID:8572
- C:\Windows\System\rIPNnHd.exe
  C:\Windows\System\rIPNnHd.exe
  2⤵
  PID:8588
- C:\Windows\System\alRvOFU.exe
  C:\Windows\System\alRvOFU.exe
  2⤵
  PID:8604
- C:\Windows\System\feaziql.exe
  C:\Windows\System\feaziql.exe
  2⤵
  PID:8632
- C:\Windows\System\rJlnnRR.exe
  C:\Windows\System\rJlnnRR.exe
  2⤵
  PID:8684
- C:\Windows\System\zHEuOpa.exe
  C:\Windows\System\zHEuOpa.exe
  2⤵
  PID:8724
- C:\Windows\System\llaEGam.exe
  C:\Windows\System\llaEGam.exe
  2⤵
  PID:8752
- C:\Windows\System\fvgPILV.exe
  C:\Windows\System\fvgPILV.exe
  2⤵
  PID:8772
- C:\Windows\System\UaaDHpp.exe
  C:\Windows\System\UaaDHpp.exe
  2⤵
  PID:8812
- C:\Windows\System\kSVUiqn.exe
  C:\Windows\System\kSVUiqn.exe
  2⤵
  PID:8832
- C:\Windows\System\EErRIJU.exe
  C:\Windows\System\EErRIJU.exe
  2⤵
  PID:8852
- C:\Windows\System\FoFALbN.exe
  C:\Windows\System\FoFALbN.exe
  2⤵
  PID:8896
- C:\Windows\System\JOzCooZ.exe
  C:\Windows\System\JOzCooZ.exe
  2⤵
  PID:8924
- C:\Windows\System\uYxSfMe.exe
  C:\Windows\System\uYxSfMe.exe
  2⤵
  PID:8952
- C:\Windows\System\grqSrZY.exe
  C:\Windows\System\grqSrZY.exe
  2⤵
  PID:8968
- C:\Windows\System\GsHAibH.exe
  C:\Windows\System\GsHAibH.exe
  2⤵
  PID:9008
- C:\Windows\System\BoDkZzt.exe
  C:\Windows\System\BoDkZzt.exe
  2⤵
  PID:9036
- C:\Windows\System\lXeKMYL.exe
  C:\Windows\System\lXeKMYL.exe
  2⤵
  PID:9064
- C:\Windows\System\zsRoHJI.exe
  C:\Windows\System\zsRoHJI.exe
  2⤵
  PID:9092
- C:\Windows\System\rddFmRV.exe
  C:\Windows\System\rddFmRV.exe
  2⤵
  PID:9120
- C:\Windows\System\xgptwrn.exe
  C:\Windows\System\xgptwrn.exe
  2⤵
  PID:9148
- C:\Windows\System\tGEkvvq.exe
  C:\Windows\System\tGEkvvq.exe
  2⤵
  PID:9176
- C:\Windows\System\ceZVhCa.exe
  C:\Windows\System\ceZVhCa.exe
  2⤵
  PID:9204
- C:\Windows\System\yYsrLyR.exe
  C:\Windows\System\yYsrLyR.exe
  2⤵
  PID:8248
- C:\Windows\System\hQkFiSe.exe
  C:\Windows\System\hQkFiSe.exe
  2⤵
  PID:8332
- C:\Windows\System\mcyoVFC.exe
  C:\Windows\System\mcyoVFC.exe
  2⤵
  PID:8408
- C:\Windows\System\JTpnVQl.exe
  C:\Windows\System\JTpnVQl.exe
  2⤵
  PID:8472
- C:\Windows\System\aUZzvjG.exe
  C:\Windows\System\aUZzvjG.exe
  2⤵
  PID:8540
- C:\Windows\System\JGYiPof.exe
  C:\Windows\System\JGYiPof.exe
  2⤵
  PID:4692
- C:\Windows\System\rsnceoj.exe
  C:\Windows\System\rsnceoj.exe
  2⤵
  PID:8628
- C:\Windows\System\VdBSNjV.exe
  C:\Windows\System\VdBSNjV.exe
  2⤵
  PID:8708
- C:\Windows\System\prwGOwI.exe
  C:\Windows\System\prwGOwI.exe
  2⤵
  PID:8764
- C:\Windows\System\LFhXpSy.exe
  C:\Windows\System\LFhXpSy.exe
  2⤵
  PID:8844
- C:\Windows\System\DvKkFbJ.exe
  C:\Windows\System\DvKkFbJ.exe
  2⤵
  PID:8760
- C:\Windows\System\JmTAgtI.exe
  C:\Windows\System\JmTAgtI.exe
  2⤵
  PID:8964
- C:\Windows\System\xARRLQP.exe
  C:\Windows\System\xARRLQP.exe
  2⤵
  PID:9028
- C:\Windows\System\NqVZANP.exe
  C:\Windows\System\NqVZANP.exe
  2⤵
  PID:9104
- C:\Windows\System\zfvAiDf.exe
  C:\Windows\System\zfvAiDf.exe
  2⤵
  PID:9168
- C:\Windows\System\dxkmagT.exe
  C:\Windows\System\dxkmagT.exe
  2⤵
  PID:7940
- C:\Windows\System\YQywfWu.exe
  C:\Windows\System\YQywfWu.exe
  2⤵
  PID:8420
- C:\Windows\System\BsDTsms.exe
  C:\Windows\System\BsDTsms.exe
  2⤵
  PID:384
- C:\Windows\System\ntbsWbA.exe
  C:\Windows\System\ntbsWbA.exe
  2⤵
  PID:8736
- C:\Windows\System\nillmFA.exe
  C:\Windows\System\nillmFA.exe
  2⤵
  PID:8868
- C:\Windows\System\JxDvwuN.exe
  C:\Windows\System\JxDvwuN.exe
  2⤵
  PID:9020
- C:\Windows\System\bbijRta.exe
  C:\Windows\System\bbijRta.exe
  2⤵
  PID:8280
- C:\Windows\System\tTGvIjl.exe
  C:\Windows\System\tTGvIjl.exe
  2⤵
  PID:8500
- C:\Windows\System\VkNyqNh.exe
  C:\Windows\System\VkNyqNh.exe
  2⤵
  PID:8824
- C:\Windows\System\tnrsvnT.exe
  C:\Windows\System\tnrsvnT.exe
  2⤵
  PID:9084
- C:\Windows\System\JzlcITi.exe
  C:\Windows\System\JzlcITi.exe
  2⤵
  PID:4736
- C:\Windows\System\BoasHaJ.exe
  C:\Windows\System\BoasHaJ.exe
  2⤵
  PID:2932
- C:\Windows\System\GAIEeDW.exe
  C:\Windows\System\GAIEeDW.exe
  2⤵
  PID:7468
- C:\Windows\System\xnWtfiX.exe
  C:\Windows\System\xnWtfiX.exe
  2⤵
  PID:8600
- C:\Windows\System\UBJwFfa.exe
  C:\Windows\System\UBJwFfa.exe
  2⤵
  PID:4344
- C:\Windows\System\PUSbuSC.exe
  C:\Windows\System\PUSbuSC.exe
  2⤵
  PID:9132
- C:\Windows\System\kTdvNMy.exe
  C:\Windows\System\kTdvNMy.exe
  2⤵
  PID:4164
- C:\Windows\System\oUQhITK.exe
  C:\Windows\System\oUQhITK.exe
  2⤵
  PID:4008
- C:\Windows\System\vYHOIoW.exe
  C:\Windows\System\vYHOIoW.exe
  2⤵
  PID:9236
- C:\Windows\System\BMlWTiN.exe
  C:\Windows\System\BMlWTiN.exe
  2⤵
  PID:9268
- C:\Windows\System\MEFtUcL.exe
  C:\Windows\System\MEFtUcL.exe
  2⤵
  PID:9292
- C:\Windows\System\uyouLyN.exe
  C:\Windows\System\uyouLyN.exe
  2⤵
  PID:9320
- C:\Windows\System\CMVpTUB.exe
  C:\Windows\System\CMVpTUB.exe
  2⤵
  PID:9356
- C:\Windows\System\bFmqwMC.exe
  C:\Windows\System\bFmqwMC.exe
  2⤵
  PID:9384
- C:\Windows\System\wfaiOPj.exe
  C:\Windows\System\wfaiOPj.exe
  2⤵
  PID:9408
- C:\Windows\System\jtmyajB.exe
  C:\Windows\System\jtmyajB.exe
  2⤵
  PID:9440
- C:\Windows\System\dcKmBVH.exe
  C:\Windows\System\dcKmBVH.exe
  2⤵
  PID:9464
- C:\Windows\System\lMbSJZn.exe
  C:\Windows\System\lMbSJZn.exe
  2⤵
  PID:9492
- C:\Windows\System\wTJXSoQ.exe
  C:\Windows\System\wTJXSoQ.exe
  2⤵
  PID:9524
- C:\Windows\System\SUyQzfb.exe
  C:\Windows\System\SUyQzfb.exe
  2⤵
  PID:9548
- C:\Windows\System\VIpKbCN.exe
  C:\Windows\System\VIpKbCN.exe
  2⤵
  PID:9580
- C:\Windows\System\ZHRLgnm.exe
  C:\Windows\System\ZHRLgnm.exe
  2⤵
  PID:9608
- C:\Windows\System\penfith.exe
  C:\Windows\System\penfith.exe
  2⤵
  PID:9632
- C:\Windows\System\zfWJRJi.exe
  C:\Windows\System\zfWJRJi.exe
  2⤵
  PID:9664
- C:\Windows\System\ofluAOO.exe
  C:\Windows\System\ofluAOO.exe
  2⤵
  PID:9688
- C:\Windows\System\UfcqeND.exe
  C:\Windows\System\UfcqeND.exe
  2⤵
  PID:9716
- C:\Windows\System\FigvvEP.exe
  C:\Windows\System\FigvvEP.exe
  2⤵
  PID:9744
- C:\Windows\System\fLnKHoM.exe
  C:\Windows\System\fLnKHoM.exe
  2⤵
  PID:9772
- C:\Windows\System\jLCZZLU.exe
  C:\Windows\System\jLCZZLU.exe
  2⤵
  PID:9800
- C:\Windows\System\DrwQwlS.exe
  C:\Windows\System\DrwQwlS.exe
  2⤵
  PID:9828
- C:\Windows\System\hIkoDnG.exe
  C:\Windows\System\hIkoDnG.exe
  2⤵
  PID:9856
- C:\Windows\System\xLbuSwf.exe
  C:\Windows\System\xLbuSwf.exe
  2⤵
  PID:9884
- C:\Windows\System\ZQmrPDN.exe
  C:\Windows\System\ZQmrPDN.exe
  2⤵
  PID:9916
- C:\Windows\System\JSActET.exe
  C:\Windows\System\JSActET.exe
  2⤵
  PID:9944
- C:\Windows\System\sVAADqP.exe
  C:\Windows\System\sVAADqP.exe
  2⤵
  PID:9968
- C:\Windows\System\VEPoGKe.exe
  C:\Windows\System\VEPoGKe.exe
  2⤵
  PID:9996
- C:\Windows\System\VVPASlI.exe
  C:\Windows\System\VVPASlI.exe
  2⤵
  PID:10028
- C:\Windows\System\pjeFwhc.exe
  C:\Windows\System\pjeFwhc.exe
  2⤵
  PID:10052
- C:\Windows\System\RDcrjHX.exe
  C:\Windows\System\RDcrjHX.exe
  2⤵
  PID:10084
- C:\Windows\System\vRXaFjO.exe
  C:\Windows\System\vRXaFjO.exe
  2⤵
  PID:10112
- C:\Windows\System\cfSMbsn.exe
  C:\Windows\System\cfSMbsn.exe
  2⤵
  PID:10140
- C:\Windows\System\JpEkGLN.exe
  C:\Windows\System\JpEkGLN.exe
  2⤵
  PID:10172
- C:\Windows\System\YTGyvwZ.exe
  C:\Windows\System\YTGyvwZ.exe
  2⤵
  PID:10200
- C:\Windows\System\drHXwmN.exe
  C:\Windows\System\drHXwmN.exe
  2⤵
  PID:10236
- C:\Windows\System\nGWufUK.exe
  C:\Windows\System\nGWufUK.exe
  2⤵
  PID:9248
- C:\Windows\System\kZRyTRa.exe
  C:\Windows\System\kZRyTRa.exe
  2⤵
  PID:9312
- C:\Windows\System\rSmxePA.exe
  C:\Windows\System\rSmxePA.exe
  2⤵
  PID:9376
- C:\Windows\System\MbDXSTA.exe
  C:\Windows\System\MbDXSTA.exe
  2⤵
  PID:9448
- C:\Windows\System\AHcPTvy.exe
  C:\Windows\System\AHcPTvy.exe
  2⤵
  PID:9512
- C:\Windows\System\kzAyffC.exe
  C:\Windows\System\kzAyffC.exe
  2⤵
  PID:9572
- C:\Windows\System\fNKoRyY.exe
  C:\Windows\System\fNKoRyY.exe
  2⤵
  PID:9644
- C:\Windows\System\LyWegCT.exe
  C:\Windows\System\LyWegCT.exe
  2⤵
  PID:9708
- C:\Windows\System\JbGeTKX.exe
  C:\Windows\System\JbGeTKX.exe
  2⤵
  PID:9740
- C:\Windows\System\RHRVrpx.exe
  C:\Windows\System\RHRVrpx.exe
  2⤵
  PID:9812
- C:\Windows\System\ivdAIxr.exe
  C:\Windows\System\ivdAIxr.exe
  2⤵
  PID:9896
- C:\Windows\System\okIwFVX.exe
  C:\Windows\System\okIwFVX.exe
  2⤵
  PID:9960
- C:\Windows\System\ObhpDei.exe
  C:\Windows\System\ObhpDei.exe
  2⤵
  PID:10020
- C:\Windows\System\YErRJqF.exe
  C:\Windows\System\YErRJqF.exe
  2⤵
  PID:10100
- C:\Windows\System\qmijkIw.exe
  C:\Windows\System\qmijkIw.exe
  2⤵
  PID:10164
- C:\Windows\System\rBQktig.exe
  C:\Windows\System\rBQktig.exe
  2⤵
  PID:10216
- C:\Windows\System\VhUfLpJ.exe
  C:\Windows\System\VhUfLpJ.exe
  2⤵
  PID:9304
- C:\Windows\System\ToEjLyi.exe
  C:\Windows\System\ToEjLyi.exe
  2⤵
  PID:9476
- C:\Windows\System\ltogugh.exe
  C:\Windows\System\ltogugh.exe
  2⤵
  PID:9616
- C:\Windows\System\BByFmEs.exe
  C:\Windows\System\BByFmEs.exe
  2⤵
  PID:2688
- C:\Windows\System\kLVXpTg.exe
  C:\Windows\System\kLVXpTg.exe
  2⤵
  PID:4416
- C:\Windows\System\xXxUZQN.exe
  C:\Windows\System\xXxUZQN.exe
  2⤵
  PID:9824
- C:\Windows\System\PFpmCaB.exe
  C:\Windows\System\PFpmCaB.exe
  2⤵
  PID:9924
- C:\Windows\System\mhZtqXN.exe
  C:\Windows\System\mhZtqXN.exe
  2⤵
  PID:10132
- C:\Windows\System\dlbiKoo.exe
  C:\Windows\System\dlbiKoo.exe
  2⤵
  PID:9232
- C:\Windows\System\DhhzyoZ.exe
  C:\Windows\System\DhhzyoZ.exe
  2⤵
  PID:2232
- C:\Windows\System\PVGvlPw.exe
  C:\Windows\System\PVGvlPw.exe
  2⤵
  PID:4276
- C:\Windows\System\pdVRfqb.exe
  C:\Windows\System\pdVRfqb.exe
  2⤵
  PID:9932
- C:\Windows\System\DJIjvxP.exe
  C:\Windows\System\DJIjvxP.exe
  2⤵
  PID:9432
- C:\Windows\System\KUnyqzm.exe
  C:\Windows\System\KUnyqzm.exe
  2⤵
  PID:2368
- C:\Windows\System\dDQTcDN.exe
  C:\Windows\System\dDQTcDN.exe
  2⤵
  PID:9728
- C:\Windows\System\dWOcGQB.exe
  C:\Windows\System\dWOcGQB.exe
  2⤵
  PID:10244
- C:\Windows\System\btxTsWy.exe
  C:\Windows\System\btxTsWy.exe
  2⤵
  PID:10284
- C:\Windows\System\hoXqHfK.exe
  C:\Windows\System\hoXqHfK.exe
  2⤵
  PID:10312
- C:\Windows\System\QilZHsM.exe
  C:\Windows\System\QilZHsM.exe
  2⤵
  PID:10340
- C:\Windows\System\ETNdFGO.exe
  C:\Windows\System\ETNdFGO.exe
  2⤵
  PID:10368
- C:\Windows\System\kmqGnjS.exe
  C:\Windows\System\kmqGnjS.exe
  2⤵
  PID:10396
- C:\Windows\System\OMbSkDv.exe
  C:\Windows\System\OMbSkDv.exe
  2⤵
  PID:10432
- C:\Windows\System\ezWUULL.exe
  C:\Windows\System\ezWUULL.exe
  2⤵
  PID:10464
- C:\Windows\System\bBcccBK.exe
  C:\Windows\System\bBcccBK.exe
  2⤵
  PID:10492
- C:\Windows\System\GwLWUOG.exe
  C:\Windows\System\GwLWUOG.exe
  2⤵
  PID:10520
- C:\Windows\System\lDZhlea.exe
  C:\Windows\System\lDZhlea.exe
  2⤵
  PID:10548
- C:\Windows\System\iBAnRYi.exe
  C:\Windows\System\iBAnRYi.exe
  2⤵
  PID:10576
- C:\Windows\System\yTSvDJW.exe
  C:\Windows\System\yTSvDJW.exe
  2⤵
  PID:10604
- C:\Windows\System\qofaVdU.exe
  C:\Windows\System\qofaVdU.exe
  2⤵
  PID:10632
- C:\Windows\System\ntIOTUK.exe
  C:\Windows\System\ntIOTUK.exe
  2⤵
  PID:10660
- C:\Windows\System\SdiwQVo.exe
  C:\Windows\System\SdiwQVo.exe
  2⤵
  PID:10688
- C:\Windows\System\OcbAaDf.exe
  C:\Windows\System\OcbAaDf.exe
  2⤵
  PID:10716
- C:\Windows\System\NFWKfEf.exe
  C:\Windows\System\NFWKfEf.exe
  2⤵
  PID:10744
- C:\Windows\System\KmudROv.exe
  C:\Windows\System\KmudROv.exe
  2⤵
  PID:10772
- C:\Windows\System\HlByvDW.exe
  C:\Windows\System\HlByvDW.exe
  2⤵
  PID:10800
- C:\Windows\System\XcaPnTt.exe
  C:\Windows\System\XcaPnTt.exe
  2⤵
  PID:10828
- C:\Windows\System\nvUusHu.exe
  C:\Windows\System\nvUusHu.exe
  2⤵
  PID:10856
- C:\Windows\System\hNKNwXW.exe
  C:\Windows\System\hNKNwXW.exe
  2⤵
  PID:10884
- C:\Windows\System\tUrbcyU.exe
  C:\Windows\System\tUrbcyU.exe
  2⤵
  PID:10912
- C:\Windows\System\cujDxvS.exe
  C:\Windows\System\cujDxvS.exe
  2⤵
  PID:10940
- C:\Windows\System\cQdFqmj.exe
  C:\Windows\System\cQdFqmj.exe
  2⤵
  PID:10968
- C:\Windows\System\cHTRYfK.exe
  C:\Windows\System\cHTRYfK.exe
  2⤵
  PID:10996
- C:\Windows\System\ACoBDZN.exe
  C:\Windows\System\ACoBDZN.exe
  2⤵
  PID:11024
- C:\Windows\System\HryaFQL.exe
  C:\Windows\System\HryaFQL.exe
  2⤵
  PID:11052
- C:\Windows\System\tJWMLHE.exe
  C:\Windows\System\tJWMLHE.exe
  2⤵
  PID:11080
- C:\Windows\System\kvfPksH.exe
  C:\Windows\System\kvfPksH.exe
  2⤵
  PID:11108
- C:\Windows\System\CMtfrmh.exe
  C:\Windows\System\CMtfrmh.exe
  2⤵
  PID:11136
- C:\Windows\System\aQpzFOh.exe
  C:\Windows\System\aQpzFOh.exe
  2⤵
  PID:11164
- C:\Windows\System\EQHxpvP.exe
  C:\Windows\System\EQHxpvP.exe
  2⤵
  PID:11192
- C:\Windows\System\KZtTjju.exe
  C:\Windows\System\KZtTjju.exe
  2⤵
  PID:11220
- C:\Windows\System\WhbcXAH.exe
  C:\Windows\System\WhbcXAH.exe
  2⤵
  PID:11248
- C:\Windows\System\yQyNPSq.exe
  C:\Windows\System\yQyNPSq.exe
  2⤵
  PID:10264
- C:\Windows\System\aJJjNVj.exe
  C:\Windows\System\aJJjNVj.exe
  2⤵
  PID:10336
- C:\Windows\System\ZQWujna.exe
  C:\Windows\System\ZQWujna.exe
  2⤵
  PID:10392
- C:\Windows\System\BFtPgeu.exe
  C:\Windows\System\BFtPgeu.exe
  2⤵
  PID:10452
- C:\Windows\System\qCWiMpc.exe
  C:\Windows\System\qCWiMpc.exe
  2⤵
  PID:10512
- C:\Windows\System\EOcxXSe.exe
  C:\Windows\System\EOcxXSe.exe
  2⤵
  PID:10572
- C:\Windows\System\beVClBD.exe
  C:\Windows\System\beVClBD.exe
  2⤵
  PID:10648
- C:\Windows\System\lIwWVDX.exe
  C:\Windows\System\lIwWVDX.exe
  2⤵
  PID:10708
- C:\Windows\System\PNVOgXG.exe
  C:\Windows\System\PNVOgXG.exe
  2⤵
  PID:10768
- C:\Windows\System\kNOCZft.exe
  C:\Windows\System\kNOCZft.exe
  2⤵
  PID:10840
- C:\Windows\System\dYHgBQZ.exe
  C:\Windows\System\dYHgBQZ.exe
  2⤵
  PID:10904
- C:\Windows\System\UofiAZj.exe
  C:\Windows\System\UofiAZj.exe
  2⤵
  PID:10964
- C:\Windows\System\jUYsCjb.exe
  C:\Windows\System\jUYsCjb.exe
  2⤵
  PID:11036
- C:\Windows\System\vgKWOwu.exe
  C:\Windows\System\vgKWOwu.exe
  2⤵
  PID:11100
- C:\Windows\System\fsKHKCL.exe
  C:\Windows\System\fsKHKCL.exe
  2⤵
  PID:11160
- C:\Windows\System\jZmWCcv.exe
  C:\Windows\System\jZmWCcv.exe
  2⤵
  PID:11232
- C:\Windows\System\xwnwqnv.exe
  C:\Windows\System\xwnwqnv.exe
  2⤵
  PID:10308
- C:\Windows\System\dpdyuUv.exe
  C:\Windows\System\dpdyuUv.exe
  2⤵
  PID:10424
- C:\Windows\System\RAGOIVT.exe
  C:\Windows\System\RAGOIVT.exe
  2⤵
  PID:10600
- C:\Windows\System\MkGuZfe.exe
  C:\Windows\System\MkGuZfe.exe
  2⤵
  PID:10756
- C:\Windows\System\sGCsJOB.exe
  C:\Windows\System\sGCsJOB.exe
  2⤵
  PID:10896
- C:\Windows\System\SOWGlxF.exe
  C:\Windows\System\SOWGlxF.exe
  2⤵
  PID:11076
- C:\Windows\System\UIYPePK.exe
  C:\Windows\System\UIYPePK.exe
  2⤵
  PID:11216
- C:\Windows\System\LierDjm.exe
  C:\Windows\System\LierDjm.exe
  2⤵
  PID:10428
- C:\Windows\System\pUjmMsj.exe
  C:\Windows\System\pUjmMsj.exe
  2⤵
  PID:10820
- C:\Windows\System\AoEptGB.exe
  C:\Windows\System\AoEptGB.exe
  2⤵
  PID:11156
- C:\Windows\System\XAHvPQJ.exe
  C:\Windows\System\XAHvPQJ.exe
  2⤵
  PID:10736
- C:\Windows\System\JrenOhV.exe
  C:\Windows\System\JrenOhV.exe
  2⤵
  PID:10700
- C:\Windows\System\zlTOhLe.exe
  C:\Windows\System\zlTOhLe.exe
  2⤵
  PID:11280
- C:\Windows\System\gfxuOTP.exe
  C:\Windows\System\gfxuOTP.exe
  2⤵
  PID:11308
- C:\Windows\System\oWXyxoq.exe
  C:\Windows\System\oWXyxoq.exe
  2⤵
  PID:11336
- C:\Windows\System\exTEghF.exe
  C:\Windows\System\exTEghF.exe
  2⤵
  PID:11364
- C:\Windows\System\MzMrJAR.exe
  C:\Windows\System\MzMrJAR.exe
  2⤵
  PID:11392
- C:\Windows\System\hoVWVRR.exe
  C:\Windows\System\hoVWVRR.exe
  2⤵
  PID:11420
- C:\Windows\System\CqXbNUy.exe
  C:\Windows\System\CqXbNUy.exe
  2⤵
  PID:11448
- C:\Windows\System\TLUgslJ.exe
  C:\Windows\System\TLUgslJ.exe
  2⤵
  PID:11476
- C:\Windows\System\lBtYQRp.exe
  C:\Windows\System\lBtYQRp.exe
  2⤵
  PID:11504
- C:\Windows\System\nelcvdL.exe
  C:\Windows\System\nelcvdL.exe
  2⤵
  PID:11532
- C:\Windows\System\TxrymOe.exe
  C:\Windows\System\TxrymOe.exe
  2⤵
  PID:11560
- C:\Windows\System\qsinzIr.exe
  C:\Windows\System\qsinzIr.exe
  2⤵
  PID:11588
- C:\Windows\System\mlWSHFk.exe
  C:\Windows\System\mlWSHFk.exe
  2⤵
  PID:11616
- C:\Windows\System\ZTXFRhn.exe
  C:\Windows\System\ZTXFRhn.exe
  2⤵
  PID:11644
- C:\Windows\System\egUMHNb.exe
  C:\Windows\System\egUMHNb.exe
  2⤵
  PID:11672
- C:\Windows\System\SpbabCp.exe
  C:\Windows\System\SpbabCp.exe
  2⤵
  PID:11700
- C:\Windows\System\DxSKZeu.exe
  C:\Windows\System\DxSKZeu.exe
  2⤵
  PID:11728
- C:\Windows\System\XEmOrJA.exe
  C:\Windows\System\XEmOrJA.exe
  2⤵
  PID:11756
- C:\Windows\System\LQDDFdc.exe
  C:\Windows\System\LQDDFdc.exe
  2⤵
  PID:11784
- C:\Windows\System\MAMsfwl.exe
  C:\Windows\System\MAMsfwl.exe
  2⤵
  PID:11812
- C:\Windows\System\tGHpeqe.exe
  C:\Windows\System\tGHpeqe.exe
  2⤵
  PID:11840
- C:\Windows\System\axsCNdT.exe
  C:\Windows\System\axsCNdT.exe
  2⤵
  PID:11868
- C:\Windows\System\cGlsgGo.exe
  C:\Windows\System\cGlsgGo.exe
  2⤵
  PID:11896
- C:\Windows\System\lDLdjhR.exe
  C:\Windows\System\lDLdjhR.exe
  2⤵
  PID:11924
- C:\Windows\System\RfuHUSM.exe
  C:\Windows\System\RfuHUSM.exe
  2⤵
  PID:11952
- C:\Windows\System\DcxMHqR.exe
  C:\Windows\System\DcxMHqR.exe
  2⤵
  PID:11980
- C:\Windows\System\QPHugnh.exe
  C:\Windows\System\QPHugnh.exe
  2⤵
  PID:12008
- C:\Windows\System\xkgLgTH.exe
  C:\Windows\System\xkgLgTH.exe
  2⤵
  PID:12036
- C:\Windows\System\vKCVeza.exe
  C:\Windows\System\vKCVeza.exe
  2⤵
  PID:12064
- C:\Windows\System\MCZnvTy.exe
  C:\Windows\System\MCZnvTy.exe
  2⤵
  PID:12092
- C:\Windows\System\fjTbQkk.exe
  C:\Windows\System\fjTbQkk.exe
  2⤵
  PID:12120
- C:\Windows\System\EbEXPsn.exe
  C:\Windows\System\EbEXPsn.exe
  2⤵
  PID:12148
- C:\Windows\System\IBwvmYa.exe
  C:\Windows\System\IBwvmYa.exe
  2⤵
  PID:12176
- C:\Windows\System\UuKmExG.exe
  C:\Windows\System\UuKmExG.exe
  2⤵
  PID:12204
- C:\Windows\System\mBZRjyC.exe
  C:\Windows\System\mBZRjyC.exe
  2⤵
  PID:12220
- C:\Windows\System\eIiIUqP.exe
  C:\Windows\System\eIiIUqP.exe
  2⤵
  PID:12252
- C:\Windows\System\wdxWnvv.exe
  C:\Windows\System\wdxWnvv.exe
  2⤵
  PID:10672
- C:\Windows\System\GCJEfYM.exe
  C:\Windows\System\GCJEfYM.exe
  2⤵
  PID:11328
- C:\Windows\System\uKlRVlI.exe
  C:\Windows\System\uKlRVlI.exe
  2⤵
  PID:11388
- C:\Windows\System\WFJIUyb.exe
  C:\Windows\System\WFJIUyb.exe
  2⤵
  PID:11460
- C:\Windows\System\AawLYVG.exe
  C:\Windows\System\AawLYVG.exe
  2⤵
  PID:11524
- C:\Windows\System\DamHllk.exe
  C:\Windows\System\DamHllk.exe
  2⤵
  PID:11600
- C:\Windows\System\YIRQKiS.exe
  C:\Windows\System\YIRQKiS.exe
  2⤵
  PID:11664
- C:\Windows\System\VsSsNil.exe
  C:\Windows\System\VsSsNil.exe
  2⤵
  PID:11724
- C:\Windows\System\WfQuxMg.exe
  C:\Windows\System\WfQuxMg.exe
  2⤵
  PID:11800
- C:\Windows\System\QSSrvqU.exe
  C:\Windows\System\QSSrvqU.exe
  2⤵
  PID:11860
- C:\Windows\System\GaYRYxA.exe
  C:\Windows\System\GaYRYxA.exe
  2⤵
  PID:11916
- C:\Windows\System\CaKkBph.exe
  C:\Windows\System\CaKkBph.exe
  2⤵
  PID:11992
- C:\Windows\System\BHqoCcr.exe
  C:\Windows\System\BHqoCcr.exe
  2⤵
  PID:12056
- C:\Windows\System\ZnQabef.exe
  C:\Windows\System\ZnQabef.exe
  2⤵
  PID:2540
- C:\Windows\System\cIxSMzw.exe
  C:\Windows\System\cIxSMzw.exe
  2⤵
  PID:12160
- C:\Windows\System\uEjAWix.exe
  C:\Windows\System\uEjAWix.exe
  2⤵
  PID:12232
- C:\Windows\System\BAjBDti.exe
  C:\Windows\System\BAjBDti.exe
  2⤵
  PID:11296
- C:\Windows\System\DzGpDiu.exe
  C:\Windows\System\DzGpDiu.exe
  2⤵
  PID:11436
- C:\Windows\System\kRnOJFp.exe
  C:\Windows\System\kRnOJFp.exe
  2⤵
  PID:11516
- C:\Windows\System\AFAkkYR.exe
  C:\Windows\System\AFAkkYR.exe
  2⤵
  PID:11692
- C:\Windows\System\PzmEMJM.exe
  C:\Windows\System\PzmEMJM.exe
  2⤵
  PID:11836
- C:\Windows\System\PYtIFxU.exe
  C:\Windows\System\PYtIFxU.exe
  2⤵
  PID:11976
- C:\Windows\System\DvlQWfH.exe
  C:\Windows\System\DvlQWfH.exe
  2⤵
  PID:12116
- C:\Windows\System\ohpLitk.exe
  C:\Windows\System\ohpLitk.exe
  2⤵
  PID:12272
- C:\Windows\System\NUZWeRl.exe
  C:\Windows\System\NUZWeRl.exe
  2⤵
  PID:11500
- C:\Windows\System\DbSurRP.exe
  C:\Windows\System\DbSurRP.exe
  2⤵
  PID:11912
- C:\Windows\System\caLnacc.exe
  C:\Windows\System\caLnacc.exe
  2⤵
  PID:12212
- C:\Windows\System\dAuheSx.exe
  C:\Windows\System\dAuheSx.exe
  2⤵
  PID:11780
- C:\Windows\System\qDCBQHH.exe
  C:\Windows\System\qDCBQHH.exe
  2⤵
  PID:12200
- C:\Windows\System\FeeBvCd.exe
  C:\Windows\System\FeeBvCd.exe
  2⤵
  PID:12308
- C:\Windows\System\FvGNTBb.exe
  C:\Windows\System\FvGNTBb.exe
  2⤵
  PID:12336
- C:\Windows\System\GXQzAgU.exe
  C:\Windows\System\GXQzAgU.exe
  2⤵
  PID:12364
- C:\Windows\System\DHkbntf.exe
  C:\Windows\System\DHkbntf.exe
  2⤵
  PID:12392
- C:\Windows\System\UgmbPFw.exe
  C:\Windows\System\UgmbPFw.exe
  2⤵
  PID:12420
- C:\Windows\System\ngprbjk.exe
  C:\Windows\System\ngprbjk.exe
  2⤵
  PID:12448
- C:\Windows\System\somONhV.exe
  C:\Windows\System\somONhV.exe
  2⤵
  PID:12476
- C:\Windows\System\JIVxDxl.exe
  C:\Windows\System\JIVxDxl.exe
  2⤵
  PID:12504
- C:\Windows\System\kwDBEcO.exe
  C:\Windows\System\kwDBEcO.exe
  2⤵
  PID:12532
- C:\Windows\System\ijDgjcr.exe
  C:\Windows\System\ijDgjcr.exe
  2⤵
  PID:12560
- C:\Windows\System\DtwLiyl.exe
  C:\Windows\System\DtwLiyl.exe
  2⤵
  PID:12588
- C:\Windows\System\VcHfhst.exe
  C:\Windows\System\VcHfhst.exe
  2⤵
  PID:12628
- C:\Windows\System\ZqutRun.exe
  C:\Windows\System\ZqutRun.exe
  2⤵
  PID:12644
- C:\Windows\System\MoyYkKb.exe
  C:\Windows\System\MoyYkKb.exe
  2⤵
  PID:12672
- C:\Windows\System\NHmzXCg.exe
  C:\Windows\System\NHmzXCg.exe
  2⤵
  PID:12700
- C:\Windows\System\hdoRjyy.exe
  C:\Windows\System\hdoRjyy.exe
  2⤵
  PID:12728
- C:\Windows\System\wRHLRof.exe
  C:\Windows\System\wRHLRof.exe
  2⤵
  PID:12756
- C:\Windows\System\ZImRlhK.exe
  C:\Windows\System\ZImRlhK.exe
  2⤵
  PID:12784
- C:\Windows\System\hXXWjKu.exe
  C:\Windows\System\hXXWjKu.exe
  2⤵
  PID:12812
- C:\Windows\System\ucYJyIm.exe
  C:\Windows\System\ucYJyIm.exe
  2⤵
  PID:12840
- C:\Windows\System\biPhFwt.exe
  C:\Windows\System\biPhFwt.exe
  2⤵
  PID:12868
- C:\Windows\System\AwECWsZ.exe
  C:\Windows\System\AwECWsZ.exe
  2⤵
  PID:12896
- C:\Windows\System\RInIoUQ.exe
  C:\Windows\System\RInIoUQ.exe
  2⤵
  PID:12924
- C:\Windows\System\brLvqia.exe
  C:\Windows\System\brLvqia.exe
  2⤵
  PID:12952
- C:\Windows\System\qMEtCdq.exe
  C:\Windows\System\qMEtCdq.exe
  2⤵
  PID:12980
- C:\Windows\System\uJpOYHI.exe
  C:\Windows\System\uJpOYHI.exe
  2⤵
  PID:13008
- C:\Windows\System\MiqtgXO.exe
  C:\Windows\System\MiqtgXO.exe
  2⤵
  PID:13040
- C:\Windows\System\PGzmxyE.exe
  C:\Windows\System\PGzmxyE.exe
  2⤵
  PID:13076
- C:\Windows\System\gKvDjtN.exe
  C:\Windows\System\gKvDjtN.exe
  2⤵
  PID:13096
- C:\Windows\System\ODPmBDo.exe
  C:\Windows\System\ODPmBDo.exe
  2⤵
  PID:13124
- C:\Windows\System\aGsUecH.exe
  C:\Windows\System\aGsUecH.exe
  2⤵
  PID:13152
- C:\Windows\System\owroyvE.exe
  C:\Windows\System\owroyvE.exe
  2⤵
  PID:13180
- C:\Windows\System\tapBtWI.exe
  C:\Windows\System\tapBtWI.exe
  2⤵
  PID:13208
- C:\Windows\System\EHjfDqQ.exe
  C:\Windows\System\EHjfDqQ.exe
  2⤵
  PID:13244
- C:\Windows\System\NBsXheY.exe
  C:\Windows\System\NBsXheY.exe
  2⤵
  PID:13280
- C:\Windows\System\aZNRMEy.exe
  C:\Windows\System\aZNRMEy.exe
  2⤵
  PID:12320
- C:\Windows\System\gWYAdUe.exe
  C:\Windows\System\gWYAdUe.exe
  2⤵
  PID:12384
- C:\Windows\System\WJdywLx.exe
  C:\Windows\System\WJdywLx.exe
  2⤵
  PID:12444
- C:\Windows\System\fDSuqEP.exe
  C:\Windows\System\fDSuqEP.exe
  2⤵
  PID:12516
- C:\Windows\System\uxtrLmk.exe
  C:\Windows\System\uxtrLmk.exe
  2⤵
  PID:12584
- C:\Windows\System\hYdzUTs.exe
  C:\Windows\System\hYdzUTs.exe
  2⤵
  PID:12664
- C:\Windows\System\atrOKEG.exe
  C:\Windows\System\atrOKEG.exe
  2⤵
  PID:12720
- C:\Windows\System\jnridCr.exe
  C:\Windows\System\jnridCr.exe
  2⤵
  PID:12808
- C:\Windows\System\dnDkHgA.exe
  C:\Windows\System\dnDkHgA.exe
  2⤵
  PID:12880
- C:\Windows\System\RychpNo.exe
  C:\Windows\System\RychpNo.exe
  2⤵
  PID:12944
- C:\Windows\System\GZZFjVZ.exe
  C:\Windows\System\GZZFjVZ.exe
  2⤵
  PID:13004
- C:\Windows\System\saBccAZ.exe
  C:\Windows\System\saBccAZ.exe
  2⤵
  PID:13092
- C:\Windows\System\UYjJfLU.exe
  C:\Windows\System\UYjJfLU.exe
  2⤵
  PID:1244
- C:\Windows\System\KtkxFzy.exe
  C:\Windows\System\KtkxFzy.exe
  2⤵
  PID:13148
- C:\Windows\System\cikqquP.exe
  C:\Windows\System\cikqquP.exe
  2⤵
  PID:13204
- C:\Windows\System\OKbahIM.exe
  C:\Windows\System\OKbahIM.exe
  2⤵
  PID:13276
- C:\Windows\System\FedwDzj.exe
  C:\Windows\System\FedwDzj.exe
  2⤵
  PID:12300
- C:\Windows\System\vrXlfuO.exe
  C:\Windows\System\vrXlfuO.exe
  2⤵
  PID:12472
- C:\Windows\System\zAtIQps.exe
  C:\Windows\System\zAtIQps.exe
  2⤵
  PID:12616
- C:\Windows\System\ESPgKEI.exe
  C:\Windows\System\ESPgKEI.exe
  2⤵
  PID:12836
- C:\Windows\System\JakzTxh.exe
  C:\Windows\System\JakzTxh.exe
  2⤵
  PID:13000
- C:\Windows\System\bkVQXLa.exe
  C:\Windows\System\bkVQXLa.exe
  2⤵
  PID:13116
- C:\Windows\System\IFANaIN.exe
  C:\Windows\System\IFANaIN.exe
  2⤵
  PID:2504
- C:\Windows\System\rwzXwvT.exe
  C:\Windows\System\rwzXwvT.exe
  2⤵
  PID:12360
- C:\Windows\System\ZspgRly.exe
  C:\Windows\System\ZspgRly.exe
  2⤵
  PID:12796
- C:\Windows\System\oZvUYly.exe
  C:\Windows\System\oZvUYly.exe
  2⤵
  PID:12972
- C:\Windows\System\QFDpCzU.exe
  C:\Windows\System\QFDpCzU.exe
  2⤵
  PID:2176
- C:\Windows\System\UGGGgaC.exe
  C:\Windows\System\UGGGgaC.exe
  2⤵
  PID:3532
- C:\Windows\System\HcLfOMU.exe
  C:\Windows\System\HcLfOMU.exe
  2⤵
  PID:12576
- C:\Windows\System\tOrZcpP.exe
  C:\Windows\System\tOrZcpP.exe
  2⤵
  PID:13332
- C:\Windows\System\gDnFxYA.exe
  C:\Windows\System\gDnFxYA.exe
  2⤵
  PID:13360
- C:\Windows\System\rhXfhAL.exe
  C:\Windows\System\rhXfhAL.exe
  2⤵
  PID:13388
- C:\Windows\System\XlVxPZE.exe
  C:\Windows\System\XlVxPZE.exe
  2⤵
  PID:13416
- C:\Windows\System\RbuXwKB.exe
  C:\Windows\System\RbuXwKB.exe
  2⤵
  PID:13444
- C:\Windows\System\XEzJAOk.exe
  C:\Windows\System\XEzJAOk.exe
  2⤵
  PID:13472
- C:\Windows\System\JPZywFs.exe
  C:\Windows\System\JPZywFs.exe
  2⤵
  PID:13500
- C:\Windows\System\PjjOXHq.exe
  C:\Windows\System\PjjOXHq.exe
  2⤵
  PID:13528
- C:\Windows\System\ogzgmWH.exe
  C:\Windows\System\ogzgmWH.exe
  2⤵
  PID:13556
- C:\Windows\System\PfrSTGB.exe
  C:\Windows\System\PfrSTGB.exe
  2⤵
  PID:13584
- C:\Windows\System\laMHIZL.exe
  C:\Windows\System\laMHIZL.exe
  2⤵
  PID:13612
- C:\Windows\System\fIIWwGl.exe
  C:\Windows\System\fIIWwGl.exe
  2⤵
  PID:13640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hrml3h0q.qzd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BYCallF.exe

Filesize
2.8MB

MD5
f737f288fefdd9353794c6d7b0b1e277

SHA1
b91ae48c41b5f4a410248f73314a4175fbb69f57

SHA256
5c6abc1495fb3f4f13eeb89ceebabf612c7204cb11c97cdb4b6b1ae993393dfa

SHA512
8617356ae262d93de53f99d2ef36929e6f0db93365b4ac7f22d93cca84937e6819419b9043beeaebeefb599f45f487757d97c0301a66f32e5b0cb77491bc48dd

Download Submit
C:\Windows\System\CyuGlNu.exe

Filesize
2.8MB

MD5
80c8d22a0f2d67cb2df0fcde3aa5c508

SHA1
bbd7101ad22fb245ab7c8e2aa54beae84f991962

SHA256
2d862ebf26c97d155fff3b2fbc9a31b55c287cdeab96afb91437af61678374ca

SHA512
e48f6ba35aeb99a2e2db0d5d4d7a5e66bc66f048441877bba3a56d4f65e0df959572808b9e4517e9282d37f891d1f73791a9bdc026e649b3666a2c188fcffb11

Download Submit
C:\Windows\System\DRFGcoa.exe

Filesize
2.8MB

MD5
f1d6d7b30ee4cc31a107123728439e82

SHA1
78522f3e2f4f2cda427c879166efa3af48c1c0d8

SHA256
2d8532a0c084570362e37143cbc8af03d61bbe9db7841a4217236cae3a736b44

SHA512
6b5a5d09e3e0d97265c7feb962eb8f593a90db008e7b391129a5f7ad3cbddccc1a7d8eb2f532d4cdc47f1b5adffb3342023c3550853ce8e50ac5600dc14a0b7e

Download Submit
C:\Windows\System\DdsvbCm.exe

Filesize
2.8MB

MD5
3d9c66d6b9f13d8afee029bfd49aa234

SHA1
104e0364f1bbbf6b4bd3ab913a0069da25b42238

SHA256
b90010dba59fba5a251807fd2818558543644240d63dffe31b9e60b38e93bbb4

SHA512
fa30b35fab22febf572c8700b731d9f6231464ee02ca6e9425fb8985fc5179581801bd1495f50c8b86dace46ab6985481707c34a7e4b8aa595b01081e0f513f2

Download Submit
C:\Windows\System\FRkDHUf.exe

Filesize
2.8MB

MD5
47b17b7cb3a63afd08ca0d88c02e1802

SHA1
570ab9d93175713ca691f023974783b0285fab19

SHA256
5bea0ba4c40b656f30e61259920ebcf981c98280157342dd711ba89f72a3ef9d

SHA512
f5502ba44f62b10187d1d9891ee60368abd220ed94e7a18be2f2301d843e6b6ec377af596aee7e6748abc4e9b2a48b607673410349143a39ca9197c4d984260c

Download Submit
C:\Windows\System\GWMtNwP.exe

Filesize
2.8MB

MD5
249546845d3e8551104b6e815b14c154

SHA1
e3e78764ad036ff2199431f53220b628a3a32cb3

SHA256
a8e148aac36480689be6b87121cf7e808f50880110c65e23b69be4707dabee3f

SHA512
df7b65293cd102c72be1357011eda20d795e53b5f253c3d897fd5cb76d9c8ca503b9fe09cd61e6e4a46dd24a499cf9c89e4325689051aede927d9749e004381b

Download Submit
C:\Windows\System\GwVzxXk.exe

Filesize
2.8MB

MD5
2a34845af6f5e98984a476b70768d793

SHA1
cc8651b4a22cd590dab59052cfe966462a940905

SHA256
3d18a26c6cdb4d1527467e3e9c9c6274a777ca4de4f8cf45e1e8924ae588754a

SHA512
07ffb88c3711d6c97593f975783d73e09c28e8975cdb3db356da76b8a07d30d4d9be616947ecd6079296bf15fd326b21914c90c5bf52395ed488c23d9a0ad01e

Download Submit
C:\Windows\System\HkGgiVG.exe

Filesize
2.8MB

MD5
45cd97f67628aaeb46d517fee8649408

SHA1
6efc4021aebf3376bb9e94402ba5055a6706c989

SHA256
89e48fc291aed02f3234e59c0579e2be52f3e897f9037e57f72d7de63bd9ae75

SHA512
28f4913cdd36e260678ec724fc2cca5db6172e9e023293a7eb1b7e3eaa6bb240cd035f1d5f19edcc1aa9f7439250ece7ac7cfe9f6b937c20f5624668f445f254

Download Submit
C:\Windows\System\IAMXYNE.exe

Filesize
2.8MB

MD5
98413b4e8caa04753b675a3e5ef6703d

SHA1
829b9974f29c0e5dfc9ab8f52abe37968bc89f82

SHA256
bda79ab247766acbe111d0fbfca98e5ca296735cd3c5772a8c9afe180622d35c

SHA512
afb173e7ddcc090f7a99cdb16a1c66cd3cc39346dda79072fdcb87b7aaf80709cc70468f641e154acf96e7c24185d8479bb96a58c84204cd89b3e735faf3d9f4

Download Submit
C:\Windows\System\PtFSlzq.exe

Filesize
2.8MB

MD5
d4dc9f5407a277570dbfd81913411ce2

SHA1
336fe995cf997ffe674bb0739830141c40bc37ec

SHA256
84629c2029493a9a18ea70cbbd72ee337cadc55f5bd22bd1b3466165b7f01060

SHA512
2bf2b7cf7484ff3822dea6e90819fd411dc5281b5cdb54300228d37e37f19d4db1d1fae6f2385ded883c8a9db87f621ccff917dca634eba8156198343f5277e0

Download Submit
C:\Windows\System\TSNFcbm.exe

Filesize
2.8MB

MD5
5e0e92b283a7cab5725908437de723ab

SHA1
780dc4638dbe60b598e0941d9ae2fe1be19ab936

SHA256
cd8e257d0d90330601a94a163766208d2aca4674f4e9284f982bf4a1b25970e0

SHA512
10f6bec66b53decab5357b625e2de6678ccb655de4d35bc400cab8ca1b0edbbd53be62a695a65d9c077d70c1eca0006b41be9a2f9cc297cc8ed4c168adc53eab

Download Submit
C:\Windows\System\UeXygAh.exe

Filesize
2.8MB

MD5
0c126fdca381cf2e4ec51c9963100e3e

SHA1
4b95ea3dfb66bb61a961c9e3721ef6e86f62ecb7

SHA256
8674907da030cd019c838669b9814a990acd940bd70e8f0f4aed5d493fc6d963

SHA512
1de6f0a1c157b80b5e60b97d648046dc3d314840be86d8432e6670af782a133d50e97d016023b41d5cff4f9c1eae2bded7c925bce5ba6452804f8f0de146eba8

Download Submit
C:\Windows\System\UwaIQSH.exe

Filesize
2.8MB

MD5
2a47ebb55f3ef91455469eb2037eacff

SHA1
017da584e77ae7f6c883736394abb7874af8a540

SHA256
3123e1f6ec2cc5fcba63554495855e21ce0619bcaa0f17dbe38e66462594840a

SHA512
a84fa202c4c73c7b7753dd24ec4638b78dc2b4de21510ed518ea85e4694f7c498ff7119986250bcbfe36c1fa375802e4a5b289cc836e377aef67932866bed752

Download Submit
C:\Windows\System\VXlJeZk.exe

Filesize
2.8MB

MD5
cbe20a6b6eb44010220770144c90cb2d

SHA1
4047ab9cf7982239b7f1306d3b4c19ff0481f6a6

SHA256
e5601c86946a79a5abc9cc991d52d60c17983027b8f5cfdcc4e053ba60746318

SHA512
a7870a6cea7e09b6c59b35ecefe57e263d338ec19475b98a48dd474ce7863e602f6053b71574f2115f7fae6fc63d65534b71d2d024fd0fcdf0db5fba48737c4d

Download Submit
C:\Windows\System\WRDDswF.exe

Filesize
2.8MB

MD5
2f55d2f2744355cccc4e1b17e8f9c016

SHA1
38d2b2f0551126e5d1b4ecca288fc18b54338ec6

SHA256
bae55f91e83d3083ff8e1988b7ff04385b09dd8b48c418d4f9a4a0d85cf5ba49

SHA512
91dfefcabf86eb8f0ec70284230e48164f6aaa704b1d2928aa5eaaee575e24bbfdb36730928daa929db03fbf571c8c459123b4e7edf0205d82b30c9adb7e928a

Download Submit
C:\Windows\System\XsurDxH.exe

Filesize
2.8MB

MD5
445bde95bd08da7de9f8d0e61ef82165

SHA1
64f5dfc1e6b75f1de97d37b56e47f6d23a050fe0

SHA256
e9ea68b85c34a6b5dd04481509b463750b71004bd664213f74fb584e66c8f81a

SHA512
33bfe4a0fccbf3ccf1d0459bc4bd0b4850d3f42b553996acf84f63d8897c2fa42c04fd22c2b3a3d3d10be9e139d652c8ce543e36ba75e83e371f7d1dc6ce8227

Download Submit
C:\Windows\System\csMmaEw.exe

Filesize
2.8MB

MD5
5b38f10b498c65147aead20f8894c4d7

SHA1
4a699f3bbbd4db84aca818cafffd7978639d0aa7

SHA256
7e8a303c2153a4aaa7e4869ef70b83cd3bad473bf5429ff9729f4d5350c01504

SHA512
c50a20c5209a84268e400a1a0ee32f759cc3f046195d8d08d6e0b9f5c303cd67cf939f6fd34ab6a9dd89e87596ecabe6af811d62a309847a5dc110cc884c4fc8

Download Submit
C:\Windows\System\duiRLHX.exe

Filesize
2.8MB

MD5
08dc0d55cef336bde7a07a983509611c

SHA1
235f09597d2574e8dc59fdd6db331fa8bc6a174c

SHA256
377e0845b21e94deb0aed5fac18f664a550c879b32a29992a8624da2f497732d

SHA512
2732657084a4e6fd9105d0e3f29644840e6a93c164395cdad4afa69000fde1884a20aa2bf97b5c967f4e47ad5768b3e822fe11accd35aeb906e974f3b47fe8b8

Download Submit
C:\Windows\System\ffyoVKL.exe

Filesize
2.8MB

MD5
def51f962650ca0268c2b14e9502909b

SHA1
f3764703999ff9ce2673d963b44551e8a1192e96

SHA256
7517ea103db9c7001444af47d0ddc2825e3fb1e2523cf16efa3ba3a23dd636bc

SHA512
83865a9d8fb044a9da8f0faf41e6775372d687dc14c05c78d839b3eaf5dd416848453ecd9f5b5ee21b9e2fa69fffabd72412380d4d645fa04ee500adb85b0e40

Download Submit
C:\Windows\System\gdEUXPR.exe

Filesize
2.8MB

MD5
072deec4ff4472e205a3fd401610ec35

SHA1
970b64e5e7c380edbb387ab4940abb809f15e85d

SHA256
39996e05be82d4874d0efcf631d2d0b52e1072dd1e5f710995fc029716eb2d91

SHA512
f26a258b0e02599988361bfac218440a5737e725daa5f0eafcf4b471d5c72a3f885fd6eb47500f42820e92d195c80bef1f3e78e3350f3ee003ee28e34311c9b4

Download Submit
C:\Windows\System\hZwYvJp.exe

Filesize
2.8MB

MD5
c43708ef4a265255c34b13fb745aef04

SHA1
d1734facd0517f128a245e5bf40386d5c653a935

SHA256
cace147e5e31102e5c2e59bde298feede3f01356103e555872614acc54d8eae0

SHA512
552a5804c5146af49f5d1139fc90ccadb7703f07c1f131a316c596ecae9ebc310905f45f4bcb824f34a1e509efa9cfd3f5f01a0af4128983eb6f0c326d092b25

Download Submit
C:\Windows\System\hsjovCO.exe

Filesize
2.8MB

MD5
886d7fc29da4ebba138307432ceb37fe

SHA1
923daddf8f924fabd1396114a574e61417ec2228

SHA256
b13beefd3880337d86e4542cf58039aef8fcb148388959434413e2b477aeb602

SHA512
4e41f608e7a3a8a84a08d67f37e86d99d4e429ccf58a5e5aa8ab8e39c3c0428428493387517cf056c90d35aa993b495cacbbabfdbb93188cbc2941b57765bd87

Download Submit
C:\Windows\System\mFsVhtr.exe

Filesize
2.8MB

MD5
6fef582194439dc659b61ceab018e95a

SHA1
398bd87bf0534be4fb8bc9c08f4a231147f43b1d

SHA256
49f40df6b31171ca879b58cda55bf1d2659754ae294852b1fc98575006a7f36d

SHA512
9ded168770804f377cd4111fe1b6265469d0885af653eb03e8f0f7a705b317c2176b2ccada7761659555ff881d4a06e12f4e3e2af87d7f38a4d901012606a8f1

Download Submit
C:\Windows\System\ojAYUbn.exe

Filesize
2.8MB

MD5
0b25f85498e1e341eed65a0152cc4104

SHA1
a043ceb5452fcbf7366df0a616385533324c030b

SHA256
65b51cc066339ad9bfbd409ae4bbb170c3dd35556b1c06b56dedf3d99d2a5cdb

SHA512
52eeb3fe1eb56814a869356630c63009b9085439d5c6203ff1513e47937aefe061f0e2337964ed192d663c9660bfd3bc8e02a4e37612262c1ce1ab86ab5e8b8a

Download Submit
C:\Windows\System\oqipQWU.exe

Filesize
2.8MB

MD5
e0fb6edbbb721b78a3b1281bb9efba07

SHA1
205a17286cd9e032b56ee30130767741a0019cf2

SHA256
24b48b0d2f7a02c37fbe1e5463df6d777c459a2920c1006d775d705d63e95fb7

SHA512
1d6ba10f63406429a5d65b764e79ab14d7ca7b32911da6949b2747c4c02f4f7b5780b99db87e17579fa436c979557d2a433cab7c5162b5275da5556a1bdf9e02

Download Submit
C:\Windows\System\rEFjOXU.exe

Filesize
2.8MB

MD5
676d608b8bca31c7606b57c45cd4aaa6

SHA1
93142e62ecc52a1b10986f72a4d8722de8e36e4b

SHA256
3e6e3eba7455157a213dda47811f3e68973dcb47066cdbeb4cb495a7f8e12f3d

SHA512
30c82fb0ae37756cdfa22bc7bfdf2c778b5fd8578731473f28d8c41babd2b730e8f82b24c772d2fcf24acacf36ada3f0bfe94e9fb77795269c1d20bf34b4a731

Download Submit
C:\Windows\System\rboLqZC.exe

Filesize
8B

MD5
f5de367e14d93143ef1faedf842e5b6d

SHA1
53c34a3e3da8f1f6c2e9e53890e9edf2ff008d74

SHA256
36e55333ae3d5576ba03b741cb1c838f247aac6b1cd7cdcee267d53cebe8decc

SHA512
0b231b233512c747cdbb209c99fd8472d55d97087002ae2f0851082cba32457ea0555a830f41369229ad1917eed68b9237ee47ec40ef110da72ae97f30abe677

Download Submit
C:\Windows\System\uuassxv.exe

Filesize
2.8MB

MD5
8a183139ddf072e87c28da1c632b31e6

SHA1
cc7763519a17edee1b78dd0ceb26e5605fab0539

SHA256
7275d55672379a71cb1c426ad7ec58b549665ef93b1487a557e2be67952cbbd9

SHA512
8b22f7142964071ba5e4f9fd043937ef09f149872fae6d89c666719fbdf0c408b4370319a433fd3baece47b77e7a4bbb32b039abe08d49467699234d6ec573df

Download Submit
C:\Windows\System\vJHGRFo.exe

Filesize
2.8MB

MD5
71b88013f0222a78ffc8fa34500b1340

SHA1
b940a41578405e6215493828c92b605642bfe2c3

SHA256
052ec63508f0a8a82bdd7c4c2f42fef816bd88d63d87a5e4b46d14e4a64f73ac

SHA512
eabe2871cc4503280f3bcbc3ea860639803c73249e876b8a34269f13703a3b53c461c0babdbc0b1b4802d7f843bd5dc68d69d10ecd21c17b629d6fbc3c6f0a58

Download Submit
C:\Windows\System\vUdGZzw.exe

Filesize
2.8MB

MD5
345b0b1f35fa8edb2e12be8f0c5a10bb

SHA1
c2da4a4fa8f4ee845e4942cc9eb5df04122e2cc2

SHA256
bf77caf987049a984718b9c3680361f4a04910ae8961388696d813d4b13707d2

SHA512
7739521ff3a330ff5d270712f60a2361608858d4c1080e5883573c89a97095899bfe183fadce19b06e316087407cbbca9ac33fdbeb6a01cb721a93e45f74755f

Download Submit
C:\Windows\System\vxMVGum.exe

Filesize
2.8MB

MD5
e285fabf30b476b66c2732bbb3496001

SHA1
94395fd1fadee6f94fe9547f8cd473c0ddaaf253

SHA256
a8b50f30220d07ce753d06f55339070dbe6a6a6a2687c4be180fb374a8a4fe20

SHA512
9a7b492b5fc3ea5a7d9f8ac18e15c56b6cc251c4ea49351c4dfcd585357c8a1687214986138435aef50940b4455556902730db26f9b69928270cebebb7a2187c

Download Submit
C:\Windows\System\wHzYcDU.exe

Filesize
2.8MB

MD5
4dbe68ae6bfe86ba38963885d5d9e9b2

SHA1
5dbccb1ef3f520f0dec3186d6a9efeeb4f9ebad1

SHA256
e9fb28aa3dbd9f0a5bdf8450013957d7e9ca9a9148281250083c07db26e4cfa8

SHA512
ad4c3aaaea0a79551a69c4caed73bb3c8238b26403d778e7315f22c69fe9b77f21530ba63626a773d43dca8be06a24f412dface15e3b67d95d34605fef8b6a78

Download Submit
C:\Windows\System\wvkbhtg.exe

Filesize
2.8MB

MD5
f264bbe8bc3d41376d412a4a2f3eb2d2

SHA1
4469f6b6d435c2431f66b2ad9a771e55dd46ffd8

SHA256
0c5fbb2d7e2d8ccb06ba51c3ff609997877d44c51f18c1df2eca16933e60e986

SHA512
acea6708abe4d7d59c28513ac1f7ab74ad286b379bb1de6f2e50657fd4603652ee63cc98fc4c6288795c11e119441967f3a3f69a52f39be287eb52ca59b07a4a

Download Submit
memory/32-324-0x00007FF64A760000-0x00007FF64AB56000-memory.dmp

Filesize
4.0MB

Download
memory/32-2322-0x00007FF64A760000-0x00007FF64AB56000-memory.dmp

Filesize
4.0MB

Download
memory/320-63-0x00007FF655890000-0x00007FF655C86000-memory.dmp

Filesize
4.0MB

Download
memory/320-2310-0x00007FF655890000-0x00007FF655C86000-memory.dmp

Filesize
4.0MB

Download
memory/320-329-0x00007FF655890000-0x00007FF655C86000-memory.dmp

Filesize
4.0MB

Download
memory/684-2308-0x00007FF7AD950000-0x00007FF7ADD46000-memory.dmp

Filesize
4.0MB

Download
memory/684-60-0x00007FF7AD950000-0x00007FF7ADD46000-memory.dmp

Filesize
4.0MB

Download
memory/1064-57-0x00007FF6723B0000-0x00007FF6727A6000-memory.dmp

Filesize
4.0MB

Download
memory/1064-2307-0x00007FF6723B0000-0x00007FF6727A6000-memory.dmp

Filesize
4.0MB

Download
memory/1388-92-0x00007FF617240000-0x00007FF617636000-memory.dmp

Filesize
4.0MB

Download
memory/1388-2314-0x00007FF617240000-0x00007FF617636000-memory.dmp

Filesize
4.0MB

Download
memory/1388-467-0x00007FF617240000-0x00007FF617636000-memory.dmp

Filesize
4.0MB

Download
memory/1700-2309-0x00007FF644EF0000-0x00007FF6452E6000-memory.dmp

Filesize
4.0MB

Download
memory/1700-59-0x00007FF644EF0000-0x00007FF6452E6000-memory.dmp

Filesize
4.0MB

Download
memory/1892-864-0x00007FF6E0330000-0x00007FF6E0726000-memory.dmp

Filesize
4.0MB

Download
memory/1892-2323-0x00007FF6E0330000-0x00007FF6E0726000-memory.dmp

Filesize
4.0MB

Download
memory/1892-272-0x00007FF6E0330000-0x00007FF6E0726000-memory.dmp

Filesize
4.0MB

Download
memory/2208-861-0x00007FF77B5A0000-0x00007FF77B996000-memory.dmp

Filesize
4.0MB

Download
memory/2208-2321-0x00007FF77B5A0000-0x00007FF77B996000-memory.dmp

Filesize
4.0MB

Download
memory/2208-266-0x00007FF77B5A0000-0x00007FF77B996000-memory.dmp

Filesize
4.0MB

Download
memory/2256-206-0x00007FF726360000-0x00007FF726756000-memory.dmp

Filesize
4.0MB

Download
memory/2256-1-0x000001FD7BEE0000-0x000001FD7BEF0000-memory.dmp

Filesize
64KB

Download
memory/2256-0-0x00007FF726360000-0x00007FF726756000-memory.dmp

Filesize
4.0MB

Download
memory/2592-441-0x00007FF7FA820000-0x00007FF7FAC16000-memory.dmp

Filesize
4.0MB

Download
memory/2592-2311-0x00007FF7FA820000-0x00007FF7FAC16000-memory.dmp

Filesize
4.0MB

Download
memory/2592-77-0x00007FF7FA820000-0x00007FF7FAC16000-memory.dmp

Filesize
4.0MB

Download
memory/2748-528-0x00007FF7013B0000-0x00007FF7017A6000-memory.dmp

Filesize
4.0MB

Download
memory/2748-2315-0x00007FF7013B0000-0x00007FF7017A6000-memory.dmp

Filesize
4.0MB

Download
memory/2748-96-0x00007FF7013B0000-0x00007FF7017A6000-memory.dmp

Filesize
4.0MB

Download
memory/2836-302-0x00007FF783150000-0x00007FF783546000-memory.dmp

Filesize
4.0MB

Download
memory/2836-2318-0x00007FF783150000-0x00007FF783546000-memory.dmp

Filesize
4.0MB

Download
memory/2904-209-0x00007FF65EC50000-0x00007FF65F046000-memory.dmp

Filesize
4.0MB

Download
memory/2904-2316-0x00007FF65EC50000-0x00007FF65F046000-memory.dmp

Filesize
4.0MB

Download
memory/2920-2304-0x00007FF7E61F0000-0x00007FF7E65E6000-memory.dmp

Filesize
4.0MB

Download
memory/2920-54-0x00007FF7E61F0000-0x00007FF7E65E6000-memory.dmp

Filesize
4.0MB

Download
memory/3136-219-0x00007FFDBC993000-0x00007FFDBC995000-memory.dmp

Filesize
8KB

Download
memory/3136-6-0x00007FFDBC993000-0x00007FFDBC995000-memory.dmp

Filesize
8KB

Download
memory/3136-435-0x0000029A983F0000-0x0000029A9860C000-memory.dmp

Filesize
2.1MB

Download
memory/3136-64-0x0000029B007B0000-0x0000029B00F56000-memory.dmp

Filesize
7.6MB

Download
memory/3136-20-0x00007FFDBC990000-0x00007FFDBD451000-memory.dmp

Filesize
10.8MB

Download
memory/3136-49-0x00007FFDBC990000-0x00007FFDBD451000-memory.dmp

Filesize
10.8MB

Download
memory/3136-208-0x00007FFDBC990000-0x00007FFDBD451000-memory.dmp

Filesize
10.8MB

Download
memory/3136-247-0x00007FFDBC990000-0x00007FFDBD451000-memory.dmp

Filesize
10.8MB

Download
memory/3136-43-0x0000029AFFB30000-0x0000029AFFB52000-memory.dmp

Filesize
136KB

Download
memory/3204-336-0x00007FF7794F0000-0x00007FF7798E6000-memory.dmp

Filesize
4.0MB

Download
memory/3204-2324-0x00007FF7794F0000-0x00007FF7798E6000-memory.dmp

Filesize
4.0MB

Download
memory/3320-262-0x00007FF7B9790000-0x00007FF7B9B86000-memory.dmp

Filesize
4.0MB

Download
memory/3320-2317-0x00007FF7B9790000-0x00007FF7B9B86000-memory.dmp

Filesize
4.0MB

Download
memory/3412-2306-0x00007FF61C6C0000-0x00007FF61CAB6000-memory.dmp

Filesize
4.0MB

Download
memory/3412-28-0x00007FF61C6C0000-0x00007FF61CAB6000-memory.dmp

Filesize
4.0MB

Download
memory/3776-207-0x00007FF7E54D0000-0x00007FF7E58C6000-memory.dmp

Filesize
4.0MB

Download
memory/3776-9-0x00007FF7E54D0000-0x00007FF7E58C6000-memory.dmp

Filesize
4.0MB

Download
memory/3776-2303-0x00007FF7E54D0000-0x00007FF7E58C6000-memory.dmp

Filesize
4.0MB

Download
memory/3844-2305-0x00007FF672AB0000-0x00007FF672EA6000-memory.dmp

Filesize
4.0MB

Download
memory/3844-30-0x00007FF672AB0000-0x00007FF672EA6000-memory.dmp

Filesize
4.0MB

Download
memory/4360-2320-0x00007FF7747F0000-0x00007FF774BE6000-memory.dmp

Filesize
4.0MB

Download
memory/4360-305-0x00007FF7747F0000-0x00007FF774BE6000-memory.dmp

Filesize
4.0MB

Download
memory/4396-348-0x00007FF772650000-0x00007FF772A46000-memory.dmp

Filesize
4.0MB

Download
memory/4396-2325-0x00007FF772650000-0x00007FF772A46000-memory.dmp

Filesize
4.0MB

Download
memory/4700-444-0x00007FF6B2CD0000-0x00007FF6B30C6000-memory.dmp

Filesize
4.0MB

Download
memory/4700-84-0x00007FF6B2CD0000-0x00007FF6B30C6000-memory.dmp

Filesize
4.0MB

Download
memory/4700-2313-0x00007FF6B2CD0000-0x00007FF6B30C6000-memory.dmp

Filesize
4.0MB

Download
memory/4908-352-0x00007FF79F040000-0x00007FF79F436000-memory.dmp

Filesize
4.0MB

Download
memory/4908-1191-0x00007FF79F040000-0x00007FF79F436000-memory.dmp

Filesize
4.0MB

Download
memory/4908-2326-0x00007FF79F040000-0x00007FF79F436000-memory.dmp

Filesize
4.0MB

Download
memory/4980-2312-0x00007FF6789B0000-0x00007FF678DA6000-memory.dmp

Filesize
4.0MB

Download
memory/4980-72-0x00007FF6789B0000-0x00007FF678DA6000-memory.dmp

Filesize
4.0MB

Download
memory/4980-355-0x00007FF6789B0000-0x00007FF678DA6000-memory.dmp

Filesize
4.0MB

Download
memory/5080-317-0x00007FF69BAC0000-0x00007FF69BEB6000-memory.dmp

Filesize
4.0MB

Download
memory/5080-2319-0x00007FF69BAC0000-0x00007FF69BEB6000-memory.dmp

Filesize
4.0MB

Download