xmrig | 5319e810e34d4cfb9b23756e8969625203010bb0fcf8c99dc0357c762e248455

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2577b63fe6dcf1c7f158e0b24f3ff440N.exe
Size

2.9MB
MD5

2577b63fe6dcf1c7f158e0b24f3ff440
SHA1

677ee8d8700b16c29967b5780801e0d80e699cd9
SHA256

5319e810e34d4cfb9b23756e8969625203010bb0fcf8c99dc0357c762e248455
SHA512

b1e583f44c2d1c0f8384e2f421820e897385a734435495ee40b909d5d9a5f04657873717e5c2990db35169cbb17c0f0c802622ed794f270e9d57ba48012506b2
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkibTIA5LDGTDRkd:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1968-0-0x00007FF6D7600000-0x00007FF6D79F6000-memory.dmp	xmrig
behavioral2/files/0x000800000002343b-6.dat	xmrig
behavioral2/files/0x000700000002343f-9.dat	xmrig
behavioral2/files/0x0007000000023443-23.dat	xmrig
behavioral2/files/0x0007000000023440-26.dat	xmrig
behavioral2/memory/3172-61-0x00007FF6406C0000-0x00007FF640AB6000-memory.dmp	xmrig
behavioral2/files/0x000700000002344d-74.dat	xmrig
behavioral2/memory/3632-100-0x00007FF7229D0000-0x00007FF722DC6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023456-131.dat	xmrig
behavioral2/files/0x000700000002345a-156.dat	xmrig
behavioral2/files/0x0007000000023460-181.dat	xmrig
behavioral2/memory/320-192-0x00007FF6754F0000-0x00007FF6758E6000-memory.dmp	xmrig
behavioral2/memory/1936-201-0x00007FF6A6B70000-0x00007FF6A6F66000-memory.dmp	xmrig
behavioral2/memory/3340-206-0x00007FF74F140000-0x00007FF74F536000-memory.dmp	xmrig
behavioral2/memory/3248-210-0x00007FF6A7AF0000-0x00007FF6A7EE6000-memory.dmp	xmrig
behavioral2/memory/872-213-0x00007FF741920000-0x00007FF741D16000-memory.dmp	xmrig
behavioral2/memory/1068-212-0x00007FF786EA0000-0x00007FF787296000-memory.dmp	xmrig
behavioral2/memory/1504-211-0x00007FF627390000-0x00007FF627786000-memory.dmp	xmrig
behavioral2/memory/368-208-0x00007FF639090000-0x00007FF639486000-memory.dmp	xmrig
behavioral2/memory/696-207-0x00007FF6CCAB0000-0x00007FF6CCEA6000-memory.dmp	xmrig
behavioral2/memory/2500-205-0x00007FF677420000-0x00007FF677816000-memory.dmp	xmrig
behavioral2/memory/392-204-0x00007FF6A7780000-0x00007FF6A7B76000-memory.dmp	xmrig
behavioral2/memory/1048-203-0x00007FF6119A0000-0x00007FF611D96000-memory.dmp	xmrig
behavioral2/memory/2600-202-0x00007FF72BAA0000-0x00007FF72BE96000-memory.dmp	xmrig
behavioral2/memory/220-200-0x00007FF6BA2C0000-0x00007FF6BA6B6000-memory.dmp	xmrig
behavioral2/memory/2460-197-0x00007FF6AB640000-0x00007FF6ABA36000-memory.dmp	xmrig
behavioral2/files/0x0007000000023459-185.dat	xmrig
behavioral2/files/0x0007000000023461-184.dat	xmrig
behavioral2/files/0x0008000000023452-183.dat	xmrig
behavioral2/memory/4860-182-0x00007FF797520000-0x00007FF797916000-memory.dmp	xmrig
behavioral2/files/0x000700000002345f-178.dat	xmrig
behavioral2/files/0x0007000000023455-175.dat	xmrig
behavioral2/files/0x000800000002343c-174.dat	xmrig
behavioral2/files/0x000700000002345e-171.dat	xmrig
behavioral2/files/0x0007000000023458-169.dat	xmrig
behavioral2/memory/1380-166-0x00007FF7C6150000-0x00007FF7C6546000-memory.dmp	xmrig
behavioral2/memory/1308-165-0x00007FF7258D0000-0x00007FF725CC6000-memory.dmp	xmrig
behavioral2/files/0x000700000002345d-164.dat	xmrig
behavioral2/files/0x0007000000023457-162.dat	xmrig
behavioral2/files/0x000700000002345c-161.dat	xmrig
behavioral2/files/0x000700000002345b-160.dat	xmrig
behavioral2/files/0x0007000000023451-153.dat	xmrig
behavioral2/files/0x0007000000023454-152.dat	xmrig
behavioral2/files/0x0008000000023453-144.dat	xmrig
behavioral2/files/0x000700000002344f-142.dat	xmrig
behavioral2/memory/2332-136-0x00007FF7659E0000-0x00007FF765DD6000-memory.dmp	xmrig
behavioral2/files/0x000700000002344c-121.dat	xmrig
behavioral2/files/0x000700000002344a-118.dat	xmrig
behavioral2/files/0x000700000002344e-115.dat	xmrig
behavioral2/memory/4660-112-0x00007FF660A60000-0x00007FF660E56000-memory.dmp	xmrig
behavioral2/files/0x0007000000023450-128.dat	xmrig
behavioral2/files/0x000700000002344b-104.dat	xmrig
behavioral2/files/0x0007000000023449-92.dat	xmrig
behavioral2/files/0x0007000000023447-89.dat	xmrig
behavioral2/files/0x0007000000023446-103.dat	xmrig
behavioral2/memory/1612-87-0x00007FF700F80000-0x00007FF701376000-memory.dmp	xmrig
behavioral2/files/0x0007000000023444-73.dat	xmrig
behavioral2/files/0x0007000000023448-69.dat	xmrig
behavioral2/memory/864-48-0x00007FF740B60000-0x00007FF740F56000-memory.dmp	xmrig
behavioral2/files/0x0007000000023445-43.dat	xmrig
behavioral2/files/0x0007000000023442-33.dat	xmrig
behavioral2/files/0x0007000000023441-28.dat	xmrig
behavioral2/memory/1968-1114-0x00007FF6D7600000-0x00007FF6D79F6000-memory.dmp	xmrig
behavioral2/memory/864-2596-0x00007FF740B60000-0x00007FF740F56000-memory.dmp	xmrig

Blocklisted process makes network request 17 IoCs

flow	pid	Process
8	4968	powershell.exe
16	4968	powershell.exe
23	4968	powershell.exe
24	4968	powershell.exe
25	4968	powershell.exe
27	4968	powershell.exe
28	4968	powershell.exe
29	4968	powershell.exe
30	4968	powershell.exe
31	4968	powershell.exe
32	4968	powershell.exe
34	4968	powershell.exe
35	4968	powershell.exe
36	4968	powershell.exe
37	4968	powershell.exe
38	4968	powershell.exe
39	4968	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4968	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
864	QybHSDV.exe
3172	IcVQVcD.exe
1612	NUJldnr.exe
3632	ebSLiON.exe
4660	IyEiIYx.exe
2332	pXohRNw.exe
1308	izLLgCG.exe
1380	koEpEpd.exe
3248	QgtAvPP.exe
4860	ZQuLBfW.exe
320	GQSFHVB.exe
2460	vHTFozS.exe
220	RGKdtnb.exe
1936	TAzqIDF.exe
2600	HlSqpPA.exe
1504	HUjrWQS.exe
1048	ciNtRff.exe
392	MguuATR.exe
2500	hgooLsa.exe
3340	YMRdLcb.exe
1068	aNMeVoc.exe
872	FHePtDc.exe
696	OdHQUPj.exe
368	wxEJtTA.exe
2736	ISJgXso.exe
4664	wXbGJfY.exe
2932	jQIjmvH.exe
508	YQuHAol.exe
1028	JvChEtj.exe
4648	vdGYWrF.exe
4396	JrWbQjw.exe
4176	UAlYdjI.exe
1580	pltykOp.exe
1320	fiUVIHq.exe
3708	jwESHKr.exe
2988	hMpooxW.exe
1796	YMgxckm.exe
1916	YhLHjaN.exe
2832	yzDojuJ.exe
3524	VUGCdgy.exe
3988	uczmfEm.exe
2452	qcjhdSX.exe
4856	rJjLYvk.exe
4092	dcjiGbe.exe
4476	iHMFUgj.exe
4456	VSzqKdP.exe
5052	HkUYPjg.exe
3008	kvPWWLd.exe
3540	NUKlrBV.exe
3648	neqQGsD.exe
1524	HrqlQXx.exe
2812	BDrBRec.exe
3892	fNDfEbh.exe
3224	aOSnniE.exe
4568	BaicYWu.exe
212	ITAdMCP.exe
1848	wVlDzKl.exe
2508	GsxRTzE.exe
4612	VQHJwny.exe
4524	uIKBonp.exe
4416	UjKWcRn.exe
3516	DjbxQOB.exe
1128	XdtpcRC.exe
4488	WgluBdw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1968-0-0x00007FF6D7600000-0x00007FF6D79F6000-memory.dmp	upx
behavioral2/files/0x000800000002343b-6.dat	upx
behavioral2/files/0x000700000002343f-9.dat	upx
behavioral2/files/0x0007000000023443-23.dat	upx
behavioral2/files/0x0007000000023440-26.dat	upx
behavioral2/memory/3172-61-0x00007FF6406C0000-0x00007FF640AB6000-memory.dmp	upx
behavioral2/files/0x000700000002344d-74.dat	upx
behavioral2/memory/3632-100-0x00007FF7229D0000-0x00007FF722DC6000-memory.dmp	upx
behavioral2/files/0x0007000000023456-131.dat	upx
behavioral2/files/0x000700000002345a-156.dat	upx
behavioral2/files/0x0007000000023460-181.dat	upx
behavioral2/memory/320-192-0x00007FF6754F0000-0x00007FF6758E6000-memory.dmp	upx
behavioral2/memory/1936-201-0x00007FF6A6B70000-0x00007FF6A6F66000-memory.dmp	upx
behavioral2/memory/3340-206-0x00007FF74F140000-0x00007FF74F536000-memory.dmp	upx
behavioral2/memory/3248-210-0x00007FF6A7AF0000-0x00007FF6A7EE6000-memory.dmp	upx
behavioral2/memory/872-213-0x00007FF741920000-0x00007FF741D16000-memory.dmp	upx
behavioral2/memory/1068-212-0x00007FF786EA0000-0x00007FF787296000-memory.dmp	upx
behavioral2/memory/1504-211-0x00007FF627390000-0x00007FF627786000-memory.dmp	upx
behavioral2/memory/368-208-0x00007FF639090000-0x00007FF639486000-memory.dmp	upx
behavioral2/memory/696-207-0x00007FF6CCAB0000-0x00007FF6CCEA6000-memory.dmp	upx
behavioral2/memory/2500-205-0x00007FF677420000-0x00007FF677816000-memory.dmp	upx
behavioral2/memory/392-204-0x00007FF6A7780000-0x00007FF6A7B76000-memory.dmp	upx
behavioral2/memory/1048-203-0x00007FF6119A0000-0x00007FF611D96000-memory.dmp	upx
behavioral2/memory/2600-202-0x00007FF72BAA0000-0x00007FF72BE96000-memory.dmp	upx
behavioral2/memory/220-200-0x00007FF6BA2C0000-0x00007FF6BA6B6000-memory.dmp	upx
behavioral2/memory/2460-197-0x00007FF6AB640000-0x00007FF6ABA36000-memory.dmp	upx
behavioral2/files/0x0007000000023459-185.dat	upx
behavioral2/files/0x0007000000023461-184.dat	upx
behavioral2/files/0x0008000000023452-183.dat	upx
behavioral2/memory/4860-182-0x00007FF797520000-0x00007FF797916000-memory.dmp	upx
behavioral2/files/0x000700000002345f-178.dat	upx
behavioral2/files/0x0007000000023455-175.dat	upx
behavioral2/files/0x000800000002343c-174.dat	upx
behavioral2/files/0x000700000002345e-171.dat	upx
behavioral2/files/0x0007000000023458-169.dat	upx
behavioral2/memory/1380-166-0x00007FF7C6150000-0x00007FF7C6546000-memory.dmp	upx
behavioral2/memory/1308-165-0x00007FF7258D0000-0x00007FF725CC6000-memory.dmp	upx
behavioral2/files/0x000700000002345d-164.dat	upx
behavioral2/files/0x0007000000023457-162.dat	upx
behavioral2/files/0x000700000002345c-161.dat	upx
behavioral2/files/0x000700000002345b-160.dat	upx
behavioral2/files/0x0007000000023451-153.dat	upx
behavioral2/files/0x0007000000023454-152.dat	upx
behavioral2/files/0x0008000000023453-144.dat	upx
behavioral2/files/0x000700000002344f-142.dat	upx
behavioral2/memory/2332-136-0x00007FF7659E0000-0x00007FF765DD6000-memory.dmp	upx
behavioral2/files/0x000700000002344c-121.dat	upx
behavioral2/files/0x000700000002344a-118.dat	upx
behavioral2/files/0x000700000002344e-115.dat	upx
behavioral2/memory/4660-112-0x00007FF660A60000-0x00007FF660E56000-memory.dmp	upx
behavioral2/files/0x0007000000023450-128.dat	upx
behavioral2/files/0x000700000002344b-104.dat	upx
behavioral2/files/0x0007000000023449-92.dat	upx
behavioral2/files/0x0007000000023447-89.dat	upx
behavioral2/files/0x0007000000023446-103.dat	upx
behavioral2/memory/1612-87-0x00007FF700F80000-0x00007FF701376000-memory.dmp	upx
behavioral2/files/0x0007000000023444-73.dat	upx
behavioral2/files/0x0007000000023448-69.dat	upx
behavioral2/memory/864-48-0x00007FF740B60000-0x00007FF740F56000-memory.dmp	upx
behavioral2/files/0x0007000000023445-43.dat	upx
behavioral2/files/0x0007000000023442-33.dat	upx
behavioral2/files/0x0007000000023441-28.dat	upx
behavioral2/memory/1968-1114-0x00007FF6D7600000-0x00007FF6D79F6000-memory.dmp	upx
behavioral2/memory/864-2596-0x00007FF740B60000-0x00007FF740F56000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XLgUVLj.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\DsANieE.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\joeTysu.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\gyTazxi.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\IgCnLpQ.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\LTIqMXx.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\hheVJaH.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\wowYZfp.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\zNSFXYK.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\WZXfZSS.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\XHDrlCG.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\iDMrFqk.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\nNXKHcc.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\UOfdxns.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\SFJMwOs.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\JghkHBK.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\cEpyAeF.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\UqjRHfK.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\EqzevLW.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\RJxeShU.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\CeMQnnl.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\CuZIOyK.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\rOoHTmA.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\rzMjgAI.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\UVjyHEb.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\PDKXMdT.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\nPUOjHB.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\kgGHSpO.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\velJTGz.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\ZINmlLV.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\mSDojua.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\EDJIXCA.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\EFpYABa.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\gikLxpK.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\FhWJxQY.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\aQFnIha.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\bGlaMrZ.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\ZnguBop.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\YkfRFUf.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\puNkzVE.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\BITMSRr.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\SDEACyO.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\tkPTLeW.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\UWKjtOx.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\fdfmbaK.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\kRDjcyk.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\LvFMbts.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\GuUQgKp.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\IrhtIRR.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\GqOhyDq.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\LvXIwZn.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\jYzQKdZ.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\aZKXeHZ.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\sEoxSBm.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\UsCKeLd.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\JrWbQjw.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\WgluBdw.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\fCteynW.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\pBWlFGO.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\HijIVSb.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\NhxFAAg.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\jJGweWa.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\nxyhdad.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
File created	C:\Windows\System\OFlCMQD.exe	2577b63fe6dcf1c7f158e0b24f3ff440N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeLockMemoryPrivilege	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4968	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	86
PID 1968 wrote to memory of 4968	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	86
PID 1968 wrote to memory of 864	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	87
PID 1968 wrote to memory of 864	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	87
PID 1968 wrote to memory of 3172	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	88
PID 1968 wrote to memory of 3172	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	88
PID 1968 wrote to memory of 1612	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	89
PID 1968 wrote to memory of 1612	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	89
PID 1968 wrote to memory of 3632	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	90
PID 1968 wrote to memory of 3632	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	90
PID 1968 wrote to memory of 4660	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	91
PID 1968 wrote to memory of 4660	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	91
PID 1968 wrote to memory of 2332	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	92
PID 1968 wrote to memory of 2332	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	92
PID 1968 wrote to memory of 1308	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	93
PID 1968 wrote to memory of 1308	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	93
PID 1968 wrote to memory of 1380	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	94
PID 1968 wrote to memory of 1380	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	94
PID 1968 wrote to memory of 3248	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	95
PID 1968 wrote to memory of 3248	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	95
PID 1968 wrote to memory of 4860	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	96
PID 1968 wrote to memory of 4860	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	96
PID 1968 wrote to memory of 320	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	97
PID 1968 wrote to memory of 320	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	97
PID 1968 wrote to memory of 2460	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	98
PID 1968 wrote to memory of 2460	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	98
PID 1968 wrote to memory of 220	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	99
PID 1968 wrote to memory of 220	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	99
PID 1968 wrote to memory of 1936	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	100
PID 1968 wrote to memory of 1936	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	100
PID 1968 wrote to memory of 392	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	101
PID 1968 wrote to memory of 392	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	101
PID 1968 wrote to memory of 2600	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	102
PID 1968 wrote to memory of 2600	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	102
PID 1968 wrote to memory of 1504	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	103
PID 1968 wrote to memory of 1504	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	103
PID 1968 wrote to memory of 1048	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	104
PID 1968 wrote to memory of 1048	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	104
PID 1968 wrote to memory of 2500	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	105
PID 1968 wrote to memory of 2500	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	105
PID 1968 wrote to memory of 3340	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	106
PID 1968 wrote to memory of 3340	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	106
PID 1968 wrote to memory of 1068	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	107
PID 1968 wrote to memory of 1068	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	107
PID 1968 wrote to memory of 872	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	108
PID 1968 wrote to memory of 872	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	108
PID 1968 wrote to memory of 696	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	109
PID 1968 wrote to memory of 696	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	109
PID 1968 wrote to memory of 368	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	110
PID 1968 wrote to memory of 368	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	110
PID 1968 wrote to memory of 2736	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	111
PID 1968 wrote to memory of 2736	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	111
PID 1968 wrote to memory of 4396	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	112
PID 1968 wrote to memory of 4396	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	112
PID 1968 wrote to memory of 4664	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	113
PID 1968 wrote to memory of 4664	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	113
PID 1968 wrote to memory of 2932	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	114
PID 1968 wrote to memory of 2932	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	114
PID 1968 wrote to memory of 508	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	115
PID 1968 wrote to memory of 508	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	115
PID 1968 wrote to memory of 1028	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	116
PID 1968 wrote to memory of 1028	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	116
PID 1968 wrote to memory of 4648	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	117
PID 1968 wrote to memory of 4648	1968	2577b63fe6dcf1c7f158e0b24f3ff440N.exe	117

C:\Users\Admin\AppData\Local\Temp\2577b63fe6dcf1c7f158e0b24f3ff440N.exe
"C:\Users\Admin\AppData\Local\Temp\2577b63fe6dcf1c7f158e0b24f3ff440N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\System\QybHSDV.exe
  C:\Windows\System\QybHSDV.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\IcVQVcD.exe
  C:\Windows\System\IcVQVcD.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\NUJldnr.exe
  C:\Windows\System\NUJldnr.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ebSLiON.exe
  C:\Windows\System\ebSLiON.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\IyEiIYx.exe
  C:\Windows\System\IyEiIYx.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\pXohRNw.exe
  C:\Windows\System\pXohRNw.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\izLLgCG.exe
  C:\Windows\System\izLLgCG.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\koEpEpd.exe
  C:\Windows\System\koEpEpd.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\QgtAvPP.exe
  C:\Windows\System\QgtAvPP.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\ZQuLBfW.exe
  C:\Windows\System\ZQuLBfW.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\GQSFHVB.exe
  C:\Windows\System\GQSFHVB.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\vHTFozS.exe
  C:\Windows\System\vHTFozS.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\RGKdtnb.exe
  C:\Windows\System\RGKdtnb.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\TAzqIDF.exe
  C:\Windows\System\TAzqIDF.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\MguuATR.exe
  C:\Windows\System\MguuATR.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\HlSqpPA.exe
  C:\Windows\System\HlSqpPA.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\HUjrWQS.exe
  C:\Windows\System\HUjrWQS.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\ciNtRff.exe
  C:\Windows\System\ciNtRff.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\hgooLsa.exe
  C:\Windows\System\hgooLsa.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\YMRdLcb.exe
  C:\Windows\System\YMRdLcb.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\aNMeVoc.exe
  C:\Windows\System\aNMeVoc.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\FHePtDc.exe
  C:\Windows\System\FHePtDc.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\OdHQUPj.exe
  C:\Windows\System\OdHQUPj.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\wxEJtTA.exe
  C:\Windows\System\wxEJtTA.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\ISJgXso.exe
  C:\Windows\System\ISJgXso.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\JrWbQjw.exe
  C:\Windows\System\JrWbQjw.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\wXbGJfY.exe
  C:\Windows\System\wXbGJfY.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\jQIjmvH.exe
  C:\Windows\System\jQIjmvH.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\YQuHAol.exe
  C:\Windows\System\YQuHAol.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\JvChEtj.exe
  C:\Windows\System\JvChEtj.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\vdGYWrF.exe
  C:\Windows\System\vdGYWrF.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\UAlYdjI.exe
  C:\Windows\System\UAlYdjI.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\pltykOp.exe
  C:\Windows\System\pltykOp.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\fiUVIHq.exe
  C:\Windows\System\fiUVIHq.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\jwESHKr.exe
  C:\Windows\System\jwESHKr.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\hMpooxW.exe
  C:\Windows\System\hMpooxW.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\YMgxckm.exe
  C:\Windows\System\YMgxckm.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\YhLHjaN.exe
  C:\Windows\System\YhLHjaN.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\yzDojuJ.exe
  C:\Windows\System\yzDojuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\VUGCdgy.exe
  C:\Windows\System\VUGCdgy.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\uczmfEm.exe
  C:\Windows\System\uczmfEm.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\qcjhdSX.exe
  C:\Windows\System\qcjhdSX.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\rJjLYvk.exe
  C:\Windows\System\rJjLYvk.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\dcjiGbe.exe
  C:\Windows\System\dcjiGbe.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\iHMFUgj.exe
  C:\Windows\System\iHMFUgj.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\VSzqKdP.exe
  C:\Windows\System\VSzqKdP.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\HkUYPjg.exe
  C:\Windows\System\HkUYPjg.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\kvPWWLd.exe
  C:\Windows\System\kvPWWLd.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\NUKlrBV.exe
  C:\Windows\System\NUKlrBV.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\neqQGsD.exe
  C:\Windows\System\neqQGsD.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\HrqlQXx.exe
  C:\Windows\System\HrqlQXx.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\BDrBRec.exe
  C:\Windows\System\BDrBRec.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\fNDfEbh.exe
  C:\Windows\System\fNDfEbh.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\aOSnniE.exe
  C:\Windows\System\aOSnniE.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\BaicYWu.exe
  C:\Windows\System\BaicYWu.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\ITAdMCP.exe
  C:\Windows\System\ITAdMCP.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\wVlDzKl.exe
  C:\Windows\System\wVlDzKl.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\GsxRTzE.exe
  C:\Windows\System\GsxRTzE.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\VQHJwny.exe
  C:\Windows\System\VQHJwny.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\uIKBonp.exe
  C:\Windows\System\uIKBonp.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\UjKWcRn.exe
  C:\Windows\System\UjKWcRn.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\DjbxQOB.exe
  C:\Windows\System\DjbxQOB.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\XdtpcRC.exe
  C:\Windows\System\XdtpcRC.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\WgluBdw.exe
  C:\Windows\System\WgluBdw.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\ZOjEOGr.exe
  C:\Windows\System\ZOjEOGr.exe
  2⤵
  PID:4604
- C:\Windows\System\uFsboIJ.exe
  C:\Windows\System\uFsboIJ.exe
  2⤵
  PID:2456
- C:\Windows\System\cVUcGLV.exe
  C:\Windows\System\cVUcGLV.exe
  2⤵
  PID:5048
- C:\Windows\System\bfxMmZl.exe
  C:\Windows\System\bfxMmZl.exe
  2⤵
  PID:388
- C:\Windows\System\rqUSiCA.exe
  C:\Windows\System\rqUSiCA.exe
  2⤵
  PID:4052
- C:\Windows\System\XiuHZkM.exe
  C:\Windows\System\XiuHZkM.exe
  2⤵
  PID:5136
- C:\Windows\System\wABmUzX.exe
  C:\Windows\System\wABmUzX.exe
  2⤵
  PID:5152
- C:\Windows\System\fnrbgdT.exe
  C:\Windows\System\fnrbgdT.exe
  2⤵
  PID:5168
- C:\Windows\System\gDqsJjX.exe
  C:\Windows\System\gDqsJjX.exe
  2⤵
  PID:5184
- C:\Windows\System\AmaJbBS.exe
  C:\Windows\System\AmaJbBS.exe
  2⤵
  PID:5348
- C:\Windows\System\HuMaMXz.exe
  C:\Windows\System\HuMaMXz.exe
  2⤵
  PID:5364
- C:\Windows\System\VGaBfWp.exe
  C:\Windows\System\VGaBfWp.exe
  2⤵
  PID:5380
- C:\Windows\System\qRkHbmo.exe
  C:\Windows\System\qRkHbmo.exe
  2⤵
  PID:5396
- C:\Windows\System\zFRugmu.exe
  C:\Windows\System\zFRugmu.exe
  2⤵
  PID:5412
- C:\Windows\System\vnwDHyu.exe
  C:\Windows\System\vnwDHyu.exe
  2⤵
  PID:5428
- C:\Windows\System\mPqcwqw.exe
  C:\Windows\System\mPqcwqw.exe
  2⤵
  PID:5444
- C:\Windows\System\MPokTtm.exe
  C:\Windows\System\MPokTtm.exe
  2⤵
  PID:5460
- C:\Windows\System\jJaPIzL.exe
  C:\Windows\System\jJaPIzL.exe
  2⤵
  PID:5476
- C:\Windows\System\iNHwSfI.exe
  C:\Windows\System\iNHwSfI.exe
  2⤵
  PID:5492
- C:\Windows\System\LXwrdrH.exe
  C:\Windows\System\LXwrdrH.exe
  2⤵
  PID:5508
- C:\Windows\System\xmhjMqw.exe
  C:\Windows\System\xmhjMqw.exe
  2⤵
  PID:5524
- C:\Windows\System\PGlYOsy.exe
  C:\Windows\System\PGlYOsy.exe
  2⤵
  PID:5540
- C:\Windows\System\ZLrMOqQ.exe
  C:\Windows\System\ZLrMOqQ.exe
  2⤵
  PID:5556
- C:\Windows\System\bqVeKwh.exe
  C:\Windows\System\bqVeKwh.exe
  2⤵
  PID:5780
- C:\Windows\System\KylxWrK.exe
  C:\Windows\System\KylxWrK.exe
  2⤵
  PID:5796
- C:\Windows\System\OgRUMvj.exe
  C:\Windows\System\OgRUMvj.exe
  2⤵
  PID:5812
- C:\Windows\System\nnEnorR.exe
  C:\Windows\System\nnEnorR.exe
  2⤵
  PID:5828
- C:\Windows\System\NcRXzpB.exe
  C:\Windows\System\NcRXzpB.exe
  2⤵
  PID:5848
- C:\Windows\System\llCDnwM.exe
  C:\Windows\System\llCDnwM.exe
  2⤵
  PID:5908
- C:\Windows\System\mhjGeDS.exe
  C:\Windows\System\mhjGeDS.exe
  2⤵
  PID:5924
- C:\Windows\System\ygwddUM.exe
  C:\Windows\System\ygwddUM.exe
  2⤵
  PID:5948
- C:\Windows\System\TrKcwlN.exe
  C:\Windows\System\TrKcwlN.exe
  2⤵
  PID:5996
- C:\Windows\System\tBtAQjR.exe
  C:\Windows\System\tBtAQjR.exe
  2⤵
  PID:6020
- C:\Windows\System\FRgrDyi.exe
  C:\Windows\System\FRgrDyi.exe
  2⤵
  PID:6064
- C:\Windows\System\YfkwQJg.exe
  C:\Windows\System\YfkwQJg.exe
  2⤵
  PID:6080
- C:\Windows\System\MlGOoao.exe
  C:\Windows\System\MlGOoao.exe
  2⤵
  PID:6096
- C:\Windows\System\ZQIKEEe.exe
  C:\Windows\System\ZQIKEEe.exe
  2⤵
  PID:6132
- C:\Windows\System\MVaOvfb.exe
  C:\Windows\System\MVaOvfb.exe
  2⤵
  PID:4864
- C:\Windows\System\YTfLsDy.exe
  C:\Windows\System\YTfLsDy.exe
  2⤵
  PID:2764
- C:\Windows\System\jGDPpHs.exe
  C:\Windows\System\jGDPpHs.exe
  2⤵
  PID:4588
- C:\Windows\System\rOTGGbd.exe
  C:\Windows\System\rOTGGbd.exe
  2⤵
  PID:4952
- C:\Windows\System\rqzAJdP.exe
  C:\Windows\System\rqzAJdP.exe
  2⤵
  PID:4720
- C:\Windows\System\iLJaghe.exe
  C:\Windows\System\iLJaghe.exe
  2⤵
  PID:2104
- C:\Windows\System\CyAJmOx.exe
  C:\Windows\System\CyAJmOx.exe
  2⤵
  PID:448
- C:\Windows\System\KUQyevT.exe
  C:\Windows\System\KUQyevT.exe
  2⤵
  PID:3944
- C:\Windows\System\xXAyXMb.exe
  C:\Windows\System\xXAyXMb.exe
  2⤵
  PID:5148
- C:\Windows\System\AYCrJIj.exe
  C:\Windows\System\AYCrJIj.exe
  2⤵
  PID:5220
- C:\Windows\System\RFjFfne.exe
  C:\Windows\System\RFjFfne.exe
  2⤵
  PID:5252
- C:\Windows\System\ZwtXMQC.exe
  C:\Windows\System\ZwtXMQC.exe
  2⤵
  PID:5376
- C:\Windows\System\dPZZSge.exe
  C:\Windows\System\dPZZSge.exe
  2⤵
  PID:5436
- C:\Windows\System\DiqrXtn.exe
  C:\Windows\System\DiqrXtn.exe
  2⤵
  PID:5468
- C:\Windows\System\vGzJHvZ.exe
  C:\Windows\System\vGzJHvZ.exe
  2⤵
  PID:5500
- C:\Windows\System\jxcRACm.exe
  C:\Windows\System\jxcRACm.exe
  2⤵
  PID:5532
- C:\Windows\System\CdaGnin.exe
  C:\Windows\System\CdaGnin.exe
  2⤵
  PID:5572
- C:\Windows\System\dbVIndX.exe
  C:\Windows\System\dbVIndX.exe
  2⤵
  PID:5612
- C:\Windows\System\eTjTFBb.exe
  C:\Windows\System\eTjTFBb.exe
  2⤵
  PID:3580
- C:\Windows\System\yIMIwsf.exe
  C:\Windows\System\yIMIwsf.exe
  2⤵
  PID:264
- C:\Windows\System\IBEMJMj.exe
  C:\Windows\System\IBEMJMj.exe
  2⤵
  PID:1428
- C:\Windows\System\ZkcHdPX.exe
  C:\Windows\System\ZkcHdPX.exe
  2⤵
  PID:464
- C:\Windows\System\tcedWFD.exe
  C:\Windows\System\tcedWFD.exe
  2⤵
  PID:4180
- C:\Windows\System\ctAsQEN.exe
  C:\Windows\System\ctAsQEN.exe
  2⤵
  PID:4868
- C:\Windows\System\AwCBjIg.exe
  C:\Windows\System\AwCBjIg.exe
  2⤵
  PID:4388
- C:\Windows\System\VdMbTcb.exe
  C:\Windows\System\VdMbTcb.exe
  2⤵
  PID:4852
- C:\Windows\System\SrGWqMf.exe
  C:\Windows\System\SrGWqMf.exe
  2⤵
  PID:1604
- C:\Windows\System\bjoUpBE.exe
  C:\Windows\System\bjoUpBE.exe
  2⤵
  PID:4400
- C:\Windows\System\DiyInbw.exe
  C:\Windows\System\DiyInbw.exe
  2⤵
  PID:4440
- C:\Windows\System\NeSJeyB.exe
  C:\Windows\System\NeSJeyB.exe
  2⤵
  PID:5740
- C:\Windows\System\liPrJEo.exe
  C:\Windows\System\liPrJEo.exe
  2⤵
  PID:5884
- C:\Windows\System\hhwLBvV.exe
  C:\Windows\System\hhwLBvV.exe
  2⤵
  PID:5960
- C:\Windows\System\FCyUczX.exe
  C:\Windows\System\FCyUczX.exe
  2⤵
  PID:6076
- C:\Windows\System\roElHbB.exe
  C:\Windows\System\roElHbB.exe
  2⤵
  PID:4624
- C:\Windows\System\MrGyNnP.exe
  C:\Windows\System\MrGyNnP.exe
  2⤵
  PID:3840
- C:\Windows\System\FYJwJWK.exe
  C:\Windows\System\FYJwJWK.exe
  2⤵
  PID:452
- C:\Windows\System\ywKFtNb.exe
  C:\Windows\System\ywKFtNb.exe
  2⤵
  PID:5236
- C:\Windows\System\zjyxGPG.exe
  C:\Windows\System\zjyxGPG.exe
  2⤵
  PID:5404
- C:\Windows\System\OguLcSM.exe
  C:\Windows\System\OguLcSM.exe
  2⤵
  PID:5552
- C:\Windows\System\dgmxlfb.exe
  C:\Windows\System\dgmxlfb.exe
  2⤵
  PID:5676
- C:\Windows\System\XchyDxi.exe
  C:\Windows\System\XchyDxi.exe
  2⤵
  PID:3784
- C:\Windows\System\XBqUpVj.exe
  C:\Windows\System\XBqUpVj.exe
  2⤵
  PID:3116
- C:\Windows\System\ctyUrgq.exe
  C:\Windows\System\ctyUrgq.exe
  2⤵
  PID:428
- C:\Windows\System\jgfPPKd.exe
  C:\Windows\System\jgfPPKd.exe
  2⤵
  PID:432
- C:\Windows\System\lAeKZOk.exe
  C:\Windows\System\lAeKZOk.exe
  2⤵
  PID:1420
- C:\Windows\System\qflxCMY.exe
  C:\Windows\System\qflxCMY.exe
  2⤵
  PID:6116
- C:\Windows\System\nHZUjyf.exe
  C:\Windows\System\nHZUjyf.exe
  2⤵
  PID:5200
- C:\Windows\System\SqxmuaK.exe
  C:\Windows\System\SqxmuaK.exe
  2⤵
  PID:3824
- C:\Windows\System\WmGBVuE.exe
  C:\Windows\System\WmGBVuE.exe
  2⤵
  PID:5880
- C:\Windows\System\ZvZzOqU.exe
  C:\Windows\System\ZvZzOqU.exe
  2⤵
  PID:1680
- C:\Windows\System\VImvsOH.exe
  C:\Windows\System\VImvsOH.exe
  2⤵
  PID:3460
- C:\Windows\System\MsyxgyY.exe
  C:\Windows\System\MsyxgyY.exe
  2⤵
  PID:4320
- C:\Windows\System\FpUDBgk.exe
  C:\Windows\System\FpUDBgk.exe
  2⤵
  PID:5856
- C:\Windows\System\gYZZskY.exe
  C:\Windows\System\gYZZskY.exe
  2⤵
  PID:5920
- C:\Windows\System\cLYnyYn.exe
  C:\Windows\System\cLYnyYn.exe
  2⤵
  PID:5776
- C:\Windows\System\VteoXyu.exe
  C:\Windows\System\VteoXyu.exe
  2⤵
  PID:6172
- C:\Windows\System\TlNOHtS.exe
  C:\Windows\System\TlNOHtS.exe
  2⤵
  PID:6196
- C:\Windows\System\qJgNMtr.exe
  C:\Windows\System\qJgNMtr.exe
  2⤵
  PID:6228
- C:\Windows\System\ZWjsgmU.exe
  C:\Windows\System\ZWjsgmU.exe
  2⤵
  PID:6260
- C:\Windows\System\pAYaaAw.exe
  C:\Windows\System\pAYaaAw.exe
  2⤵
  PID:6288
- C:\Windows\System\dIcmOvg.exe
  C:\Windows\System\dIcmOvg.exe
  2⤵
  PID:6316
- C:\Windows\System\VHNvJWb.exe
  C:\Windows\System\VHNvJWb.exe
  2⤵
  PID:6360
- C:\Windows\System\sFIrGUh.exe
  C:\Windows\System\sFIrGUh.exe
  2⤵
  PID:6376
- C:\Windows\System\knswdtT.exe
  C:\Windows\System\knswdtT.exe
  2⤵
  PID:6416
- C:\Windows\System\ZmSApAR.exe
  C:\Windows\System\ZmSApAR.exe
  2⤵
  PID:6444
- C:\Windows\System\oexFYDj.exe
  C:\Windows\System\oexFYDj.exe
  2⤵
  PID:6464
- C:\Windows\System\gnggmQj.exe
  C:\Windows\System\gnggmQj.exe
  2⤵
  PID:6500
- C:\Windows\System\YClVkbQ.exe
  C:\Windows\System\YClVkbQ.exe
  2⤵
  PID:6520
- C:\Windows\System\iIXEqCp.exe
  C:\Windows\System\iIXEqCp.exe
  2⤵
  PID:6556
- C:\Windows\System\TsTRIyi.exe
  C:\Windows\System\TsTRIyi.exe
  2⤵
  PID:6572
- C:\Windows\System\hfrvZOY.exe
  C:\Windows\System\hfrvZOY.exe
  2⤵
  PID:6600
- C:\Windows\System\ghgbhbt.exe
  C:\Windows\System\ghgbhbt.exe
  2⤵
  PID:6640
- C:\Windows\System\NlDNXrz.exe
  C:\Windows\System\NlDNXrz.exe
  2⤵
  PID:6656
- C:\Windows\System\WSxdeRS.exe
  C:\Windows\System\WSxdeRS.exe
  2⤵
  PID:6696
- C:\Windows\System\MjTVIZl.exe
  C:\Windows\System\MjTVIZl.exe
  2⤵
  PID:6724
- C:\Windows\System\mmIUzzL.exe
  C:\Windows\System\mmIUzzL.exe
  2⤵
  PID:6752
- C:\Windows\System\iprqaiu.exe
  C:\Windows\System\iprqaiu.exe
  2⤵
  PID:6784
- C:\Windows\System\eKLSHYR.exe
  C:\Windows\System\eKLSHYR.exe
  2⤵
  PID:6812
- C:\Windows\System\twRsgoH.exe
  C:\Windows\System\twRsgoH.exe
  2⤵
  PID:6840
- C:\Windows\System\aWEwFDF.exe
  C:\Windows\System\aWEwFDF.exe
  2⤵
  PID:6856
- C:\Windows\System\LbMVWFT.exe
  C:\Windows\System\LbMVWFT.exe
  2⤵
  PID:6872
- C:\Windows\System\Orqrpwf.exe
  C:\Windows\System\Orqrpwf.exe
  2⤵
  PID:6892
- C:\Windows\System\nSKvPKx.exe
  C:\Windows\System\nSKvPKx.exe
  2⤵
  PID:6940
- C:\Windows\System\wZAgfHt.exe
  C:\Windows\System\wZAgfHt.exe
  2⤵
  PID:6980
- C:\Windows\System\penbwbB.exe
  C:\Windows\System\penbwbB.exe
  2⤵
  PID:7008
- C:\Windows\System\ANoWDRr.exe
  C:\Windows\System\ANoWDRr.exe
  2⤵
  PID:7024
- C:\Windows\System\wVzASII.exe
  C:\Windows\System\wVzASII.exe
  2⤵
  PID:7052
- C:\Windows\System\PgiwERa.exe
  C:\Windows\System\PgiwERa.exe
  2⤵
  PID:7092
- C:\Windows\System\RLnRtmz.exe
  C:\Windows\System\RLnRtmz.exe
  2⤵
  PID:7120
- C:\Windows\System\vrtxVrg.exe
  C:\Windows\System\vrtxVrg.exe
  2⤵
  PID:7136
- C:\Windows\System\JNvbEaD.exe
  C:\Windows\System\JNvbEaD.exe
  2⤵
  PID:7160
- C:\Windows\System\KnwrLcl.exe
  C:\Windows\System\KnwrLcl.exe
  2⤵
  PID:6180
- C:\Windows\System\SHMeCrF.exe
  C:\Windows\System\SHMeCrF.exe
  2⤵
  PID:6236
- C:\Windows\System\UwULkyi.exe
  C:\Windows\System\UwULkyi.exe
  2⤵
  PID:6276
- C:\Windows\System\nPlyeEU.exe
  C:\Windows\System\nPlyeEU.exe
  2⤵
  PID:6344
- C:\Windows\System\xhTpUOX.exe
  C:\Windows\System\xhTpUOX.exe
  2⤵
  PID:6412
- C:\Windows\System\YNLMBuz.exe
  C:\Windows\System\YNLMBuz.exe
  2⤵
  PID:6428
- C:\Windows\System\ryJXgDO.exe
  C:\Windows\System\ryJXgDO.exe
  2⤵
  PID:6492
- C:\Windows\System\sjMeODV.exe
  C:\Windows\System\sjMeODV.exe
  2⤵
  PID:6596
- C:\Windows\System\HAmOsug.exe
  C:\Windows\System\HAmOsug.exe
  2⤵
  PID:6636
- C:\Windows\System\SCCasHC.exe
  C:\Windows\System\SCCasHC.exe
  2⤵
  PID:6716
- C:\Windows\System\xxLOcJz.exe
  C:\Windows\System\xxLOcJz.exe
  2⤵
  PID:6780
- C:\Windows\System\JkQhkKH.exe
  C:\Windows\System\JkQhkKH.exe
  2⤵
  PID:6824
- C:\Windows\System\fvXdoms.exe
  C:\Windows\System\fvXdoms.exe
  2⤵
  PID:6908
- C:\Windows\System\sprlgIi.exe
  C:\Windows\System\sprlgIi.exe
  2⤵
  PID:6972
- C:\Windows\System\fYnrmkc.exe
  C:\Windows\System\fYnrmkc.exe
  2⤵
  PID:7048
- C:\Windows\System\UziEHbG.exe
  C:\Windows\System\UziEHbG.exe
  2⤵
  PID:7116
- C:\Windows\System\yEgOpoA.exe
  C:\Windows\System\yEgOpoA.exe
  2⤵
  PID:2516
- C:\Windows\System\FQWGWHA.exe
  C:\Windows\System\FQWGWHA.exe
  2⤵
  PID:6184
- C:\Windows\System\wQjbbfi.exe
  C:\Windows\System\wQjbbfi.exe
  2⤵
  PID:6272
- C:\Windows\System\EpLNLmK.exe
  C:\Windows\System\EpLNLmK.exe
  2⤵
  PID:6528
- C:\Windows\System\GnplecG.exe
  C:\Windows\System\GnplecG.exe
  2⤵
  PID:6676
- C:\Windows\System\dEwlnvd.exe
  C:\Windows\System\dEwlnvd.exe
  2⤵
  PID:6764
- C:\Windows\System\GGUedxs.exe
  C:\Windows\System\GGUedxs.exe
  2⤵
  PID:6900
- C:\Windows\System\iOGpSiE.exe
  C:\Windows\System\iOGpSiE.exe
  2⤵
  PID:7020
- C:\Windows\System\bHhMBpx.exe
  C:\Windows\System\bHhMBpx.exe
  2⤵
  PID:6368
- C:\Windows\System\ESCkKoy.exe
  C:\Windows\System\ESCkKoy.exe
  2⤵
  PID:6772
- C:\Windows\System\cgJQorc.exe
  C:\Windows\System\cgJQorc.exe
  2⤵
  PID:6964
- C:\Windows\System\gDMJfWE.exe
  C:\Windows\System\gDMJfWE.exe
  2⤵
  PID:4548
- C:\Windows\System\vSVifqN.exe
  C:\Windows\System\vSVifqN.exe
  2⤵
  PID:6836
- C:\Windows\System\BDNKqnN.exe
  C:\Windows\System\BDNKqnN.exe
  2⤵
  PID:7176
- C:\Windows\System\ffWIpyS.exe
  C:\Windows\System\ffWIpyS.exe
  2⤵
  PID:7224
- C:\Windows\System\ZNnOEJR.exe
  C:\Windows\System\ZNnOEJR.exe
  2⤵
  PID:7248
- C:\Windows\System\bdkyjif.exe
  C:\Windows\System\bdkyjif.exe
  2⤵
  PID:7276
- C:\Windows\System\oXwPraI.exe
  C:\Windows\System\oXwPraI.exe
  2⤵
  PID:7304
- C:\Windows\System\UWZjvOf.exe
  C:\Windows\System\UWZjvOf.exe
  2⤵
  PID:7332
- C:\Windows\System\FrMHitz.exe
  C:\Windows\System\FrMHitz.exe
  2⤵
  PID:7364
- C:\Windows\System\RjXjmZW.exe
  C:\Windows\System\RjXjmZW.exe
  2⤵
  PID:7392
- C:\Windows\System\OOoiZeu.exe
  C:\Windows\System\OOoiZeu.exe
  2⤵
  PID:7416
- C:\Windows\System\YLBCHAU.exe
  C:\Windows\System\YLBCHAU.exe
  2⤵
  PID:7448
- C:\Windows\System\TBcLcPD.exe
  C:\Windows\System\TBcLcPD.exe
  2⤵
  PID:7472
- C:\Windows\System\GZljMve.exe
  C:\Windows\System\GZljMve.exe
  2⤵
  PID:7500
- C:\Windows\System\QKHVIlZ.exe
  C:\Windows\System\QKHVIlZ.exe
  2⤵
  PID:7528
- C:\Windows\System\GGQOwpw.exe
  C:\Windows\System\GGQOwpw.exe
  2⤵
  PID:7560
- C:\Windows\System\HGkFeZW.exe
  C:\Windows\System\HGkFeZW.exe
  2⤵
  PID:7588
- C:\Windows\System\dGQVUhA.exe
  C:\Windows\System\dGQVUhA.exe
  2⤵
  PID:7616
- C:\Windows\System\CVvcWKz.exe
  C:\Windows\System\CVvcWKz.exe
  2⤵
  PID:7644
- C:\Windows\System\lqDeOqR.exe
  C:\Windows\System\lqDeOqR.exe
  2⤵
  PID:7680
- C:\Windows\System\ONPWTOl.exe
  C:\Windows\System\ONPWTOl.exe
  2⤵
  PID:7700
- C:\Windows\System\bKGMFHk.exe
  C:\Windows\System\bKGMFHk.exe
  2⤵
  PID:7736
- C:\Windows\System\lWUJvZw.exe
  C:\Windows\System\lWUJvZw.exe
  2⤵
  PID:7760
- C:\Windows\System\QZvnwGC.exe
  C:\Windows\System\QZvnwGC.exe
  2⤵
  PID:7784
- C:\Windows\System\gXoGzOk.exe
  C:\Windows\System\gXoGzOk.exe
  2⤵
  PID:7816
- C:\Windows\System\PHUdXGh.exe
  C:\Windows\System\PHUdXGh.exe
  2⤵
  PID:7840
- C:\Windows\System\QCDWLkm.exe
  C:\Windows\System\QCDWLkm.exe
  2⤵
  PID:7868
- C:\Windows\System\XIQBVMT.exe
  C:\Windows\System\XIQBVMT.exe
  2⤵
  PID:7896
- C:\Windows\System\jiwomCg.exe
  C:\Windows\System\jiwomCg.exe
  2⤵
  PID:7924
- C:\Windows\System\QAaDJyu.exe
  C:\Windows\System\QAaDJyu.exe
  2⤵
  PID:7952
- C:\Windows\System\FLFwTAE.exe
  C:\Windows\System\FLFwTAE.exe
  2⤵
  PID:7980
- C:\Windows\System\pikWSub.exe
  C:\Windows\System\pikWSub.exe
  2⤵
  PID:8020
- C:\Windows\System\MICiJze.exe
  C:\Windows\System\MICiJze.exe
  2⤵
  PID:8036
- C:\Windows\System\ZXLccMP.exe
  C:\Windows\System\ZXLccMP.exe
  2⤵
  PID:8064
- C:\Windows\System\XUqwRsa.exe
  C:\Windows\System\XUqwRsa.exe
  2⤵
  PID:8092
- C:\Windows\System\iHoKRyo.exe
  C:\Windows\System\iHoKRyo.exe
  2⤵
  PID:8120
- C:\Windows\System\bQMZDyk.exe
  C:\Windows\System\bQMZDyk.exe
  2⤵
  PID:8148
- C:\Windows\System\uxsdQMh.exe
  C:\Windows\System\uxsdQMh.exe
  2⤵
  PID:8176
- C:\Windows\System\IMVlLJk.exe
  C:\Windows\System\IMVlLJk.exe
  2⤵
  PID:6156
- C:\Windows\System\rNuZWBR.exe
  C:\Windows\System\rNuZWBR.exe
  2⤵
  PID:7268
- C:\Windows\System\GiOkKvC.exe
  C:\Windows\System\GiOkKvC.exe
  2⤵
  PID:7316
- C:\Windows\System\UpWNgTm.exe
  C:\Windows\System\UpWNgTm.exe
  2⤵
  PID:7384
- C:\Windows\System\HmSTlem.exe
  C:\Windows\System\HmSTlem.exe
  2⤵
  PID:7456
- C:\Windows\System\jasbsEL.exe
  C:\Windows\System\jasbsEL.exe
  2⤵
  PID:7512
- C:\Windows\System\DGODMlB.exe
  C:\Windows\System\DGODMlB.exe
  2⤵
  PID:7580
- C:\Windows\System\NJoQpGS.exe
  C:\Windows\System\NJoQpGS.exe
  2⤵
  PID:7640
- C:\Windows\System\BUZoMUm.exe
  C:\Windows\System\BUZoMUm.exe
  2⤵
  PID:7696
- C:\Windows\System\mzAbPNd.exe
  C:\Windows\System\mzAbPNd.exe
  2⤵
  PID:7768
- C:\Windows\System\wCESWZR.exe
  C:\Windows\System\wCESWZR.exe
  2⤵
  PID:7836
- C:\Windows\System\bWZqUwi.exe
  C:\Windows\System\bWZqUwi.exe
  2⤵
  PID:7892
- C:\Windows\System\RViiwnG.exe
  C:\Windows\System\RViiwnG.exe
  2⤵
  PID:7964
- C:\Windows\System\kiddhMs.exe
  C:\Windows\System\kiddhMs.exe
  2⤵
  PID:8028
- C:\Windows\System\AltqANn.exe
  C:\Windows\System\AltqANn.exe
  2⤵
  PID:8088
- C:\Windows\System\iViwaFu.exe
  C:\Windows\System\iViwaFu.exe
  2⤵
  PID:8160
- C:\Windows\System\PztjrWU.exe
  C:\Windows\System\PztjrWU.exe
  2⤵
  PID:7240
- C:\Windows\System\RmpWAcx.exe
  C:\Windows\System\RmpWAcx.exe
  2⤵
  PID:7408
- C:\Windows\System\panMRJg.exe
  C:\Windows\System\panMRJg.exe
  2⤵
  PID:7540
- C:\Windows\System\RQNOqZv.exe
  C:\Windows\System\RQNOqZv.exe
  2⤵
  PID:7692
- C:\Windows\System\MgpYkNq.exe
  C:\Windows\System\MgpYkNq.exe
  2⤵
  PID:7824
- C:\Windows\System\PiRPSJv.exe
  C:\Windows\System\PiRPSJv.exe
  2⤵
  PID:7992
- C:\Windows\System\JIyxhhO.exe
  C:\Windows\System\JIyxhhO.exe
  2⤵
  PID:8140
- C:\Windows\System\mZyXMoO.exe
  C:\Windows\System\mZyXMoO.exe
  2⤵
  PID:7468
- C:\Windows\System\UHAZgWq.exe
  C:\Windows\System\UHAZgWq.exe
  2⤵
  PID:7748
- C:\Windows\System\nhBhdJa.exe
  C:\Windows\System\nhBhdJa.exe
  2⤵
  PID:8116
- C:\Windows\System\BZunrZJ.exe
  C:\Windows\System\BZunrZJ.exe
  2⤵
  PID:7888
- C:\Windows\System\BsoSIbt.exe
  C:\Windows\System\BsoSIbt.exe
  2⤵
  PID:8056
- C:\Windows\System\MOrFgtD.exe
  C:\Windows\System\MOrFgtD.exe
  2⤵
  PID:8212
- C:\Windows\System\kENqVMw.exe
  C:\Windows\System\kENqVMw.exe
  2⤵
  PID:8248
- C:\Windows\System\LgcNRSg.exe
  C:\Windows\System\LgcNRSg.exe
  2⤵
  PID:8268
- C:\Windows\System\UkVqjvB.exe
  C:\Windows\System\UkVqjvB.exe
  2⤵
  PID:8296
- C:\Windows\System\tHPsnzh.exe
  C:\Windows\System\tHPsnzh.exe
  2⤵
  PID:8324
- C:\Windows\System\ZuxlBXk.exe
  C:\Windows\System\ZuxlBXk.exe
  2⤵
  PID:8352
- C:\Windows\System\mPZTmnj.exe
  C:\Windows\System\mPZTmnj.exe
  2⤵
  PID:8380
- C:\Windows\System\tzSDxjr.exe
  C:\Windows\System\tzSDxjr.exe
  2⤵
  PID:8412
- C:\Windows\System\osUXpLP.exe
  C:\Windows\System\osUXpLP.exe
  2⤵
  PID:8436
- C:\Windows\System\oaCzwst.exe
  C:\Windows\System\oaCzwst.exe
  2⤵
  PID:8456
- C:\Windows\System\BvorGkG.exe
  C:\Windows\System\BvorGkG.exe
  2⤵
  PID:8488
- C:\Windows\System\dVekjQc.exe
  C:\Windows\System\dVekjQc.exe
  2⤵
  PID:8520
- C:\Windows\System\YcWwuri.exe
  C:\Windows\System\YcWwuri.exe
  2⤵
  PID:8548
- C:\Windows\System\oAloZCr.exe
  C:\Windows\System\oAloZCr.exe
  2⤵
  PID:8576
- C:\Windows\System\bjqJuBM.exe
  C:\Windows\System\bjqJuBM.exe
  2⤵
  PID:8604
- C:\Windows\System\VnHJMGF.exe
  C:\Windows\System\VnHJMGF.exe
  2⤵
  PID:8636
- C:\Windows\System\oACZrer.exe
  C:\Windows\System\oACZrer.exe
  2⤵
  PID:8660
- C:\Windows\System\cVNOdwP.exe
  C:\Windows\System\cVNOdwP.exe
  2⤵
  PID:8688
- C:\Windows\System\arioWgT.exe
  C:\Windows\System\arioWgT.exe
  2⤵
  PID:8716
- C:\Windows\System\tZVENWE.exe
  C:\Windows\System\tZVENWE.exe
  2⤵
  PID:8744
- C:\Windows\System\zLBFNXM.exe
  C:\Windows\System\zLBFNXM.exe
  2⤵
  PID:8772
- C:\Windows\System\QFOduPw.exe
  C:\Windows\System\QFOduPw.exe
  2⤵
  PID:8804
- C:\Windows\System\vtpnRLo.exe
  C:\Windows\System\vtpnRLo.exe
  2⤵
  PID:8828
- C:\Windows\System\jggmBED.exe
  C:\Windows\System\jggmBED.exe
  2⤵
  PID:8856
- C:\Windows\System\mQMSzwN.exe
  C:\Windows\System\mQMSzwN.exe
  2⤵
  PID:8884
- C:\Windows\System\QYbKwoC.exe
  C:\Windows\System\QYbKwoC.exe
  2⤵
  PID:8912
- C:\Windows\System\eWeuBrR.exe
  C:\Windows\System\eWeuBrR.exe
  2⤵
  PID:8940
- C:\Windows\System\rFuFVKz.exe
  C:\Windows\System\rFuFVKz.exe
  2⤵
  PID:8968
- C:\Windows\System\XcDiszx.exe
  C:\Windows\System\XcDiszx.exe
  2⤵
  PID:8996
- C:\Windows\System\FPcjlFG.exe
  C:\Windows\System\FPcjlFG.exe
  2⤵
  PID:9024
- C:\Windows\System\dinkXuy.exe
  C:\Windows\System\dinkXuy.exe
  2⤵
  PID:9052
- C:\Windows\System\iLMmBhH.exe
  C:\Windows\System\iLMmBhH.exe
  2⤵
  PID:9080
- C:\Windows\System\SzTKYbU.exe
  C:\Windows\System\SzTKYbU.exe
  2⤵
  PID:9108
- C:\Windows\System\VhoOoiI.exe
  C:\Windows\System\VhoOoiI.exe
  2⤵
  PID:9136
- C:\Windows\System\fMMVKgv.exe
  C:\Windows\System\fMMVKgv.exe
  2⤵
  PID:9168
- C:\Windows\System\GpPuPrB.exe
  C:\Windows\System\GpPuPrB.exe
  2⤵
  PID:9192
- C:\Windows\System\tGilgdY.exe
  C:\Windows\System\tGilgdY.exe
  2⤵
  PID:8204
- C:\Windows\System\cbAlgtl.exe
  C:\Windows\System\cbAlgtl.exe
  2⤵
  PID:8264
- C:\Windows\System\BbwxNPZ.exe
  C:\Windows\System\BbwxNPZ.exe
  2⤵
  PID:8344
- C:\Windows\System\xFdSgGM.exe
  C:\Windows\System\xFdSgGM.exe
  2⤵
  PID:8404
- C:\Windows\System\TBOxACg.exe
  C:\Windows\System\TBOxACg.exe
  2⤵
  PID:8464
- C:\Windows\System\bkkTfdz.exe
  C:\Windows\System\bkkTfdz.exe
  2⤵
  PID:8532
- C:\Windows\System\QuYdCFy.exe
  C:\Windows\System\QuYdCFy.exe
  2⤵
  PID:8600
- C:\Windows\System\YlIZVXM.exe
  C:\Windows\System\YlIZVXM.exe
  2⤵
  PID:8672
- C:\Windows\System\bKoLYWc.exe
  C:\Windows\System\bKoLYWc.exe
  2⤵
  PID:8740
- C:\Windows\System\ZhlJyrx.exe
  C:\Windows\System\ZhlJyrx.exe
  2⤵
  PID:8792
- C:\Windows\System\wWRqwVn.exe
  C:\Windows\System\wWRqwVn.exe
  2⤵
  PID:8868
- C:\Windows\System\rNtwYLa.exe
  C:\Windows\System\rNtwYLa.exe
  2⤵
  PID:8932
- C:\Windows\System\renzziF.exe
  C:\Windows\System\renzziF.exe
  2⤵
  PID:8992
- C:\Windows\System\aNwvivg.exe
  C:\Windows\System\aNwvivg.exe
  2⤵
  PID:7344
- C:\Windows\System\VfwZpYh.exe
  C:\Windows\System\VfwZpYh.exe
  2⤵
  PID:9120
- C:\Windows\System\CJydySQ.exe
  C:\Windows\System\CJydySQ.exe
  2⤵
  PID:9188
- C:\Windows\System\hHUmtXz.exe
  C:\Windows\System\hHUmtXz.exe
  2⤵
  PID:8232
- C:\Windows\System\NnDyCrO.exe
  C:\Windows\System\NnDyCrO.exe
  2⤵
  PID:1552
- C:\Windows\System\KwNTjxX.exe
  C:\Windows\System\KwNTjxX.exe
  2⤵
  PID:8392
- C:\Windows\System\WdtMSrW.exe
  C:\Windows\System\WdtMSrW.exe
  2⤵
  PID:8512
- C:\Windows\System\dLqSTOi.exe
  C:\Windows\System\dLqSTOi.exe
  2⤵
  PID:8588
- C:\Windows\System\dpnoLpb.exe
  C:\Windows\System\dpnoLpb.exe
  2⤵
  PID:8712
- C:\Windows\System\ryGFtVR.exe
  C:\Windows\System\ryGFtVR.exe
  2⤵
  PID:8824
- C:\Windows\System\DJUkBHv.exe
  C:\Windows\System\DJUkBHv.exe
  2⤵
  PID:9044
- C:\Windows\System\IweTiGw.exe
  C:\Windows\System\IweTiGw.exe
  2⤵
  PID:8448
- C:\Windows\System\oiJbfFZ.exe
  C:\Windows\System\oiJbfFZ.exe
  2⤵
  PID:8960
- C:\Windows\System\lyBESIW.exe
  C:\Windows\System\lyBESIW.exe
  2⤵
  PID:8656
- C:\Windows\System\stTmdoA.exe
  C:\Windows\System\stTmdoA.exe
  2⤵
  PID:9220
- C:\Windows\System\DdqiYYp.exe
  C:\Windows\System\DdqiYYp.exe
  2⤵
  PID:9244
- C:\Windows\System\OYfgHFe.exe
  C:\Windows\System\OYfgHFe.exe
  2⤵
  PID:9268
- C:\Windows\System\pjbpmNE.exe
  C:\Windows\System\pjbpmNE.exe
  2⤵
  PID:9312
- C:\Windows\System\zBhFGcH.exe
  C:\Windows\System\zBhFGcH.exe
  2⤵
  PID:9348
- C:\Windows\System\JeqThTU.exe
  C:\Windows\System\JeqThTU.exe
  2⤵
  PID:9368
- C:\Windows\System\SRkXEvg.exe
  C:\Windows\System\SRkXEvg.exe
  2⤵
  PID:9396
- C:\Windows\System\AhYBMQw.exe
  C:\Windows\System\AhYBMQw.exe
  2⤵
  PID:9424
- C:\Windows\System\kXogzTh.exe
  C:\Windows\System\kXogzTh.exe
  2⤵
  PID:9452
- C:\Windows\System\mkRfqVX.exe
  C:\Windows\System\mkRfqVX.exe
  2⤵
  PID:9484
- C:\Windows\System\RrpGAhZ.exe
  C:\Windows\System\RrpGAhZ.exe
  2⤵
  PID:9512
- C:\Windows\System\pZrXVbC.exe
  C:\Windows\System\pZrXVbC.exe
  2⤵
  PID:9528
- C:\Windows\System\sQYVkUe.exe
  C:\Windows\System\sQYVkUe.exe
  2⤵
  PID:9568
- C:\Windows\System\zXMgMCl.exe
  C:\Windows\System\zXMgMCl.exe
  2⤵
  PID:9596
- C:\Windows\System\RGBHTOL.exe
  C:\Windows\System\RGBHTOL.exe
  2⤵
  PID:9628
- C:\Windows\System\baaxUNp.exe
  C:\Windows\System\baaxUNp.exe
  2⤵
  PID:9644
- C:\Windows\System\MghFFgw.exe
  C:\Windows\System\MghFFgw.exe
  2⤵
  PID:9684
- C:\Windows\System\qQRenda.exe
  C:\Windows\System\qQRenda.exe
  2⤵
  PID:9712
- C:\Windows\System\wSKJCBp.exe
  C:\Windows\System\wSKJCBp.exe
  2⤵
  PID:9736
- C:\Windows\System\lttrBNC.exe
  C:\Windows\System\lttrBNC.exe
  2⤵
  PID:9752
- C:\Windows\System\MhpGEqw.exe
  C:\Windows\System\MhpGEqw.exe
  2⤵
  PID:9784
- C:\Windows\System\kROCUzN.exe
  C:\Windows\System\kROCUzN.exe
  2⤵
  PID:9836
- C:\Windows\System\DtabMdI.exe
  C:\Windows\System\DtabMdI.exe
  2⤵
  PID:9880
- C:\Windows\System\btvciFM.exe
  C:\Windows\System\btvciFM.exe
  2⤵
  PID:9908
- C:\Windows\System\xtbZUsv.exe
  C:\Windows\System\xtbZUsv.exe
  2⤵
  PID:9944
- C:\Windows\System\ZzzSZMP.exe
  C:\Windows\System\ZzzSZMP.exe
  2⤵
  PID:9972
- C:\Windows\System\nNxyekZ.exe
  C:\Windows\System\nNxyekZ.exe
  2⤵
  PID:9992
- C:\Windows\System\DizORfv.exe
  C:\Windows\System\DizORfv.exe
  2⤵
  PID:10016
- C:\Windows\System\oELucVH.exe
  C:\Windows\System\oELucVH.exe
  2⤵
  PID:10044
- C:\Windows\System\oJRJwwf.exe
  C:\Windows\System\oJRJwwf.exe
  2⤵
  PID:10088
- C:\Windows\System\PQAZxdm.exe
  C:\Windows\System\PQAZxdm.exe
  2⤵
  PID:10104
- C:\Windows\System\qyRMrZf.exe
  C:\Windows\System\qyRMrZf.exe
  2⤵
  PID:10120
- C:\Windows\System\tGFhzMo.exe
  C:\Windows\System\tGFhzMo.exe
  2⤵
  PID:10136
- C:\Windows\System\eYlQmZW.exe
  C:\Windows\System\eYlQmZW.exe
  2⤵
  PID:10160
- C:\Windows\System\dVecOVg.exe
  C:\Windows\System\dVecOVg.exe
  2⤵
  PID:10176
- C:\Windows\System\iLbNiZs.exe
  C:\Windows\System\iLbNiZs.exe
  2⤵
  PID:10196
- C:\Windows\System\fPXOUnd.exe
  C:\Windows\System\fPXOUnd.exe
  2⤵
  PID:10212
- C:\Windows\System\cDfGZsy.exe
  C:\Windows\System\cDfGZsy.exe
  2⤵
  PID:10228
- C:\Windows\System\DZpabgz.exe
  C:\Windows\System\DZpabgz.exe
  2⤵
  PID:9228
- C:\Windows\System\tOgRubX.exe
  C:\Windows\System\tOgRubX.exe
  2⤵
  PID:9284
- C:\Windows\System\CNTDmPX.exe
  C:\Windows\System\CNTDmPX.exe
  2⤵
  PID:9332
- C:\Windows\System\ouUXJBu.exe
  C:\Windows\System\ouUXJBu.exe
  2⤵
  PID:9392
- C:\Windows\System\lUqKECP.exe
  C:\Windows\System\lUqKECP.exe
  2⤵
  PID:9468
- C:\Windows\System\sKJZBHJ.exe
  C:\Windows\System\sKJZBHJ.exe
  2⤵
  PID:9508
- C:\Windows\System\EyylUfC.exe
  C:\Windows\System\EyylUfC.exe
  2⤵
  PID:9552
- C:\Windows\System\clmrtLs.exe
  C:\Windows\System\clmrtLs.exe
  2⤵
  PID:9620
- C:\Windows\System\EzZFmbW.exe
  C:\Windows\System\EzZFmbW.exe
  2⤵
  PID:9744
- C:\Windows\System\QUrhPBQ.exe
  C:\Windows\System\QUrhPBQ.exe
  2⤵
  PID:9864
- C:\Windows\System\IICfhNL.exe
  C:\Windows\System\IICfhNL.exe
  2⤵
  PID:10000
- C:\Windows\System\SydPwak.exe
  C:\Windows\System\SydPwak.exe
  2⤵
  PID:10064
- C:\Windows\System\kvuwLvE.exe
  C:\Windows\System\kvuwLvE.exe
  2⤵
  PID:10132
- C:\Windows\System\iWngXeR.exe
  C:\Windows\System\iWngXeR.exe
  2⤵
  PID:9364
- C:\Windows\System\fyPJcwu.exe
  C:\Windows\System\fyPJcwu.exe
  2⤵
  PID:9496
- C:\Windows\System\NOrpwyP.exe
  C:\Windows\System\NOrpwyP.exe
  2⤵
  PID:9704
- C:\Windows\System\rJUkUwt.exe
  C:\Windows\System\rJUkUwt.exe
  2⤵
  PID:9592
- C:\Windows\System\UJERHpF.exe
  C:\Windows\System\UJERHpF.exe
  2⤵
  PID:9708
- C:\Windows\System\GyILcsi.exe
  C:\Windows\System\GyILcsi.exe
  2⤵
  PID:9772
- C:\Windows\System\mUKDlEC.exe
  C:\Windows\System\mUKDlEC.exe
  2⤵
  PID:10056
- C:\Windows\System\UpAECZV.exe
  C:\Windows\System\UpAECZV.exe
  2⤵
  PID:8260
- C:\Windows\System\zkljlwn.exe
  C:\Windows\System\zkljlwn.exe
  2⤵
  PID:9580
- C:\Windows\System\ncwJyLv.exe
  C:\Windows\System\ncwJyLv.exe
  2⤵
  PID:10188
- C:\Windows\System\eaHjlcf.exe
  C:\Windows\System\eaHjlcf.exe
  2⤵
  PID:9824
- C:\Windows\System\kjsxNWq.exe
  C:\Windows\System\kjsxNWq.exe
  2⤵
  PID:10276
- C:\Windows\System\nBrksfm.exe
  C:\Windows\System\nBrksfm.exe
  2⤵
  PID:10312
- C:\Windows\System\ziBzbOf.exe
  C:\Windows\System\ziBzbOf.exe
  2⤵
  PID:10340
- C:\Windows\System\nFjDDGX.exe
  C:\Windows\System\nFjDDGX.exe
  2⤵
  PID:10388
- C:\Windows\System\wpZkQff.exe
  C:\Windows\System\wpZkQff.exe
  2⤵
  PID:10412
- C:\Windows\System\xffuoml.exe
  C:\Windows\System\xffuoml.exe
  2⤵
  PID:10452
- C:\Windows\System\mUyKWeM.exe
  C:\Windows\System\mUyKWeM.exe
  2⤵
  PID:10508
- C:\Windows\System\sCtHjFJ.exe
  C:\Windows\System\sCtHjFJ.exe
  2⤵
  PID:10552
- C:\Windows\System\dxrHvRB.exe
  C:\Windows\System\dxrHvRB.exe
  2⤵
  PID:10580
- C:\Windows\System\epprwKo.exe
  C:\Windows\System\epprwKo.exe
  2⤵
  PID:10616
- C:\Windows\System\CzebrZd.exe
  C:\Windows\System\CzebrZd.exe
  2⤵
  PID:10648
- C:\Windows\System\BfgyDjz.exe
  C:\Windows\System\BfgyDjz.exe
  2⤵
  PID:10700
- C:\Windows\System\DTKZOOl.exe
  C:\Windows\System\DTKZOOl.exe
  2⤵
  PID:10740
- C:\Windows\System\kfWeMwr.exe
  C:\Windows\System\kfWeMwr.exe
  2⤵
  PID:10772
- C:\Windows\System\ccVkAQn.exe
  C:\Windows\System\ccVkAQn.exe
  2⤵
  PID:10796
- C:\Windows\System\FNyAvER.exe
  C:\Windows\System\FNyAvER.exe
  2⤵
  PID:10816
- C:\Windows\System\ZEyDFPG.exe
  C:\Windows\System\ZEyDFPG.exe
  2⤵
  PID:10844
- C:\Windows\System\UoosdFO.exe
  C:\Windows\System\UoosdFO.exe
  2⤵
  PID:10860
- C:\Windows\System\hiDvqtM.exe
  C:\Windows\System\hiDvqtM.exe
  2⤵
  PID:10888
- C:\Windows\System\ZPyVCRA.exe
  C:\Windows\System\ZPyVCRA.exe
  2⤵
  PID:10912
- C:\Windows\System\VFgnVDS.exe
  C:\Windows\System\VFgnVDS.exe
  2⤵
  PID:10968
- C:\Windows\System\vEDgCcf.exe
  C:\Windows\System\vEDgCcf.exe
  2⤵
  PID:11028
- C:\Windows\System\vcogKpf.exe
  C:\Windows\System\vcogKpf.exe
  2⤵
  PID:11056
- C:\Windows\System\DjjIHCE.exe
  C:\Windows\System\DjjIHCE.exe
  2⤵
  PID:11112
- C:\Windows\System\RFEPDtZ.exe
  C:\Windows\System\RFEPDtZ.exe
  2⤵
  PID:11184
- C:\Windows\System\jeTDxnQ.exe
  C:\Windows\System\jeTDxnQ.exe
  2⤵
  PID:11252
- C:\Windows\System\aeCkgFg.exe
  C:\Windows\System\aeCkgFg.exe
  2⤵
  PID:10328
- C:\Windows\System\YBLhzIN.exe
  C:\Windows\System\YBLhzIN.exe
  2⤵
  PID:9852
- C:\Windows\System\xxkCqUU.exe
  C:\Windows\System\xxkCqUU.exe
  2⤵
  PID:10408
- C:\Windows\System\PCgqmZL.exe
  C:\Windows\System\PCgqmZL.exe
  2⤵
  PID:10516
- C:\Windows\System\pBFeyYP.exe
  C:\Windows\System\pBFeyYP.exe
  2⤵
  PID:10576
- C:\Windows\System\PLqRyLr.exe
  C:\Windows\System\PLqRyLr.exe
  2⤵
  PID:10660
- C:\Windows\System\YJrkKEY.exe
  C:\Windows\System\YJrkKEY.exe
  2⤵
  PID:10692
- C:\Windows\System\cgVYSwv.exe
  C:\Windows\System\cgVYSwv.exe
  2⤵
  PID:10824
- C:\Windows\System\yVVNilX.exe
  C:\Windows\System\yVVNilX.exe
  2⤵
  PID:10792
- C:\Windows\System\izcUKMc.exe
  C:\Windows\System\izcUKMc.exe
  2⤵
  PID:10932
- C:\Windows\System\mblrOlI.exe
  C:\Windows\System\mblrOlI.exe
  2⤵
  PID:11020
- C:\Windows\System\rCLriTb.exe
  C:\Windows\System\rCLriTb.exe
  2⤵
  PID:11136
- C:\Windows\System\orNWwPQ.exe
  C:\Windows\System\orNWwPQ.exe
  2⤵
  PID:11172
- C:\Windows\System\WBDtEpx.exe
  C:\Windows\System\WBDtEpx.exe
  2⤵
  PID:11228
- C:\Windows\System\xjOBrFD.exe
  C:\Windows\System\xjOBrFD.exe
  2⤵
  PID:10384
- C:\Windows\System\ajpQOrx.exe
  C:\Windows\System\ajpQOrx.exe
  2⤵
  PID:10496
- C:\Windows\System\cxNCnqL.exe
  C:\Windows\System\cxNCnqL.exe
  2⤵
  PID:10640
- C:\Windows\System\WxgvRJs.exe
  C:\Windows\System\WxgvRJs.exe
  2⤵
  PID:10680
- C:\Windows\System\LbpBoHy.exe
  C:\Windows\System\LbpBoHy.exe
  2⤵
  PID:10876
- C:\Windows\System\mfWxtDd.exe
  C:\Windows\System\mfWxtDd.exe
  2⤵
  PID:10956
- C:\Windows\System\kaZotYj.exe
  C:\Windows\System\kaZotYj.exe
  2⤵
  PID:11120
- C:\Windows\System\PfYknxV.exe
  C:\Windows\System\PfYknxV.exe
  2⤵
  PID:11232
- C:\Windows\System\shxZLNa.exe
  C:\Windows\System\shxZLNa.exe
  2⤵
  PID:10308
- C:\Windows\System\tkMYKad.exe
  C:\Windows\System\tkMYKad.exe
  2⤵
  PID:10612
- C:\Windows\System\pEaYfZz.exe
  C:\Windows\System\pEaYfZz.exe
  2⤵
  PID:10872
- C:\Windows\System\RMVDYqj.exe
  C:\Windows\System\RMVDYqj.exe
  2⤵
  PID:10288
- C:\Windows\System\vnokVnf.exe
  C:\Windows\System\vnokVnf.exe
  2⤵
  PID:10504
- C:\Windows\System\lUNtFyz.exe
  C:\Windows\System\lUNtFyz.exe
  2⤵
  PID:10572
- C:\Windows\System\ECjwViH.exe
  C:\Windows\System\ECjwViH.exe
  2⤵
  PID:10952
- C:\Windows\System\PGRiALd.exe
  C:\Windows\System\PGRiALd.exe
  2⤵
  PID:10372
- C:\Windows\System\IjQyzcJ.exe
  C:\Windows\System\IjQyzcJ.exe
  2⤵
  PID:10900
- C:\Windows\System\DEJaNBf.exe
  C:\Windows\System\DEJaNBf.exe
  2⤵
  PID:11268
- C:\Windows\System\QXXftno.exe
  C:\Windows\System\QXXftno.exe
  2⤵
  PID:11296
- C:\Windows\System\Tnvnmaa.exe
  C:\Windows\System\Tnvnmaa.exe
  2⤵
  PID:11328
- C:\Windows\System\zABnbhU.exe
  C:\Windows\System\zABnbhU.exe
  2⤵
  PID:11364
- C:\Windows\System\OCMyGVd.exe
  C:\Windows\System\OCMyGVd.exe
  2⤵
  PID:11408
- C:\Windows\System\pMqRdmj.exe
  C:\Windows\System\pMqRdmj.exe
  2⤵
  PID:11436
- C:\Windows\System\fDcvBQD.exe
  C:\Windows\System\fDcvBQD.exe
  2⤵
  PID:11480
- C:\Windows\System\mQThwSI.exe
  C:\Windows\System\mQThwSI.exe
  2⤵
  PID:11532
- C:\Windows\System\lqZvgKe.exe
  C:\Windows\System\lqZvgKe.exe
  2⤵
  PID:11572
- C:\Windows\System\YgDKWqJ.exe
  C:\Windows\System\YgDKWqJ.exe
  2⤵
  PID:11620
- C:\Windows\System\nbpfIBB.exe
  C:\Windows\System\nbpfIBB.exe
  2⤵
  PID:11660
- C:\Windows\System\zcFMTFV.exe
  C:\Windows\System\zcFMTFV.exe
  2⤵
  PID:11724
- C:\Windows\System\sCCEfiJ.exe
  C:\Windows\System\sCCEfiJ.exe
  2⤵
  PID:11760
- C:\Windows\System\qNsnmot.exe
  C:\Windows\System\qNsnmot.exe
  2⤵
  PID:11804
- C:\Windows\System\BqfkxgP.exe
  C:\Windows\System\BqfkxgP.exe
  2⤵
  PID:11856
- C:\Windows\System\mRFknNj.exe
  C:\Windows\System\mRFknNj.exe
  2⤵
  PID:11884
- C:\Windows\System\hwfYLUX.exe
  C:\Windows\System\hwfYLUX.exe
  2⤵
  PID:11904
- C:\Windows\System\SvUyDiW.exe
  C:\Windows\System\SvUyDiW.exe
  2⤵
  PID:11944
- C:\Windows\System\VTMkaNz.exe
  C:\Windows\System\VTMkaNz.exe
  2⤵
  PID:12000
- C:\Windows\System\NEkegLY.exe
  C:\Windows\System\NEkegLY.exe
  2⤵
  PID:12056
- C:\Windows\System\ORltAor.exe
  C:\Windows\System\ORltAor.exe
  2⤵
  PID:12100
- C:\Windows\System\hPPvvZE.exe
  C:\Windows\System\hPPvvZE.exe
  2⤵
  PID:12120
- C:\Windows\System\JrwKzco.exe
  C:\Windows\System\JrwKzco.exe
  2⤵
  PID:12160
- C:\Windows\System\fGpQgfu.exe
  C:\Windows\System\fGpQgfu.exe
  2⤵
  PID:12200
- C:\Windows\System\xDjSRqb.exe
  C:\Windows\System\xDjSRqb.exe
  2⤵
  PID:12216
- C:\Windows\System\IHdOwUm.exe
  C:\Windows\System\IHdOwUm.exe
  2⤵
  PID:12256
- C:\Windows\System\BsdwnEv.exe
  C:\Windows\System\BsdwnEv.exe
  2⤵
  PID:10804
- C:\Windows\System\iRIJXJD.exe
  C:\Windows\System\iRIJXJD.exe
  2⤵
  PID:11344
- C:\Windows\System\PedBClK.exe
  C:\Windows\System\PedBClK.exe
  2⤵
  PID:11416
- C:\Windows\System\XxARyte.exe
  C:\Windows\System\XxARyte.exe
  2⤵
  PID:11544
- C:\Windows\System\tAPHDyJ.exe
  C:\Windows\System\tAPHDyJ.exe
  2⤵
  PID:11604
- C:\Windows\System\ddnMygo.exe
  C:\Windows\System\ddnMygo.exe
  2⤵
  PID:11716
- C:\Windows\System\xWpyrZo.exe
  C:\Windows\System\xWpyrZo.exe
  2⤵
  PID:11844
- C:\Windows\System\GPddkhr.exe
  C:\Windows\System\GPddkhr.exe
  2⤵
  PID:11936
- C:\Windows\System\ktBHvYK.exe
  C:\Windows\System\ktBHvYK.exe
  2⤵
  PID:12032
- C:\Windows\System\ZzxgVgW.exe
  C:\Windows\System\ZzxgVgW.exe
  2⤵
  PID:12088
- C:\Windows\System\ZeFLzRV.exe
  C:\Windows\System\ZeFLzRV.exe
  2⤵
  PID:12184
- C:\Windows\System\vwWSSsL.exe
  C:\Windows\System\vwWSSsL.exe
  2⤵
  PID:12208
- C:\Windows\System\hIvaEMQ.exe
  C:\Windows\System\hIvaEMQ.exe
  2⤵
  PID:11340
- C:\Windows\System\sidlvJP.exe
  C:\Windows\System\sidlvJP.exe
  2⤵
  PID:11424
- C:\Windows\System\PUzvXbL.exe
  C:\Windows\System\PUzvXbL.exe
  2⤵
  PID:11524
- C:\Windows\System\zRRexZT.exe
  C:\Windows\System\zRRexZT.exe
  2⤵
  PID:11772
- C:\Windows\System\qpuwBOh.exe
  C:\Windows\System\qpuwBOh.exe
  2⤵
  PID:11932
- C:\Windows\System\zAuoJtW.exe
  C:\Windows\System\zAuoJtW.exe
  2⤵
  PID:12148
- C:\Windows\System\rqpyzHz.exe
  C:\Windows\System\rqpyzHz.exe
  2⤵
  PID:11216
- C:\Windows\System\OOcYnqX.exe
  C:\Windows\System\OOcYnqX.exe
  2⤵
  PID:11372
- C:\Windows\System\XvbMfIi.exe
  C:\Windows\System\XvbMfIi.exe
  2⤵
  PID:11880
- C:\Windows\System\epKEoQF.exe
  C:\Windows\System\epKEoQF.exe
  2⤵
  PID:12280
- C:\Windows\System\LzQaBbS.exe
  C:\Windows\System\LzQaBbS.exe
  2⤵
  PID:11556
- C:\Windows\System\adXOqIm.exe
  C:\Windows\System\adXOqIm.exe
  2⤵
  PID:12188
- C:\Windows\System\gftnnJW.exe
  C:\Windows\System\gftnnJW.exe
  2⤵
  PID:11476
- C:\Windows\System\arOGKId.exe
  C:\Windows\System\arOGKId.exe
  2⤵
  PID:11568
- C:\Windows\System\HHjvaaT.exe
  C:\Windows\System\HHjvaaT.exe
  2⤵
  PID:12320
- C:\Windows\System\VMeGJgz.exe
  C:\Windows\System\VMeGJgz.exe
  2⤵
  PID:12360
- C:\Windows\System\YuqXVCY.exe
  C:\Windows\System\YuqXVCY.exe
  2⤵
  PID:12392
- C:\Windows\System\cPFrUmq.exe
  C:\Windows\System\cPFrUmq.exe
  2⤵
  PID:12432
- C:\Windows\System\LXaVrmK.exe
  C:\Windows\System\LXaVrmK.exe
  2⤵
  PID:12484
- C:\Windows\System\sQmRdTb.exe
  C:\Windows\System\sQmRdTb.exe
  2⤵
  PID:12508
- C:\Windows\System\Zgnxvhp.exe
  C:\Windows\System\Zgnxvhp.exe
  2⤵
  PID:12540
- C:\Windows\System\qZBLTKe.exe
  C:\Windows\System\qZBLTKe.exe
  2⤵
  PID:12576
- C:\Windows\System\aHzwZAn.exe
  C:\Windows\System\aHzwZAn.exe
  2⤵
  PID:12604
- C:\Windows\System\DUHalgY.exe
  C:\Windows\System\DUHalgY.exe
  2⤵
  PID:12644
- C:\Windows\System\ZGHgYOA.exe
  C:\Windows\System\ZGHgYOA.exe
  2⤵
  PID:12676
- C:\Windows\System\wxZqftP.exe
  C:\Windows\System\wxZqftP.exe
  2⤵
  PID:12704
- C:\Windows\System\nxjOWNI.exe
  C:\Windows\System\nxjOWNI.exe
  2⤵
  PID:12740
- C:\Windows\System\xRRlYgs.exe
  C:\Windows\System\xRRlYgs.exe
  2⤵
  PID:12768
- C:\Windows\System\lQpnJkx.exe
  C:\Windows\System\lQpnJkx.exe
  2⤵
  PID:12796
- C:\Windows\System\rZJpzVC.exe
  C:\Windows\System\rZJpzVC.exe
  2⤵
  PID:12816
- C:\Windows\System\AsnCkYa.exe
  C:\Windows\System\AsnCkYa.exe
  2⤵
  PID:12852
- C:\Windows\System\TupAquD.exe
  C:\Windows\System\TupAquD.exe
  2⤵
  PID:12880
- C:\Windows\System\iZBBina.exe
  C:\Windows\System\iZBBina.exe
  2⤵
  PID:12908
- C:\Windows\System\zqiSrRB.exe
  C:\Windows\System\zqiSrRB.exe
  2⤵
  PID:12936
- C:\Windows\System\kVqOXGR.exe
  C:\Windows\System\kVqOXGR.exe
  2⤵
  PID:12964
- C:\Windows\System\XZVuddQ.exe
  C:\Windows\System\XZVuddQ.exe
  2⤵
  PID:13000
- C:\Windows\System\gIKSRcC.exe
  C:\Windows\System\gIKSRcC.exe
  2⤵
  PID:13028
- C:\Windows\System\veLPSTp.exe
  C:\Windows\System\veLPSTp.exe
  2⤵
  PID:13060
- C:\Windows\System\lCZkmrC.exe
  C:\Windows\System\lCZkmrC.exe
  2⤵
  PID:13080
- C:\Windows\System\OJAskiO.exe
  C:\Windows\System\OJAskiO.exe
  2⤵
  PID:13108
- C:\Windows\System\NBxyUKb.exe
  C:\Windows\System\NBxyUKb.exe
  2⤵
  PID:13156
- C:\Windows\System\CVYeszb.exe
  C:\Windows\System\CVYeszb.exe
  2⤵
  PID:13184
- C:\Windows\System\RoXINKq.exe
  C:\Windows\System\RoXINKq.exe
  2⤵
  PID:13204
- C:\Windows\System\gshzUYu.exe
  C:\Windows\System\gshzUYu.exe
  2⤵
  PID:13244
- C:\Windows\System\NVKFQne.exe
  C:\Windows\System\NVKFQne.exe
  2⤵
  PID:13272
- C:\Windows\System\kwwTnIL.exe
  C:\Windows\System\kwwTnIL.exe
  2⤵
  PID:13288
- C:\Windows\System\eoQhRtQ.exe
  C:\Windows\System\eoQhRtQ.exe
  2⤵
  PID:11312
- C:\Windows\System\OEmhIBN.exe
  C:\Windows\System\OEmhIBN.exe
  2⤵
  PID:12380
- C:\Windows\System\oiSZcBr.exe
  C:\Windows\System\oiSZcBr.exe
  2⤵
  PID:12348
- C:\Windows\System\bxhKIYs.exe
  C:\Windows\System\bxhKIYs.exe
  2⤵
  PID:12444
- C:\Windows\System\LdsfniQ.exe
  C:\Windows\System\LdsfniQ.exe
  2⤵
  PID:12492
- C:\Windows\System\DBPWalG.exe
  C:\Windows\System\DBPWalG.exe
  2⤵
  PID:12564
- C:\Windows\System\NbyiXoJ.exe
  C:\Windows\System\NbyiXoJ.exe
  2⤵
  PID:12584
- C:\Windows\System\wZxZcvQ.exe
  C:\Windows\System\wZxZcvQ.exe
  2⤵
  PID:12640
- C:\Windows\System\qxzMkAy.exe
  C:\Windows\System\qxzMkAy.exe
  2⤵
  PID:12716
- C:\Windows\System\vcVJpVl.exe
  C:\Windows\System\vcVJpVl.exe
  2⤵
  PID:12764
- C:\Windows\System\KuqYbIX.exe
  C:\Windows\System\KuqYbIX.exe
  2⤵
  PID:12876
- C:\Windows\System\wBtnuoZ.exe
  C:\Windows\System\wBtnuoZ.exe
  2⤵
  PID:12948
- C:\Windows\System\WEAbLbX.exe
  C:\Windows\System\WEAbLbX.exe
  2⤵
  PID:12996
- C:\Windows\System\pNvjRrH.exe
  C:\Windows\System\pNvjRrH.exe
  2⤵
  PID:3888
- C:\Windows\System\EDIkZoD.exe
  C:\Windows\System\EDIkZoD.exe
  2⤵
  PID:13100
- C:\Windows\System\xjbCakI.exe
  C:\Windows\System\xjbCakI.exe
  2⤵
  PID:13192
- C:\Windows\System\mrhWVzE.exe
  C:\Windows\System\mrhWVzE.exe
  2⤵
  PID:13220
- C:\Windows\System\VmkAJgn.exe
  C:\Windows\System\VmkAJgn.exe
  2⤵
  PID:13300
- C:\Windows\System\duDQXkc.exe
  C:\Windows\System\duDQXkc.exe
  2⤵
  PID:12340
- C:\Windows\System\TzkGpcQ.exe
  C:\Windows\System\TzkGpcQ.exe
  2⤵
  PID:12532
- C:\Windows\System\aymUnOe.exe
  C:\Windows\System\aymUnOe.exe
  2⤵
  PID:12688
- C:\Windows\System\ixEIICl.exe
  C:\Windows\System\ixEIICl.exe
  2⤵
  PID:12804
- C:\Windows\System\YwFGHBK.exe
  C:\Windows\System\YwFGHBK.exe
  2⤵
  PID:12980
- C:\Windows\System\haJMGNJ.exe
  C:\Windows\System\haJMGNJ.exe
  2⤵
  PID:13068
- C:\Windows\System\uOAWxSJ.exe
  C:\Windows\System\uOAWxSJ.exe
  2⤵
  PID:13212
- C:\Windows\System\RalyxKy.exe
  C:\Windows\System\RalyxKy.exe
  2⤵
  PID:12248
- C:\Windows\System\SNTxiBV.exe
  C:\Windows\System\SNTxiBV.exe
  2⤵
  PID:12624
- C:\Windows\System\SrORdls.exe
  C:\Windows\System\SrORdls.exe
  2⤵
  PID:13020
- C:\Windows\System\ZYdUujn.exe
  C:\Windows\System\ZYdUujn.exe
  2⤵
  PID:13268
- C:\Windows\System\eigoRfe.exe
  C:\Windows\System\eigoRfe.exe
  2⤵
  PID:12904
- C:\Windows\System\yCESEFD.exe
  C:\Windows\System\yCESEFD.exe
  2⤵
  PID:12700
- C:\Windows\System\xmlzLRg.exe
  C:\Windows\System\xmlzLRg.exe
  2⤵
  PID:13316
- C:\Windows\System\fvbKSaX.exe
  C:\Windows\System\fvbKSaX.exe
  2⤵
  PID:13344
- C:\Windows\System\vcgvMxE.exe
  C:\Windows\System\vcgvMxE.exe
  2⤵
  PID:13380
- C:\Windows\System\tBLKkZR.exe
  C:\Windows\System\tBLKkZR.exe
  2⤵
  PID:13416
- C:\Windows\System\iicWWhJ.exe
  C:\Windows\System\iicWWhJ.exe
  2⤵
  PID:13452
- C:\Windows\System\lEtiXWa.exe
  C:\Windows\System\lEtiXWa.exe
  2⤵
  PID:13476
- C:\Windows\System\RfBksbi.exe
  C:\Windows\System\RfBksbi.exe
  2⤵
  PID:13508
- C:\Windows\System\NmeSQZi.exe
  C:\Windows\System\NmeSQZi.exe
  2⤵
  PID:13536
- C:\Windows\System\ftHRnux.exe
  C:\Windows\System\ftHRnux.exe
  2⤵
  PID:13556
- C:\Windows\System\TVwnQgM.exe
  C:\Windows\System\TVwnQgM.exe
  2⤵
  PID:13596
- C:\Windows\System\tUqwTaZ.exe
  C:\Windows\System\tUqwTaZ.exe
  2⤵
  PID:13616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pllmwe3p.tkx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AeMSarM.exe

Filesize
8B

MD5
1855a32bc20d82a1da2b5edf8967f4e6

SHA1
25928e56f89ec28b56047592b93000c1d36e2a23

SHA256
197265335822dae03e837ac88a16d32bf68b201da4bc921af00edba259c1267c

SHA512
6ba43273aa11ef21001bd21641b2cb12d306e904aaff29ff56a8c7b3eadaaec0f04afabf47cd7eb2a1a7b9c79f098b4d11d9a442d2048486e96355d7914a5e67

Download Submit
C:\Windows\System\FHePtDc.exe

Filesize
2.9MB

MD5
9660dc05178ae018f1c838adc66886e0

SHA1
0e93ae0ca3e92d560da97257f80ad65ede4f1576

SHA256
fd85938fa2fd43ab3f4569fdfcac11167e5959e5a8a66a10d1a4a03ae471ddd3

SHA512
355202586b5ca6c7415ee74392cdcfc25251da7e61e34507a2954b84d739214e30f1594e34e5e3b2bfcc1eac1f031c5ed5a6c0a70b2c81515db48672543923bd

Download Submit
C:\Windows\System\GQSFHVB.exe

Filesize
2.9MB

MD5
fbb11940f189a30de2d0a5812bdeab6c

SHA1
85bbf2d1e03f08a8a59f107857c8f7be039321ab

SHA256
c9ce09157a192887e9df0cb672bd464cd3401b99e25edd1a9c46ad110a8c42bc

SHA512
2de8a6d4d065ea7dd6c1aa2f21aa950c30ee0369b9f39c7ab5f7bcb244778cfc4bf9b406025395890472a265b17ded4b4baeeea770f9c5d4bbc06a40cd5ab8b7

Download Submit
C:\Windows\System\HUjrWQS.exe

Filesize
2.9MB

MD5
6b33f90453b757d11a0a5abf3ee3bd11

SHA1
1ecd7d86c54a8dac76d751d6125ec06ca6daecfa

SHA256
1beeb5d2b5d4d27aec598558359f08b60cb5953e2eb64c6c73b3819fbaa2cce4

SHA512
182c4f925faf6afd994dc6f989672fdce2bdfb3494fe486c45f5fed3b6d012bf988e5ad82129f271ef16fa3cece7393eecf60e76ad76feae6efca6ea97c2f102

Download Submit
C:\Windows\System\HlSqpPA.exe

Filesize
2.9MB

MD5
b4a30fde83fc0564fd05c8d9c38e97ac

SHA1
416b94621e3e81a8a66bad5c4fb6086e1f834bfa

SHA256
04215845d945691a8584a1ff65ba64f0b1e0e9218bcb81cf9197b060b76fb177

SHA512
81acb1d662b62dda442c02e72c615f45823da776d822158ed6fb17ea50ceb57ce3180df4ccf931e1e7a155d2d70f187a62d824dee3ae736a0cac3b3ecf4164a8

Download Submit
C:\Windows\System\ISJgXso.exe

Filesize
2.9MB

MD5
9fa03b437b145d753b109407e213b7e2

SHA1
ae76806bda5334015b48f7571f3169091fbda1f4

SHA256
bd3fb49f8cfa926c11757ea7933eea602bbf33ed99fb41939eefb22c62b724d0

SHA512
c97220ecd0ae9f060905d790818f8bed882db198dd5423427a6b67f3e498461d04719a2c7c173f6083f61693c4bd33e70514dca93acd051f54c92a81a19063c7

Download Submit
C:\Windows\System\IcVQVcD.exe

Filesize
2.9MB

MD5
1218031ebbcecc8ae1aa583e4b42f742

SHA1
b0d6c211d6f2c11b58608105125eb99af49b2c7c

SHA256
bc2d6fc945811cf8f89a6fc5f004924a39dd7ce4e5602537f6383a5c010ff5c7

SHA512
8d7e552b2d38d3d905ca1e01a9e1b6663686088645234c3a1225e829cfc523f229d503c2589ac50b82200ccb05505f31c9fe06b8dd19fea785cf3f290aa88724

Download Submit
C:\Windows\System\IyEiIYx.exe

Filesize
2.9MB

MD5
51e4e175c1a4c2f15467cdd56ba84fd7

SHA1
4ae989c8f5253e4cf322e051570895d0bef42c10

SHA256
3c4d1b85abdfcd8fd8d2aab7b2d1d4561253b41d50e9108387140cb62ff0c1da

SHA512
7dcf8402fa11f50a8ae8859b93ba60f03c98f75e56b8bd51692f81f997dae515aaeb73eaf7b8f70f4242460ef4483a43c2f8e4d0e194b9c331bc99c3e629da0b

Download Submit
C:\Windows\System\JrWbQjw.exe

Filesize
2.9MB

MD5
c40bf47cd78c2e3c334b072d7f1f6005

SHA1
07a883ac96b5ae61bb68ac8f0cf64618817bd943

SHA256
423c83905b44720c02dfa90d5b98d09cdbad9c8bf092c01f460af5dc8632c9a4

SHA512
bfedb489fd891fe0adfa428c09149602cf50a654327c52965ef81b880faa42f67122ec391bf2a7e613b1ec2c217a7249d921db52a0da1e73757b99ba467834be

Download Submit
C:\Windows\System\JvChEtj.exe

Filesize
2.9MB

MD5
2cfe8d6134035d382db68674062954a8

SHA1
c21e34d2285b6c1c021ad0bb069f5da7a3923e38

SHA256
32e2827591b965eac428c220d156227727149f7a8831f843e2b4b70beefc17bd

SHA512
76aedc8f59bfbd08c3dd37991b96c9a8eb0d714914a10632ecdd95f549b94f96113c4ab8423c5ecfc9ac50b465e942d4ef922255197b5758454312c033662f8f

Download Submit
C:\Windows\System\MguuATR.exe

Filesize
2.9MB

MD5
e57a14d776b160f8c28083593635ee91

SHA1
db040b6b6ba3212d2c4961670225ef7c532a8d6b

SHA256
34e866ddd3ab8e1511631de6d0570807d47d88c06e1f65ee2ad11db95616717a

SHA512
7ccb6a06f93c90cb09946caebbe6fed30d1ba888bdb1de3732ad8133334a3a4cbf5c64d77ad1069a1b8ab5b34fffeb5d7ff836f4f63f62d99005e68ea567a89a

Download Submit
C:\Windows\System\NUJldnr.exe

Filesize
2.9MB

MD5
2243e5a4f02b86c725a0c5c7140ca662

SHA1
8df2432e10d2a6da66adc801a302b0b2bb8f1e16

SHA256
f9013e8072b12e83fcba782b87116d73cf5a0cf283fcd88506dd5cf76e20f1ce

SHA512
6fbf290fc4c339d2251978c11ce88f916710c25e883587c93e753814b26fcb2f0bea6287dca306c5770f3767b21b38323f0952314ff24e0e4ba1541ecf69c34f

Download Submit
C:\Windows\System\OdHQUPj.exe

Filesize
2.9MB

MD5
970d9478318eed53c374f703e7e9ac89

SHA1
d771456af4247bd001d13f4a1aa84d8210089d25

SHA256
5d03257879dcb31fb678bdec9c9438e0def75d3b8f0c16029592348e8721f93e

SHA512
8053d23169e5a6c7eb386e73f2a85905e48be09cd973457686a2de2c6350f5f33344c4b0939dc3af54eb4dd3e4ec886f888e1e1925f847d6c6c17978302a594c

Download Submit
C:\Windows\System\QgtAvPP.exe

Filesize
2.9MB

MD5
f87bfdbedff85ca60d946e5d447d418a

SHA1
dc18a824f2adfe2b1f844c2ab1787ace93dd7c9a

SHA256
a93f307f87042c93b87416bb2270fb5d59453c60d045d271ab6ec42723f5adc6

SHA512
693b28685a1fc0aaee6cdf6d7837015f494365486289916a16c3694cf00bc70a4e0b7d26da49935ec121c4f8d08ea0ba3be1c73afc995a1bc0c518bb348d4681

Download Submit
C:\Windows\System\QybHSDV.exe

Filesize
2.9MB

MD5
8cd18c5fc359e981607f9ee74b42d2ae

SHA1
46abf59a7ad18863708a8fc408e116cc50955a60

SHA256
a2ee20c596fe9d944252f51b4a7454d04f643c3fd2edef10619210c5bfad80cb

SHA512
adf946787328228a5cb88e74a933be0efe88a727e5391d42371fb54eab7c39ce78ea5d01ff4e3e65166f37ff7d39a19ee156069d04f839bc3416a548e02f7421

Download Submit
C:\Windows\System\RGKdtnb.exe

Filesize
2.9MB

MD5
55ad40793327fe8cac6c830a8290c42a

SHA1
f4c3bb22e0819e3ddd39a137d66468dee931c38b

SHA256
a19f70d0bef8b17695ef7626219f1affe711aa3c5bff62a1785319ba19e1a1f3

SHA512
7e3f1f2c495fb81105fa14a0d1a55548906867908e3c68a93e7283e909e63ab6665476face6cb2661bf7dd3c61341a9ac95531254332321c3530a48d11db3047

Download Submit
C:\Windows\System\TAzqIDF.exe

Filesize
2.9MB

MD5
554490c2614a04e2b88a722db4c8c1f8

SHA1
dc08ef645f791e1910253a4a51cb5274a18bc6fc

SHA256
299976a19e45ccdffc170f24a7396d752c265a05668e95812b5ad9616734a7e6

SHA512
fd40a76138d380fb8e679fa16b87b877c0f52395d0bc089a4decd8cddbdbbb0f71ed822a30fc73889d04d8ddabd70a28d14a74970c81ff1865e4189479ef4858

Download Submit
C:\Windows\System\UAlYdjI.exe

Filesize
2.9MB

MD5
20645237dcb0ce198ba238dd4bbdc2e6

SHA1
39525bb19e741cff5e0cee2a0f7fbfe06f9f3e96

SHA256
ba3e9fe4645357852ebbd2e4904e38e85ea2b90888d49a2421f775eae70f1c98

SHA512
b356afca97e628f0206cd3d5cf734bf82388fe47d02e902d5c8ec06909d907f69ec313e318601c07e081b5e62a86505345987a2076d090391fec0366b3b8eb08

Download Submit
C:\Windows\System\YMRdLcb.exe

Filesize
2.9MB

MD5
12a5a3d5b0a087f5d6fc6bf78a8492fb

SHA1
e97dcad1ebcbec8acb1b4e0bbdb121004ab3f462

SHA256
faadb0da1206066ae6e2cd002ed8e609b3033bedb8f62352adfddc47c7b91749

SHA512
c0d41a11bf2f2199cd87abd7e442f3de05772f59c0260baf3256fbb1cc17796e42ea059313381d342f564d0b4793a10ab515d94106018bcdee30c02f3d7dbe04

Download Submit
C:\Windows\System\YMgxckm.exe

Filesize
2.9MB

MD5
8cc25024bac9884a0d2365688909e3e5

SHA1
9d8561d2df907a217b2d2650898659a879188d07

SHA256
29b737ade225a00457d3df82a9355cff3c1977fe96e6765270144b1c0fb174a2

SHA512
24c9f1b16a7a0fd75929fad6c9776d0a97f83c57bfc6e9095c1f2c49e423e4e01372d0df0c667b7ada359082bf6e8d36d76a060940e622875914742af239adea

Download Submit
C:\Windows\System\YQuHAol.exe

Filesize
2.9MB

MD5
627fdb6837f82df2b3ab75dc0e1a02a0

SHA1
a5aaa6d5b82859fefed7084005feabe0d877a098

SHA256
2980636e41c8b2bb00fa529548e3782c4454b01ec8ba0258d36d7979037e4aad

SHA512
51339806903f9f77c2b9664b862d338ca1092f4b93d14bee1018436fcc13e0de25c3368ffb967752d37bd4ca06cb26e39b273438f8c1233b7e4f96bcafb02c1e

Download Submit
C:\Windows\System\ZQuLBfW.exe

Filesize
2.9MB

MD5
416e1f669100de2bab2e343d70102a78

SHA1
49f6c4172ce45b8b1b7a778afcbd8010c3fef427

SHA256
5b944c2929eb61c8be892292456b53710f1781eb14ea46a7a85019fdba48798d

SHA512
42cc3b0688df37b32776a14c8b9802fd72aeb55b0d6221e4fa7528c2a00055d02e43ce8bbc5bf54925ff3f9893f87e2c9a01fa99d91f6547da1c5f73e1b262a4

Download Submit
C:\Windows\System\aNMeVoc.exe

Filesize
2.9MB

MD5
b86f6309a900862d23f2fdf0cfdcd024

SHA1
e7fe57915b63abb914e5624885c34e73c75c3e53

SHA256
b84c12be17929369a6658af1477f6a15ab30e44156a42f8c3ccc28ddd7bdb801

SHA512
e624b63879392b1126ebf0b0592cc7f75353ab4d81d20dabab8a7aade6c78615fbd716f291a9a10b891b7ed0a2b112a4bfb50c9462d2bca21fd2306750344dd8

Download Submit
C:\Windows\System\ciNtRff.exe

Filesize
2.9MB

MD5
94ace14006d4225512a7fd68f9114c36

SHA1
9aa536cae54554c10268d130e24987f8bf7defd4

SHA256
f2738ac7e165bd0b326aa09e0c854417012fcfb2c928125154d80d4f14068260

SHA512
7e584a4e9b9746f7a7d47bf50bc8c0eeb3cf837bc4c400b8d00770cdcce8e75f743f9f9799d384d81b3e3835c36273eb24e27fd8cfdf7d10bee1508ceea08283

Download Submit
C:\Windows\System\ebSLiON.exe

Filesize
2.9MB

MD5
6eebe456584523dc1af01d4c79a21419

SHA1
aa979a750c816e299f377d8f3f767158b0f24555

SHA256
cee3d0d859dab72f099dbe2111054a9ff9006d3412b70a397ccf25ab6570b184

SHA512
7f35b0b860878c87acadd2629ad5821dc4f97c6e97939a7403309dee11a8af6bc42a251fda9d14e17edf8ef5c897091e3e0b2ba601d2bae21ddd13649fc80fb2

Download Submit
C:\Windows\System\fiUVIHq.exe

Filesize
2.9MB

MD5
0e2c21dc866c4bdff2f967917ae9418f

SHA1
3010f360c8c0031d5681833eed4d5379b774f9d5

SHA256
a7400f7d136613572b960f08dce89faea83bee0ecf3332fc2c6ed0fde4d5970b

SHA512
0c4c96e8ac1056a2b2689659fdac7c9003fb14fda13f1abce949debb6a76e89af1db07367dd1ab47d03273028f9c3328d0a8466330511ac1b69d9c6a09e63599

Download Submit
C:\Windows\System\hMpooxW.exe

Filesize
2.9MB

MD5
6df4663845ac0acde0b9d6964423145f

SHA1
bfe432aa5f00f75ee495567770a98e98d73fc97d

SHA256
98d2ecd924bb89109d26fcce21c0161deb9821226950738c0b985a7422a0de29

SHA512
2b8db4cc731358716b148f38e38acadba6fe47a718398b35640576545e7bb23720afb7c698cb5b62d384e5fab5f33d4a231f4840797295035e4b375b41512a48

Download Submit
C:\Windows\System\hgooLsa.exe

Filesize
2.9MB

MD5
161cca9b3e5ce1b74fc2c0775674faec

SHA1
ca619dbdffbc5fb5f35ae721800af8135a0ae9d1

SHA256
3d263237fe4d46bc13ae9e3e67ded8766fe09de18789a024b77ff78bda134025

SHA512
f5f1e43da08bbfb78f83b69fe31efe517768764636bda0db5d6177f327fd6a5f041df582c01bfa50d371c6a1095ef275e6f730a11b532d71efa16390d94028d2

Download Submit
C:\Windows\System\izLLgCG.exe

Filesize
2.9MB

MD5
63da03091984c9cc0839506ad737b1d5

SHA1
8933ff903fa75c58cac93736dd169b0c409afe5e

SHA256
971444e6e60894d6016676ccd88f0a4145590a3bd8d6411db6d47ff97f851689

SHA512
f8f9963962f95df911e99175afeb9cb0cfe93727b237b1fe7961eecd1e39d70d27ddac33ddc5f5524dea2af11c2e12506906123d66cd708dfd4e5aeb723f5727

Download Submit
C:\Windows\System\jQIjmvH.exe

Filesize
2.9MB

MD5
cbc5f0887c914ac83868dbf1b3a1b905

SHA1
e279842cb8c1355d72acb0b1f663b77da70eb597

SHA256
8c3133a80f2f268f3e313e95ea1ed628ad84d5ebbffc8c50e9f561259822765b

SHA512
4d8cf546cbd21d08b33879890d14b2adfa5194f5933a11035fd25e031ca3d5f19407dc67ff84996bfc3cac1f45dcfd057874af94136d59a28644877e5a22bdd1

Download Submit
C:\Windows\System\jwESHKr.exe

Filesize
2.9MB

MD5
92034a65eceafefe50cb1533f74467dc

SHA1
ca8a4d03b61826733857c7c27677023970b8746e

SHA256
7a41adb412688c74d32b12ee96affa97bfb046bfcfdef16bf63fe7fb1e01d728

SHA512
1a8099d8d13f9ff7b1199081699178752359c27040599aa3e4e967aea97e1b508d67d28b47ceb5f22eb2a828b1bba64a801e3014521db4f066f699ef2e9fd2cd

Download Submit
C:\Windows\System\koEpEpd.exe

Filesize
2.9MB

MD5
9aca87fa16148ed79e8d0789f97dd20a

SHA1
fa92e9ace121e044b92c42687f99a48d18627251

SHA256
fac89a41a9852409c3cf70b2ea84c2760c7f012464d2cad627452a9bc8d5ea11

SHA512
daf586a56acbf8fc4874ec54572f996901829b7c8a00b370df3c4e363ec565d50b80d037dae52d6d102f4ddc7c706dc9ec74e3641960a711e3e02cf3c15bb85f

Download Submit
C:\Windows\System\pXohRNw.exe

Filesize
2.9MB

MD5
1ca17fe4cbd792221ba5d35595953863

SHA1
547e5f3bb3473144e53949c49457c8292eeb6ad8

SHA256
20c9c6b491df14a2041e3d8bd2fceec27bc2aed422f9eaad615b836e61eed932

SHA512
3bf1b3c4bedd82940a66bd3761e3835d2fdbec99721cd421d9c7304df161cddbc1d2ca179beefc4e06214b292a0a775a261a3c6a2a0349c7f32316589992da11

Download Submit
C:\Windows\System\pltykOp.exe

Filesize
2.9MB

MD5
3deb39b56c9b1243db0cd93f33448f4c

SHA1
bffccc37bfa7d2a23e66c437d052ca5285c8bb70

SHA256
31d17d2aec8d39192e6e2b92b839b48b563281787b31624785853a9d67ed1c29

SHA512
e03ffb60f5743e5b92827ab0c469336fc5f9905456e8b08b9cb9eab6252f341694d6b2abfbc0a7a160cb0f44a8453113037f5c99a8b33bd6db02833b77618e70

Download Submit
C:\Windows\System\vHTFozS.exe

Filesize
2.9MB

MD5
0300e4e4293eb4a26a42ff51438d3065

SHA1
fdfab5c968347f4db887f2fb37da3d1f948814f5

SHA256
a573fa64cd31f9db5afe15360a433013f57548de2bd6d9aefde6c4d3b6a01a7e

SHA512
e2abbf526a7f949ff1561fddc314e52a3b8446770dfc1c80d4f9f58b343960291ad72e9bd7eb4c0886a94c68f8ac9c1f6bc52c1ff9c17b801e5423912590ac1b

Download Submit
C:\Windows\System\vdGYWrF.exe

Filesize
2.9MB

MD5
171a5a57b85dbfb1000c535319bb2e52

SHA1
9569f3b0a253ab55b072e594bc2799a59bd1c736

SHA256
36f031381c9c0a0bf157ad4737d866e9c968939cf3b4c7ab438442cd8a2b7167

SHA512
948ddab54287c6161d22ca1a841e5fa6a660ce6465c992739fe06505cece74b082b313c3bfb93006032f6e0591a67e510fa713b6713ace4c9475b94fa054f303

Download Submit
C:\Windows\System\wXbGJfY.exe

Filesize
2.9MB

MD5
988d879cadcc910ccf93aadfc932492d

SHA1
dd9bb3122c94223b8b8af236a7045cc275a1b46e

SHA256
82b93b4b736ac0c14f9d7c509eb0c3c35b4834b425a284a784a55db28c740854

SHA512
824dd6b6a88c216d3231e1a93395f7de8dbe7a2d7d748eec94217a47f9cf6e917123bbf063165bdf49a006f7b7d4763c4371694f83e2da33e338e6fea4eac778

Download Submit
C:\Windows\System\wxEJtTA.exe

Filesize
2.9MB

MD5
d3d631eddf17d9070342a236b78d9bf1

SHA1
0332c869fc2571bd3d9bb72e099a353a4689e007

SHA256
bba0e6badbcb773c3f492624de3eadbf6178706876f9d16f8708e18f4c464aa2

SHA512
07ea063cdf1d5b6da9f31546328206fecdf6de971e8e9db451a2c15fa8aac261112d02d9365c43261efac2a0280d274f9bc3ca6a11ff2ba244bd1f6ae9b5853b

Download Submit
memory/220-200-0x00007FF6BA2C0000-0x00007FF6BA6B6000-memory.dmp

Filesize
4.0MB

Download
memory/220-2609-0x00007FF6BA2C0000-0x00007FF6BA6B6000-memory.dmp

Filesize
4.0MB

Download
memory/320-2602-0x00007FF6754F0000-0x00007FF6758E6000-memory.dmp

Filesize
4.0MB

Download
memory/320-192-0x00007FF6754F0000-0x00007FF6758E6000-memory.dmp

Filesize
4.0MB

Download
memory/368-208-0x00007FF639090000-0x00007FF639486000-memory.dmp

Filesize
4.0MB

Download
memory/368-2614-0x00007FF639090000-0x00007FF639486000-memory.dmp

Filesize
4.0MB

Download
memory/392-2613-0x00007FF6A7780000-0x00007FF6A7B76000-memory.dmp

Filesize
4.0MB

Download
memory/392-204-0x00007FF6A7780000-0x00007FF6A7B76000-memory.dmp

Filesize
4.0MB

Download
memory/696-2617-0x00007FF6CCAB0000-0x00007FF6CCEA6000-memory.dmp

Filesize
4.0MB

Download
memory/696-207-0x00007FF6CCAB0000-0x00007FF6CCEA6000-memory.dmp

Filesize
4.0MB

Download
memory/864-2596-0x00007FF740B60000-0x00007FF740F56000-memory.dmp

Filesize
4.0MB

Download
memory/864-48-0x00007FF740B60000-0x00007FF740F56000-memory.dmp

Filesize
4.0MB

Download
memory/872-213-0x00007FF741920000-0x00007FF741D16000-memory.dmp

Filesize
4.0MB

Download
memory/872-2619-0x00007FF741920000-0x00007FF741D16000-memory.dmp

Filesize
4.0MB

Download
memory/1048-203-0x00007FF6119A0000-0x00007FF611D96000-memory.dmp

Filesize
4.0MB

Download
memory/1048-2618-0x00007FF6119A0000-0x00007FF611D96000-memory.dmp

Filesize
4.0MB

Download
memory/1068-212-0x00007FF786EA0000-0x00007FF787296000-memory.dmp

Filesize
4.0MB

Download
memory/1068-2616-0x00007FF786EA0000-0x00007FF787296000-memory.dmp

Filesize
4.0MB

Download
memory/1308-2603-0x00007FF7258D0000-0x00007FF725CC6000-memory.dmp

Filesize
4.0MB

Download
memory/1308-165-0x00007FF7258D0000-0x00007FF725CC6000-memory.dmp

Filesize
4.0MB

Download
memory/1380-2601-0x00007FF7C6150000-0x00007FF7C6546000-memory.dmp

Filesize
4.0MB

Download
memory/1380-166-0x00007FF7C6150000-0x00007FF7C6546000-memory.dmp

Filesize
4.0MB

Download
memory/1504-211-0x00007FF627390000-0x00007FF627786000-memory.dmp

Filesize
4.0MB

Download
memory/1504-2608-0x00007FF627390000-0x00007FF627786000-memory.dmp

Filesize
4.0MB

Download
memory/1612-87-0x00007FF700F80000-0x00007FF701376000-memory.dmp

Filesize
4.0MB

Download
memory/1612-2598-0x00007FF700F80000-0x00007FF701376000-memory.dmp

Filesize
4.0MB

Download
memory/1936-201-0x00007FF6A6B70000-0x00007FF6A6F66000-memory.dmp

Filesize
4.0MB

Download
memory/1936-2615-0x00007FF6A6B70000-0x00007FF6A6F66000-memory.dmp

Filesize
4.0MB

Download
memory/1968-1114-0x00007FF6D7600000-0x00007FF6D79F6000-memory.dmp

Filesize
4.0MB

Download
memory/1968-0-0x00007FF6D7600000-0x00007FF6D79F6000-memory.dmp

Filesize
4.0MB

Download
memory/1968-1-0x00000207C6A00000-0x00000207C6A10000-memory.dmp

Filesize
64KB

Download
memory/2332-2604-0x00007FF7659E0000-0x00007FF765DD6000-memory.dmp

Filesize
4.0MB

Download
memory/2332-136-0x00007FF7659E0000-0x00007FF765DD6000-memory.dmp

Filesize
4.0MB

Download
memory/2460-2606-0x00007FF6AB640000-0x00007FF6ABA36000-memory.dmp

Filesize
4.0MB

Download
memory/2460-197-0x00007FF6AB640000-0x00007FF6ABA36000-memory.dmp

Filesize
4.0MB

Download
memory/2500-2610-0x00007FF677420000-0x00007FF677816000-memory.dmp

Filesize
4.0MB

Download
memory/2500-205-0x00007FF677420000-0x00007FF677816000-memory.dmp

Filesize
4.0MB

Download
memory/2600-2605-0x00007FF72BAA0000-0x00007FF72BE96000-memory.dmp

Filesize
4.0MB

Download
memory/2600-202-0x00007FF72BAA0000-0x00007FF72BE96000-memory.dmp

Filesize
4.0MB

Download
memory/3172-2597-0x00007FF6406C0000-0x00007FF640AB6000-memory.dmp

Filesize
4.0MB

Download
memory/3172-61-0x00007FF6406C0000-0x00007FF640AB6000-memory.dmp

Filesize
4.0MB

Download
memory/3248-2612-0x00007FF6A7AF0000-0x00007FF6A7EE6000-memory.dmp

Filesize
4.0MB

Download
memory/3248-210-0x00007FF6A7AF0000-0x00007FF6A7EE6000-memory.dmp

Filesize
4.0MB

Download
memory/3340-2611-0x00007FF74F140000-0x00007FF74F536000-memory.dmp

Filesize
4.0MB

Download
memory/3340-206-0x00007FF74F140000-0x00007FF74F536000-memory.dmp

Filesize
4.0MB

Download
memory/3632-100-0x00007FF7229D0000-0x00007FF722DC6000-memory.dmp

Filesize
4.0MB

Download
memory/3632-2599-0x00007FF7229D0000-0x00007FF722DC6000-memory.dmp

Filesize
4.0MB

Download
memory/4660-2600-0x00007FF660A60000-0x00007FF660E56000-memory.dmp

Filesize
4.0MB

Download
memory/4660-112-0x00007FF660A60000-0x00007FF660E56000-memory.dmp

Filesize
4.0MB

Download
memory/4860-2607-0x00007FF797520000-0x00007FF797916000-memory.dmp

Filesize
4.0MB

Download
memory/4860-182-0x00007FF797520000-0x00007FF797916000-memory.dmp

Filesize
4.0MB

Download
memory/4968-1120-0x00007FF96DB80000-0x00007FF96E641000-memory.dmp

Filesize
10.8MB

Download
memory/4968-209-0x00007FF96DB80000-0x00007FF96E641000-memory.dmp

Filesize
10.8MB

Download
memory/4968-556-0x000001C5F5190000-0x000001C5F5936000-memory.dmp

Filesize
7.6MB

Download
memory/4968-39-0x00007FF96DB80000-0x00007FF96E641000-memory.dmp

Filesize
10.8MB

Download
memory/4968-1237-0x00007FF96DB83000-0x00007FF96DB85000-memory.dmp

Filesize
8KB

Download
memory/4968-1411-0x00007FF96DB80000-0x00007FF96E641000-memory.dmp

Filesize
10.8MB

Download
memory/4968-5-0x00007FF96DB83000-0x00007FF96DB85000-memory.dmp

Filesize
8KB

Download
memory/4968-84-0x000001C5F1A10000-0x000001C5F1A32000-memory.dmp

Filesize
136KB

Download