xmrig | 05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b

Analysis

max time kernel
63s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
Size

2.6MB
MD5

60253a26ce1bcda827664d98a5113936
SHA1

1de336f409a4d963ac8bf1150a495ae32e79fbc0
SHA256

05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b
SHA512

8d85148719fa619b4cd0c5ded5176d200201ae81827a17f359f8e6e0e8416e1b0410d3320109680acdf3fe744c5373933b0fc045c761b702d6205044cb5642c8
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMk+QqGRjj3LJR/Lq:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rp

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4376-0-0x00007FF7F9050000-0x00007FF7F9446000-memory.dmp	xmrig
behavioral2/files/0x00080000000233f9-6.dat	xmrig
behavioral2/files/0x00070000000233fb-8.dat	xmrig
behavioral2/files/0x00070000000233fe-36.dat	xmrig
behavioral2/memory/752-45-0x00007FF6D02E0000-0x00007FF6D06D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023400-60.dat	xmrig
behavioral2/files/0x0007000000023407-69.dat	xmrig
behavioral2/memory/4308-93-0x00007FF7F23D0000-0x00007FF7F27C6000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-132.dat	xmrig
behavioral2/files/0x0007000000023410-151.dat	xmrig
behavioral2/memory/4692-160-0x00007FF60AD30000-0x00007FF60B126000-memory.dmp	xmrig
behavioral2/files/0x00080000000233f7-177.dat	xmrig
behavioral2/memory/5048-182-0x00007FF758030000-0x00007FF758426000-memory.dmp	xmrig
behavioral2/memory/1644-186-0x00007FF703F70000-0x00007FF704366000-memory.dmp	xmrig
behavioral2/memory/1384-190-0x00007FF78EED0000-0x00007FF78F2C6000-memory.dmp	xmrig
behavioral2/memory/760-193-0x00007FF707CD0000-0x00007FF7080C6000-memory.dmp	xmrig
behavioral2/memory/3000-192-0x00007FF600AF0000-0x00007FF600EE6000-memory.dmp	xmrig
behavioral2/memory/2184-191-0x00007FF7E99F0000-0x00007FF7E9DE6000-memory.dmp	xmrig
behavioral2/memory/4640-189-0x00007FF7AFCA0000-0x00007FF7B0096000-memory.dmp	xmrig
behavioral2/memory/4340-188-0x00007FF6E6340000-0x00007FF6E6736000-memory.dmp	xmrig
behavioral2/memory/4364-185-0x00007FF6AE150000-0x00007FF6AE546000-memory.dmp	xmrig
behavioral2/memory/840-184-0x00007FF71D450000-0x00007FF71D846000-memory.dmp	xmrig
behavioral2/memory/3040-183-0x00007FF79C0B0000-0x00007FF79C4A6000-memory.dmp	xmrig
behavioral2/memory/5084-181-0x00007FF6965E0000-0x00007FF6969D6000-memory.dmp	xmrig
behavioral2/memory/2468-180-0x00007FF610E40000-0x00007FF611236000-memory.dmp	xmrig
behavioral2/memory/3944-179-0x00007FF689C50000-0x00007FF68A046000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-175.dat	xmrig
behavioral2/files/0x0007000000023418-173.dat	xmrig
behavioral2/files/0x0007000000023417-171.dat	xmrig
behavioral2/files/0x0007000000023416-169.dat	xmrig
behavioral2/files/0x0007000000023415-167.dat	xmrig
behavioral2/memory/848-166-0x00007FF7A4490000-0x00007FF7A4886000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-162.dat	xmrig
behavioral2/memory/2476-161-0x00007FF6BD0B0000-0x00007FF6BD4A6000-memory.dmp	xmrig
behavioral2/memory/2352-159-0x00007FF706C10000-0x00007FF707006000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-153.dat	xmrig
behavioral2/files/0x000700000002340f-148.dat	xmrig
behavioral2/memory/5080-144-0x00007FF6C77A0000-0x00007FF6C7B96000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-142.dat	xmrig
behavioral2/files/0x000700000002340b-126.dat	xmrig
behavioral2/files/0x000700000002340a-123.dat	xmrig
behavioral2/files/0x0007000000023409-120.dat	xmrig
behavioral2/files/0x0007000000023405-118.dat	xmrig
behavioral2/files/0x0007000000023406-101.dat	xmrig
behavioral2/files/0x0007000000023408-100.dat	xmrig
behavioral2/files/0x0007000000023404-88.dat	xmrig
behavioral2/memory/4400-87-0x00007FF7F56D0000-0x00007FF7F5AC6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023402-84.dat	xmrig
behavioral2/files/0x0007000000023403-78.dat	xmrig
behavioral2/memory/4660-74-0x00007FF66FD00000-0x00007FF6700F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023401-64.dat	xmrig
behavioral2/memory/4932-59-0x00007FF69D2B0000-0x00007FF69D6A6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023413-198.dat	xmrig
behavioral2/files/0x00070000000233ff-53.dat	xmrig
behavioral2/files/0x00070000000233fc-47.dat	xmrig
behavioral2/files/0x00070000000233fd-42.dat	xmrig
behavioral2/files/0x00070000000233fa-23.dat	xmrig
behavioral2/memory/752-2223-0x00007FF6D02E0000-0x00007FF6D06D6000-memory.dmp	xmrig
behavioral2/memory/4932-2224-0x00007FF69D2B0000-0x00007FF69D6A6000-memory.dmp	xmrig
behavioral2/memory/4660-2225-0x00007FF66FD00000-0x00007FF6700F6000-memory.dmp	xmrig
behavioral2/memory/5080-2226-0x00007FF6C77A0000-0x00007FF6C7B96000-memory.dmp	xmrig
behavioral2/memory/4308-2229-0x00007FF7F23D0000-0x00007FF7F27C6000-memory.dmp	xmrig
behavioral2/memory/2352-2232-0x00007FF706C10000-0x00007FF707006000-memory.dmp	xmrig
behavioral2/memory/2476-2231-0x00007FF6BD0B0000-0x00007FF6BD4A6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1996	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
752	WhmAhqT.exe
4932	WTTQavZ.exe
4660	SsueJKT.exe
4400	WhaQzBZ.exe
4308	VDwGTgq.exe
5080	NLvstZr.exe
4340	qNLxThf.exe
2352	QjsUSUP.exe
4692	inqMznX.exe
4640	YejNxby.exe
2476	LZafCCb.exe
1384	dWiLsTv.exe
848	EvJMkee.exe
3944	tUpEIvU.exe
2184	lizMjsT.exe
2468	pitKwlL.exe
5084	MORhIIE.exe
5048	hYyAvRw.exe
3040	ibBAsss.exe
3000	wQWNTPC.exe
760	eOzhEMK.exe
840	RxwEWMs.exe
4364	HjYOiql.exe
1644	lljZyny.exe
1252	akczftt.exe
4592	PVHBWRP.exe
4856	apuTMDy.exe
4540	QAzxEap.exe
5116	jQBbPmc.exe
3840	zPANPoY.exe
2196	edVoOrM.exe
4776	JCohwlO.exe
2940	fSENnyB.exe
3348	YGhSHmm.exe
2684	TOkwEuu.exe
2628	WdZtMtz.exe
3092	BuNUxAd.exe
4380	eIlzEYN.exe
2796	dJbbeOu.exe
2288	SduvsqL.exe
4500	ruCNSOY.exe
1088	uzpwBTI.exe
1948	erSELeD.exe
4544	fCrJzge.exe
932	sILMczf.exe
1900	KJkyVcG.exe
3796	uceQhnG.exe
3568	iGndQLB.exe
4724	vWaRiIl.exe
5088	fdxFOLs.exe
4372	NMwKGdb.exe
4860	jwklSTm.exe
2020	rDULhrp.exe
540	UnubZbB.exe
4584	ypxlbqW.exe
4784	zRoqnWq.exe
3480	aUDGCdD.exe
3516	WmJraWa.exe
3260	XyGPZAz.exe
1484	SGSIIdZ.exe
2344	CiQKLgh.exe
4524	RYUCGHG.exe
2068	gKwsPqJ.exe
4048	jETYBIQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4376-0-0x00007FF7F9050000-0x00007FF7F9446000-memory.dmp	upx
behavioral2/files/0x00080000000233f9-6.dat	upx
behavioral2/files/0x00070000000233fb-8.dat	upx
behavioral2/files/0x00070000000233fe-36.dat	upx
behavioral2/memory/752-45-0x00007FF6D02E0000-0x00007FF6D06D6000-memory.dmp	upx
behavioral2/files/0x0007000000023400-60.dat	upx
behavioral2/files/0x0007000000023407-69.dat	upx
behavioral2/memory/4308-93-0x00007FF7F23D0000-0x00007FF7F27C6000-memory.dmp	upx
behavioral2/files/0x000700000002340e-132.dat	upx
behavioral2/files/0x0007000000023410-151.dat	upx
behavioral2/memory/4692-160-0x00007FF60AD30000-0x00007FF60B126000-memory.dmp	upx
behavioral2/files/0x00080000000233f7-177.dat	upx
behavioral2/memory/5048-182-0x00007FF758030000-0x00007FF758426000-memory.dmp	upx
behavioral2/memory/1644-186-0x00007FF703F70000-0x00007FF704366000-memory.dmp	upx
behavioral2/memory/1384-190-0x00007FF78EED0000-0x00007FF78F2C6000-memory.dmp	upx
behavioral2/memory/760-193-0x00007FF707CD0000-0x00007FF7080C6000-memory.dmp	upx
behavioral2/memory/3000-192-0x00007FF600AF0000-0x00007FF600EE6000-memory.dmp	upx
behavioral2/memory/2184-191-0x00007FF7E99F0000-0x00007FF7E9DE6000-memory.dmp	upx
behavioral2/memory/4640-189-0x00007FF7AFCA0000-0x00007FF7B0096000-memory.dmp	upx
behavioral2/memory/4340-188-0x00007FF6E6340000-0x00007FF6E6736000-memory.dmp	upx
behavioral2/memory/4364-185-0x00007FF6AE150000-0x00007FF6AE546000-memory.dmp	upx
behavioral2/memory/840-184-0x00007FF71D450000-0x00007FF71D846000-memory.dmp	upx
behavioral2/memory/3040-183-0x00007FF79C0B0000-0x00007FF79C4A6000-memory.dmp	upx
behavioral2/memory/5084-181-0x00007FF6965E0000-0x00007FF6969D6000-memory.dmp	upx
behavioral2/memory/2468-180-0x00007FF610E40000-0x00007FF611236000-memory.dmp	upx
behavioral2/memory/3944-179-0x00007FF689C50000-0x00007FF68A046000-memory.dmp	upx
behavioral2/files/0x0007000000023414-175.dat	upx
behavioral2/files/0x0007000000023418-173.dat	upx
behavioral2/files/0x0007000000023417-171.dat	upx
behavioral2/files/0x0007000000023416-169.dat	upx
behavioral2/files/0x0007000000023415-167.dat	upx
behavioral2/memory/848-166-0x00007FF7A4490000-0x00007FF7A4886000-memory.dmp	upx
behavioral2/files/0x000700000002340d-162.dat	upx
behavioral2/memory/2476-161-0x00007FF6BD0B0000-0x00007FF6BD4A6000-memory.dmp	upx
behavioral2/memory/2352-159-0x00007FF706C10000-0x00007FF707006000-memory.dmp	upx
behavioral2/files/0x0007000000023411-153.dat	upx
behavioral2/files/0x000700000002340f-148.dat	upx
behavioral2/memory/5080-144-0x00007FF6C77A0000-0x00007FF6C7B96000-memory.dmp	upx
behavioral2/files/0x000700000002340c-142.dat	upx
behavioral2/files/0x000700000002340b-126.dat	upx
behavioral2/files/0x000700000002340a-123.dat	upx
behavioral2/files/0x0007000000023409-120.dat	upx
behavioral2/files/0x0007000000023405-118.dat	upx
behavioral2/files/0x0007000000023406-101.dat	upx
behavioral2/files/0x0007000000023408-100.dat	upx
behavioral2/files/0x0007000000023404-88.dat	upx
behavioral2/memory/4400-87-0x00007FF7F56D0000-0x00007FF7F5AC6000-memory.dmp	upx
behavioral2/files/0x0007000000023402-84.dat	upx
behavioral2/files/0x0007000000023403-78.dat	upx
behavioral2/memory/4660-74-0x00007FF66FD00000-0x00007FF6700F6000-memory.dmp	upx
behavioral2/files/0x0007000000023401-64.dat	upx
behavioral2/memory/4932-59-0x00007FF69D2B0000-0x00007FF69D6A6000-memory.dmp	upx
behavioral2/files/0x0008000000023413-198.dat	upx
behavioral2/files/0x00070000000233ff-53.dat	upx
behavioral2/files/0x00070000000233fc-47.dat	upx
behavioral2/files/0x00070000000233fd-42.dat	upx
behavioral2/files/0x00070000000233fa-23.dat	upx
behavioral2/memory/752-2223-0x00007FF6D02E0000-0x00007FF6D06D6000-memory.dmp	upx
behavioral2/memory/4932-2224-0x00007FF69D2B0000-0x00007FF69D6A6000-memory.dmp	upx
behavioral2/memory/4660-2225-0x00007FF66FD00000-0x00007FF6700F6000-memory.dmp	upx
behavioral2/memory/5080-2226-0x00007FF6C77A0000-0x00007FF6C7B96000-memory.dmp	upx
behavioral2/memory/4308-2229-0x00007FF7F23D0000-0x00007FF7F27C6000-memory.dmp	upx
behavioral2/memory/2352-2232-0x00007FF706C10000-0x00007FF707006000-memory.dmp	upx
behavioral2/memory/2476-2231-0x00007FF6BD0B0000-0x00007FF6BD4A6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wkUrspB.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\eUeINPx.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\wwYiwkK.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\mSqeCsj.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\qjEFvGa.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\JNmfhtZ.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\QIFBudJ.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\gJnNmZW.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\WsTNdzI.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\ruIyKyV.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\VugwGdw.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\UpCeFKq.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\gnzfgyl.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\EFrFEqw.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\tpYmwIp.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\MqAyeTy.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\BgFydSW.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\yiXHqCR.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\UAjDAfo.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\HDifOBZ.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\ouxlgNX.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\XuzlvkN.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\eeDyBvh.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\RuTghoX.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\fCILZVN.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\MtlWSoN.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\LbqQqgo.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\OYVDgzv.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\HKUhswl.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\ZfJavNh.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\RKDhDNx.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\Luxebvf.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\eLkLpUp.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\uiAoxoN.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\LUKlovD.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\FUZjwdt.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\pKnSTGQ.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\bTvJqbW.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\fMtSiLW.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\LvlZkSA.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\KVCZRrm.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\yEUJmAK.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\gfFCxGs.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\bhwBftA.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\WWmWOtH.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\LNmwxaj.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\eZpBHBh.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\gxrelXc.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\cbBxRmt.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\AvCterb.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\UiqulPt.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\gmfhaDS.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\jFRbftx.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\DeWGjoT.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\tbnXjeG.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\HSHohqd.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\ooVDehH.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\oMiqVpw.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\HVbwKji.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\ynfuqsm.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\CIzlyTm.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\oamQzUZ.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\yvucUYx.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
File created	C:\Windows\System\mYSyFRy.exe	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1996	powershell.exe
1996	powershell.exe
1996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
Token: SeLockMemoryPrivilege	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
Token: SeDebugPrivilege	1996	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1996	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	83
PID 4376 wrote to memory of 1996	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	83
PID 4376 wrote to memory of 752	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	84
PID 4376 wrote to memory of 752	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	84
PID 4376 wrote to memory of 4932	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	85
PID 4376 wrote to memory of 4932	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	85
PID 4376 wrote to memory of 4660	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	86
PID 4376 wrote to memory of 4660	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	86
PID 4376 wrote to memory of 4400	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	87
PID 4376 wrote to memory of 4400	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	87
PID 4376 wrote to memory of 4308	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	88
PID 4376 wrote to memory of 4308	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	88
PID 4376 wrote to memory of 5080	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	89
PID 4376 wrote to memory of 5080	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	89
PID 4376 wrote to memory of 4340	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	90
PID 4376 wrote to memory of 4340	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	90
PID 4376 wrote to memory of 2352	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	91
PID 4376 wrote to memory of 2352	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	91
PID 4376 wrote to memory of 4692	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	92
PID 4376 wrote to memory of 4692	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	92
PID 4376 wrote to memory of 4640	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	93
PID 4376 wrote to memory of 4640	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	93
PID 4376 wrote to memory of 2476	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	94
PID 4376 wrote to memory of 2476	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	94
PID 4376 wrote to memory of 1384	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	95
PID 4376 wrote to memory of 1384	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	95
PID 4376 wrote to memory of 2468	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	96
PID 4376 wrote to memory of 2468	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	96
PID 4376 wrote to memory of 848	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	97
PID 4376 wrote to memory of 848	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	97
PID 4376 wrote to memory of 3944	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	98
PID 4376 wrote to memory of 3944	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	98
PID 4376 wrote to memory of 2184	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	99
PID 4376 wrote to memory of 2184	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	99
PID 4376 wrote to memory of 5084	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	100
PID 4376 wrote to memory of 5084	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	100
PID 4376 wrote to memory of 5048	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	101
PID 4376 wrote to memory of 5048	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	101
PID 4376 wrote to memory of 3040	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	102
PID 4376 wrote to memory of 3040	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	102
PID 4376 wrote to memory of 3000	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	103
PID 4376 wrote to memory of 3000	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	103
PID 4376 wrote to memory of 760	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	104
PID 4376 wrote to memory of 760	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	104
PID 4376 wrote to memory of 840	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	105
PID 4376 wrote to memory of 840	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	105
PID 4376 wrote to memory of 4364	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	106
PID 4376 wrote to memory of 4364	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	106
PID 4376 wrote to memory of 1644	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	107
PID 4376 wrote to memory of 1644	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	107
PID 4376 wrote to memory of 1252	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	108
PID 4376 wrote to memory of 1252	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	108
PID 4376 wrote to memory of 3840	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	109
PID 4376 wrote to memory of 3840	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	109
PID 4376 wrote to memory of 4592	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	110
PID 4376 wrote to memory of 4592	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	110
PID 4376 wrote to memory of 4856	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	111
PID 4376 wrote to memory of 4856	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	111
PID 4376 wrote to memory of 4540	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	112
PID 4376 wrote to memory of 4540	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	112
PID 4376 wrote to memory of 5116	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	113
PID 4376 wrote to memory of 5116	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	113
PID 4376 wrote to memory of 2196	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	114
PID 4376 wrote to memory of 2196	4376	05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe	114

C:\Users\Admin\AppData\Local\Temp\05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe
"C:\Users\Admin\AppData\Local\Temp\05ecbb4f6bbcc48d82b3086e3f4d3e9996fcb4e64d084df21aeb5eb7d589e76b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\System\WhmAhqT.exe
  C:\Windows\System\WhmAhqT.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\WTTQavZ.exe
  C:\Windows\System\WTTQavZ.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\SsueJKT.exe
  C:\Windows\System\SsueJKT.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\WhaQzBZ.exe
  C:\Windows\System\WhaQzBZ.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\VDwGTgq.exe
  C:\Windows\System\VDwGTgq.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\NLvstZr.exe
  C:\Windows\System\NLvstZr.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\qNLxThf.exe
  C:\Windows\System\qNLxThf.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\QjsUSUP.exe
  C:\Windows\System\QjsUSUP.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\inqMznX.exe
  C:\Windows\System\inqMznX.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\YejNxby.exe
  C:\Windows\System\YejNxby.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\LZafCCb.exe
  C:\Windows\System\LZafCCb.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\dWiLsTv.exe
  C:\Windows\System\dWiLsTv.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\pitKwlL.exe
  C:\Windows\System\pitKwlL.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\EvJMkee.exe
  C:\Windows\System\EvJMkee.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\tUpEIvU.exe
  C:\Windows\System\tUpEIvU.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\lizMjsT.exe
  C:\Windows\System\lizMjsT.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\MORhIIE.exe
  C:\Windows\System\MORhIIE.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\hYyAvRw.exe
  C:\Windows\System\hYyAvRw.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\ibBAsss.exe
  C:\Windows\System\ibBAsss.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\wQWNTPC.exe
  C:\Windows\System\wQWNTPC.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\eOzhEMK.exe
  C:\Windows\System\eOzhEMK.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\RxwEWMs.exe
  C:\Windows\System\RxwEWMs.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\HjYOiql.exe
  C:\Windows\System\HjYOiql.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\lljZyny.exe
  C:\Windows\System\lljZyny.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\akczftt.exe
  C:\Windows\System\akczftt.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\zPANPoY.exe
  C:\Windows\System\zPANPoY.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\PVHBWRP.exe
  C:\Windows\System\PVHBWRP.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\apuTMDy.exe
  C:\Windows\System\apuTMDy.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\QAzxEap.exe
  C:\Windows\System\QAzxEap.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\jQBbPmc.exe
  C:\Windows\System\jQBbPmc.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\edVoOrM.exe
  C:\Windows\System\edVoOrM.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\JCohwlO.exe
  C:\Windows\System\JCohwlO.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\fSENnyB.exe
  C:\Windows\System\fSENnyB.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\YGhSHmm.exe
  C:\Windows\System\YGhSHmm.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\TOkwEuu.exe
  C:\Windows\System\TOkwEuu.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\WdZtMtz.exe
  C:\Windows\System\WdZtMtz.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\BuNUxAd.exe
  C:\Windows\System\BuNUxAd.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\eIlzEYN.exe
  C:\Windows\System\eIlzEYN.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\dJbbeOu.exe
  C:\Windows\System\dJbbeOu.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\SduvsqL.exe
  C:\Windows\System\SduvsqL.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\ruCNSOY.exe
  C:\Windows\System\ruCNSOY.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\uzpwBTI.exe
  C:\Windows\System\uzpwBTI.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\erSELeD.exe
  C:\Windows\System\erSELeD.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\fCrJzge.exe
  C:\Windows\System\fCrJzge.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\sILMczf.exe
  C:\Windows\System\sILMczf.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\KJkyVcG.exe
  C:\Windows\System\KJkyVcG.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\uceQhnG.exe
  C:\Windows\System\uceQhnG.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\iGndQLB.exe
  C:\Windows\System\iGndQLB.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\fdxFOLs.exe
  C:\Windows\System\fdxFOLs.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\vWaRiIl.exe
  C:\Windows\System\vWaRiIl.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\NMwKGdb.exe
  C:\Windows\System\NMwKGdb.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\rDULhrp.exe
  C:\Windows\System\rDULhrp.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\jwklSTm.exe
  C:\Windows\System\jwklSTm.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\UnubZbB.exe
  C:\Windows\System\UnubZbB.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\ypxlbqW.exe
  C:\Windows\System\ypxlbqW.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\zRoqnWq.exe
  C:\Windows\System\zRoqnWq.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\aUDGCdD.exe
  C:\Windows\System\aUDGCdD.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\WmJraWa.exe
  C:\Windows\System\WmJraWa.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\XyGPZAz.exe
  C:\Windows\System\XyGPZAz.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\SGSIIdZ.exe
  C:\Windows\System\SGSIIdZ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\CiQKLgh.exe
  C:\Windows\System\CiQKLgh.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\RYUCGHG.exe
  C:\Windows\System\RYUCGHG.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\gKwsPqJ.exe
  C:\Windows\System\gKwsPqJ.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\jETYBIQ.exe
  C:\Windows\System\jETYBIQ.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\mgbOnKl.exe
  C:\Windows\System\mgbOnKl.exe
  2⤵
  PID:3300
- C:\Windows\System\nzRshiT.exe
  C:\Windows\System\nzRshiT.exe
  2⤵
  PID:3004
- C:\Windows\System\lyyShkp.exe
  C:\Windows\System\lyyShkp.exe
  2⤵
  PID:220
- C:\Windows\System\cCRjaoJ.exe
  C:\Windows\System\cCRjaoJ.exe
  2⤵
  PID:5044
- C:\Windows\System\JHEMEIz.exe
  C:\Windows\System\JHEMEIz.exe
  2⤵
  PID:1424
- C:\Windows\System\UNeKgry.exe
  C:\Windows\System\UNeKgry.exe
  2⤵
  PID:4804
- C:\Windows\System\MwNRtUz.exe
  C:\Windows\System\MwNRtUz.exe
  2⤵
  PID:4480
- C:\Windows\System\nslybMJ.exe
  C:\Windows\System\nslybMJ.exe
  2⤵
  PID:3580
- C:\Windows\System\KeFbLoi.exe
  C:\Windows\System\KeFbLoi.exe
  2⤵
  PID:1040
- C:\Windows\System\ToXwZlL.exe
  C:\Windows\System\ToXwZlL.exe
  2⤵
  PID:640
- C:\Windows\System\SczakLJ.exe
  C:\Windows\System\SczakLJ.exe
  2⤵
  PID:4940
- C:\Windows\System\tbZXvXo.exe
  C:\Windows\System\tbZXvXo.exe
  2⤵
  PID:1816
- C:\Windows\System\ASjuPCf.exe
  C:\Windows\System\ASjuPCf.exe
  2⤵
  PID:1544
- C:\Windows\System\WAeRIpu.exe
  C:\Windows\System\WAeRIpu.exe
  2⤵
  PID:2220
- C:\Windows\System\xGLTaZN.exe
  C:\Windows\System\xGLTaZN.exe
  2⤵
  PID:3656
- C:\Windows\System\ZhOjoBL.exe
  C:\Windows\System\ZhOjoBL.exe
  2⤵
  PID:4088
- C:\Windows\System\iLdAQLl.exe
  C:\Windows\System\iLdAQLl.exe
  2⤵
  PID:4700
- C:\Windows\System\gQbIeif.exe
  C:\Windows\System\gQbIeif.exe
  2⤵
  PID:1012
- C:\Windows\System\jTnWBaU.exe
  C:\Windows\System\jTnWBaU.exe
  2⤵
  PID:4004
- C:\Windows\System\edOwDcl.exe
  C:\Windows\System\edOwDcl.exe
  2⤵
  PID:2496
- C:\Windows\System\UVhKctX.exe
  C:\Windows\System\UVhKctX.exe
  2⤵
  PID:2516
- C:\Windows\System\WFHAMjH.exe
  C:\Windows\System\WFHAMjH.exe
  2⤵
  PID:1612
- C:\Windows\System\wIixbtm.exe
  C:\Windows\System\wIixbtm.exe
  2⤵
  PID:1732
- C:\Windows\System\qZgbPWg.exe
  C:\Windows\System\qZgbPWg.exe
  2⤵
  PID:684
- C:\Windows\System\aqAszfm.exe
  C:\Windows\System\aqAszfm.exe
  2⤵
  PID:1796
- C:\Windows\System\maZWHBS.exe
  C:\Windows\System\maZWHBS.exe
  2⤵
  PID:4460
- C:\Windows\System\RCxlAJv.exe
  C:\Windows\System\RCxlAJv.exe
  2⤵
  PID:4416
- C:\Windows\System\NUROeYY.exe
  C:\Windows\System\NUROeYY.exe
  2⤵
  PID:60
- C:\Windows\System\lAuFGKS.exe
  C:\Windows\System\lAuFGKS.exe
  2⤵
  PID:5144
- C:\Windows\System\Qwqcvil.exe
  C:\Windows\System\Qwqcvil.exe
  2⤵
  PID:5176
- C:\Windows\System\cQCVXBx.exe
  C:\Windows\System\cQCVXBx.exe
  2⤵
  PID:5204
- C:\Windows\System\agdTTbd.exe
  C:\Windows\System\agdTTbd.exe
  2⤵
  PID:5232
- C:\Windows\System\WHRgIUA.exe
  C:\Windows\System\WHRgIUA.exe
  2⤵
  PID:5268
- C:\Windows\System\gEIFmXP.exe
  C:\Windows\System\gEIFmXP.exe
  2⤵
  PID:5296
- C:\Windows\System\muWegbX.exe
  C:\Windows\System\muWegbX.exe
  2⤵
  PID:5324
- C:\Windows\System\DzweKSi.exe
  C:\Windows\System\DzweKSi.exe
  2⤵
  PID:5348
- C:\Windows\System\mdxixob.exe
  C:\Windows\System\mdxixob.exe
  2⤵
  PID:5380
- C:\Windows\System\XPlCWVB.exe
  C:\Windows\System\XPlCWVB.exe
  2⤵
  PID:5404
- C:\Windows\System\HfwjVoC.exe
  C:\Windows\System\HfwjVoC.exe
  2⤵
  PID:5432
- C:\Windows\System\MfFbSFs.exe
  C:\Windows\System\MfFbSFs.exe
  2⤵
  PID:5460
- C:\Windows\System\YoUeXTI.exe
  C:\Windows\System\YoUeXTI.exe
  2⤵
  PID:5492
- C:\Windows\System\yBFAjCW.exe
  C:\Windows\System\yBFAjCW.exe
  2⤵
  PID:5516
- C:\Windows\System\OfKbeDO.exe
  C:\Windows\System\OfKbeDO.exe
  2⤵
  PID:5556
- C:\Windows\System\zuEkrcL.exe
  C:\Windows\System\zuEkrcL.exe
  2⤵
  PID:5596
- C:\Windows\System\CaLLLOC.exe
  C:\Windows\System\CaLLLOC.exe
  2⤵
  PID:5624
- C:\Windows\System\kVPLCfG.exe
  C:\Windows\System\kVPLCfG.exe
  2⤵
  PID:5644
- C:\Windows\System\syBQvfo.exe
  C:\Windows\System\syBQvfo.exe
  2⤵
  PID:5672
- C:\Windows\System\HpZBHBm.exe
  C:\Windows\System\HpZBHBm.exe
  2⤵
  PID:5708
- C:\Windows\System\wzaueoL.exe
  C:\Windows\System\wzaueoL.exe
  2⤵
  PID:5736
- C:\Windows\System\OMBnZMm.exe
  C:\Windows\System\OMBnZMm.exe
  2⤵
  PID:5768
- C:\Windows\System\IGofDqu.exe
  C:\Windows\System\IGofDqu.exe
  2⤵
  PID:5792
- C:\Windows\System\UlhMYmJ.exe
  C:\Windows\System\UlhMYmJ.exe
  2⤵
  PID:5828
- C:\Windows\System\uCXfAxn.exe
  C:\Windows\System\uCXfAxn.exe
  2⤵
  PID:5848
- C:\Windows\System\oIxwmTa.exe
  C:\Windows\System\oIxwmTa.exe
  2⤵
  PID:5876
- C:\Windows\System\zJKHmVD.exe
  C:\Windows\System\zJKHmVD.exe
  2⤵
  PID:5912
- C:\Windows\System\bwHXEzy.exe
  C:\Windows\System\bwHXEzy.exe
  2⤵
  PID:5928
- C:\Windows\System\iReWPvD.exe
  C:\Windows\System\iReWPvD.exe
  2⤵
  PID:5944
- C:\Windows\System\yxaAsst.exe
  C:\Windows\System\yxaAsst.exe
  2⤵
  PID:5960
- C:\Windows\System\rWvQJhH.exe
  C:\Windows\System\rWvQJhH.exe
  2⤵
  PID:5988
- C:\Windows\System\JEoCfDH.exe
  C:\Windows\System\JEoCfDH.exe
  2⤵
  PID:6036
- C:\Windows\System\vUcFJSN.exe
  C:\Windows\System\vUcFJSN.exe
  2⤵
  PID:6068
- C:\Windows\System\XvEikLn.exe
  C:\Windows\System\XvEikLn.exe
  2⤵
  PID:6084
- C:\Windows\System\seGGXuX.exe
  C:\Windows\System\seGGXuX.exe
  2⤵
  PID:6112
- C:\Windows\System\KexTnDd.exe
  C:\Windows\System\KexTnDd.exe
  2⤵
  PID:6128
- C:\Windows\System\vWOPPhV.exe
  C:\Windows\System\vWOPPhV.exe
  2⤵
  PID:5128
- C:\Windows\System\DAuQpyi.exe
  C:\Windows\System\DAuQpyi.exe
  2⤵
  PID:5200
- C:\Windows\System\EIealMY.exe
  C:\Windows\System\EIealMY.exe
  2⤵
  PID:5256
- C:\Windows\System\LJRqrbJ.exe
  C:\Windows\System\LJRqrbJ.exe
  2⤵
  PID:5332
- C:\Windows\System\kuDSftl.exe
  C:\Windows\System\kuDSftl.exe
  2⤵
  PID:5396
- C:\Windows\System\wGXAmNk.exe
  C:\Windows\System\wGXAmNk.exe
  2⤵
  PID:5484
- C:\Windows\System\jRMcKSX.exe
  C:\Windows\System\jRMcKSX.exe
  2⤵
  PID:5588
- C:\Windows\System\wYRUROg.exe
  C:\Windows\System\wYRUROg.exe
  2⤵
  PID:5704
- C:\Windows\System\jgCkyBy.exe
  C:\Windows\System\jgCkyBy.exe
  2⤵
  PID:5804
- C:\Windows\System\puCRxZZ.exe
  C:\Windows\System\puCRxZZ.exe
  2⤵
  PID:5840
- C:\Windows\System\APHCylJ.exe
  C:\Windows\System\APHCylJ.exe
  2⤵
  PID:5872
- C:\Windows\System\NWtxMDw.exe
  C:\Windows\System\NWtxMDw.exe
  2⤵
  PID:5976
- C:\Windows\System\aqePyYl.exe
  C:\Windows\System\aqePyYl.exe
  2⤵
  PID:6096
- C:\Windows\System\gcgKnMy.exe
  C:\Windows\System\gcgKnMy.exe
  2⤵
  PID:6060
- C:\Windows\System\JGvJjHR.exe
  C:\Windows\System\JGvJjHR.exe
  2⤵
  PID:5312
- C:\Windows\System\sdIHxDl.exe
  C:\Windows\System\sdIHxDl.exe
  2⤵
  PID:5360
- C:\Windows\System\dObGzGW.exe
  C:\Windows\System\dObGzGW.exe
  2⤵
  PID:5632
- C:\Windows\System\PkwgAai.exe
  C:\Windows\System\PkwgAai.exe
  2⤵
  PID:5776
- C:\Windows\System\ZTxlmGm.exe
  C:\Windows\System\ZTxlmGm.exe
  2⤵
  PID:5868
- C:\Windows\System\lvEzpVD.exe
  C:\Windows\System\lvEzpVD.exe
  2⤵
  PID:5996
- C:\Windows\System\YIYMQvp.exe
  C:\Windows\System\YIYMQvp.exe
  2⤵
  PID:6052
- C:\Windows\System\sqfHElh.exe
  C:\Windows\System\sqfHElh.exe
  2⤵
  PID:5168
- C:\Windows\System\VMVjwQr.exe
  C:\Windows\System\VMVjwQr.exe
  2⤵
  PID:5756
- C:\Windows\System\itQeUCE.exe
  C:\Windows\System\itQeUCE.exe
  2⤵
  PID:5920
- C:\Windows\System\CftcJdu.exe
  C:\Windows\System\CftcJdu.exe
  2⤵
  PID:5836
- C:\Windows\System\kdxMTcC.exe
  C:\Windows\System\kdxMTcC.exe
  2⤵
  PID:6164
- C:\Windows\System\POWzKXE.exe
  C:\Windows\System\POWzKXE.exe
  2⤵
  PID:6192
- C:\Windows\System\AiqHXOB.exe
  C:\Windows\System\AiqHXOB.exe
  2⤵
  PID:6220
- C:\Windows\System\tocCBLc.exe
  C:\Windows\System\tocCBLc.exe
  2⤵
  PID:6252
- C:\Windows\System\mScnZSy.exe
  C:\Windows\System\mScnZSy.exe
  2⤵
  PID:6276
- C:\Windows\System\qRdRyPZ.exe
  C:\Windows\System\qRdRyPZ.exe
  2⤵
  PID:6304
- C:\Windows\System\nbPKHHa.exe
  C:\Windows\System\nbPKHHa.exe
  2⤵
  PID:6332
- C:\Windows\System\JxNuYtW.exe
  C:\Windows\System\JxNuYtW.exe
  2⤵
  PID:6348
- C:\Windows\System\Xazsmbh.exe
  C:\Windows\System\Xazsmbh.exe
  2⤵
  PID:6400
- C:\Windows\System\XaAGAaV.exe
  C:\Windows\System\XaAGAaV.exe
  2⤵
  PID:6428
- C:\Windows\System\QjJOSrc.exe
  C:\Windows\System\QjJOSrc.exe
  2⤵
  PID:6444
- C:\Windows\System\rpQxqOC.exe
  C:\Windows\System\rpQxqOC.exe
  2⤵
  PID:6476
- C:\Windows\System\VNHNTde.exe
  C:\Windows\System\VNHNTde.exe
  2⤵
  PID:6512
- C:\Windows\System\uvmSfua.exe
  C:\Windows\System\uvmSfua.exe
  2⤵
  PID:6536
- C:\Windows\System\MCvogqu.exe
  C:\Windows\System\MCvogqu.exe
  2⤵
  PID:6568
- C:\Windows\System\JBczLAP.exe
  C:\Windows\System\JBczLAP.exe
  2⤵
  PID:6588
- C:\Windows\System\yvslBGl.exe
  C:\Windows\System\yvslBGl.exe
  2⤵
  PID:6624
- C:\Windows\System\hayUTjW.exe
  C:\Windows\System\hayUTjW.exe
  2⤵
  PID:6652
- C:\Windows\System\HMvfBlr.exe
  C:\Windows\System\HMvfBlr.exe
  2⤵
  PID:6668
- C:\Windows\System\vcIeLoP.exe
  C:\Windows\System\vcIeLoP.exe
  2⤵
  PID:6688
- C:\Windows\System\fMonGKS.exe
  C:\Windows\System\fMonGKS.exe
  2⤵
  PID:6724
- C:\Windows\System\SHVsfvn.exe
  C:\Windows\System\SHVsfvn.exe
  2⤵
  PID:6752
- C:\Windows\System\HVwxXJg.exe
  C:\Windows\System\HVwxXJg.exe
  2⤵
  PID:6768
- C:\Windows\System\ePdKQZh.exe
  C:\Windows\System\ePdKQZh.exe
  2⤵
  PID:6784
- C:\Windows\System\MWIHAzM.exe
  C:\Windows\System\MWIHAzM.exe
  2⤵
  PID:6812
- C:\Windows\System\ipYIVmD.exe
  C:\Windows\System\ipYIVmD.exe
  2⤵
  PID:6848
- C:\Windows\System\NELctxZ.exe
  C:\Windows\System\NELctxZ.exe
  2⤵
  PID:6892
- C:\Windows\System\gpBxbVC.exe
  C:\Windows\System\gpBxbVC.exe
  2⤵
  PID:6932
- C:\Windows\System\QrOJekS.exe
  C:\Windows\System\QrOJekS.exe
  2⤵
  PID:6948
- C:\Windows\System\JMkpcUz.exe
  C:\Windows\System\JMkpcUz.exe
  2⤵
  PID:6976
- C:\Windows\System\iqFYJzR.exe
  C:\Windows\System\iqFYJzR.exe
  2⤵
  PID:7004
- C:\Windows\System\ycmOrJb.exe
  C:\Windows\System\ycmOrJb.exe
  2⤵
  PID:7040
- C:\Windows\System\JMiCbMl.exe
  C:\Windows\System\JMiCbMl.exe
  2⤵
  PID:7060
- C:\Windows\System\RXkGyYZ.exe
  C:\Windows\System\RXkGyYZ.exe
  2⤵
  PID:7100
- C:\Windows\System\JlHLFsQ.exe
  C:\Windows\System\JlHLFsQ.exe
  2⤵
  PID:7116
- C:\Windows\System\TuFFALO.exe
  C:\Windows\System\TuFFALO.exe
  2⤵
  PID:7140
- C:\Windows\System\RpCRnzE.exe
  C:\Windows\System\RpCRnzE.exe
  2⤵
  PID:7160
- C:\Windows\System\FdiESqJ.exe
  C:\Windows\System\FdiESqJ.exe
  2⤵
  PID:6204
- C:\Windows\System\YNirpAr.exe
  C:\Windows\System\YNirpAr.exe
  2⤵
  PID:6248
- C:\Windows\System\hFKiqYm.exe
  C:\Windows\System\hFKiqYm.exe
  2⤵
  PID:6344
- C:\Windows\System\iAuONtH.exe
  C:\Windows\System\iAuONtH.exe
  2⤵
  PID:6396
- C:\Windows\System\YvZMClN.exe
  C:\Windows\System\YvZMClN.exe
  2⤵
  PID:6468
- C:\Windows\System\quvobuV.exe
  C:\Windows\System\quvobuV.exe
  2⤵
  PID:6552
- C:\Windows\System\iOqWawV.exe
  C:\Windows\System\iOqWawV.exe
  2⤵
  PID:6620
- C:\Windows\System\IgFoiYa.exe
  C:\Windows\System\IgFoiYa.exe
  2⤵
  PID:6664
- C:\Windows\System\uAVrVEq.exe
  C:\Windows\System\uAVrVEq.exe
  2⤵
  PID:6712
- C:\Windows\System\cclEraJ.exe
  C:\Windows\System\cclEraJ.exe
  2⤵
  PID:6736
- C:\Windows\System\JoJMjyR.exe
  C:\Windows\System\JoJMjyR.exe
  2⤵
  PID:6800
- C:\Windows\System\dMiahzF.exe
  C:\Windows\System\dMiahzF.exe
  2⤵
  PID:6912
- C:\Windows\System\QzXcpxy.exe
  C:\Windows\System\QzXcpxy.exe
  2⤵
  PID:6988
- C:\Windows\System\ifHzEcg.exe
  C:\Windows\System\ifHzEcg.exe
  2⤵
  PID:7052
- C:\Windows\System\aOYNqhZ.exe
  C:\Windows\System\aOYNqhZ.exe
  2⤵
  PID:7076
- C:\Windows\System\YGcqkDS.exe
  C:\Windows\System\YGcqkDS.exe
  2⤵
  PID:6184
- C:\Windows\System\SDoCrhV.exe
  C:\Windows\System\SDoCrhV.exe
  2⤵
  PID:6324
- C:\Windows\System\htHkcoE.exe
  C:\Windows\System\htHkcoE.exe
  2⤵
  PID:6392
- C:\Windows\System\prTwdea.exe
  C:\Windows\System\prTwdea.exe
  2⤵
  PID:6584
- C:\Windows\System\ARxGIvE.exe
  C:\Windows\System\ARxGIvE.exe
  2⤵
  PID:6660
- C:\Windows\System\DPnpYRh.exe
  C:\Windows\System\DPnpYRh.exe
  2⤵
  PID:6876
- C:\Windows\System\kIbEKik.exe
  C:\Windows\System\kIbEKik.exe
  2⤵
  PID:7032
- C:\Windows\System\jjVndAM.exe
  C:\Windows\System\jjVndAM.exe
  2⤵
  PID:7156
- C:\Windows\System\zWlxfwn.exe
  C:\Windows\System\zWlxfwn.exe
  2⤵
  PID:5308
- C:\Windows\System\vSDkvsn.exe
  C:\Windows\System\vSDkvsn.exe
  2⤵
  PID:6836
- C:\Windows\System\wKcSVBl.exe
  C:\Windows\System\wKcSVBl.exe
  2⤵
  PID:6236
- C:\Windows\System\LRwDZfS.exe
  C:\Windows\System\LRwDZfS.exe
  2⤵
  PID:6744
- C:\Windows\System\oopLclz.exe
  C:\Windows\System\oopLclz.exe
  2⤵
  PID:6636
- C:\Windows\System\bvHVdfT.exe
  C:\Windows\System\bvHVdfT.exe
  2⤵
  PID:7188
- C:\Windows\System\cSEoCrS.exe
  C:\Windows\System\cSEoCrS.exe
  2⤵
  PID:7220
- C:\Windows\System\kAuVsaw.exe
  C:\Windows\System\kAuVsaw.exe
  2⤵
  PID:7244
- C:\Windows\System\wbICieD.exe
  C:\Windows\System\wbICieD.exe
  2⤵
  PID:7280
- C:\Windows\System\dpiXoVh.exe
  C:\Windows\System\dpiXoVh.exe
  2⤵
  PID:7308
- C:\Windows\System\CGgyUyh.exe
  C:\Windows\System\CGgyUyh.exe
  2⤵
  PID:7336
- C:\Windows\System\BNevOuQ.exe
  C:\Windows\System\BNevOuQ.exe
  2⤵
  PID:7364
- C:\Windows\System\ZFlEOld.exe
  C:\Windows\System\ZFlEOld.exe
  2⤵
  PID:7380
- C:\Windows\System\biZOanB.exe
  C:\Windows\System\biZOanB.exe
  2⤵
  PID:7408
- C:\Windows\System\CeQiqUt.exe
  C:\Windows\System\CeQiqUt.exe
  2⤵
  PID:7436
- C:\Windows\System\KVLiDbH.exe
  C:\Windows\System\KVLiDbH.exe
  2⤵
  PID:7472
- C:\Windows\System\QMqvLWh.exe
  C:\Windows\System\QMqvLWh.exe
  2⤵
  PID:7504
- C:\Windows\System\KVtvUdt.exe
  C:\Windows\System\KVtvUdt.exe
  2⤵
  PID:7532
- C:\Windows\System\rshuzdy.exe
  C:\Windows\System\rshuzdy.exe
  2⤵
  PID:7560
- C:\Windows\System\fIyDNRu.exe
  C:\Windows\System\fIyDNRu.exe
  2⤵
  PID:7584
- C:\Windows\System\jxvUwtS.exe
  C:\Windows\System\jxvUwtS.exe
  2⤵
  PID:7604
- C:\Windows\System\jypiMAh.exe
  C:\Windows\System\jypiMAh.exe
  2⤵
  PID:7632
- C:\Windows\System\UBMcypj.exe
  C:\Windows\System\UBMcypj.exe
  2⤵
  PID:7660
- C:\Windows\System\GjvnvQq.exe
  C:\Windows\System\GjvnvQq.exe
  2⤵
  PID:7700
- C:\Windows\System\GVLvNlW.exe
  C:\Windows\System\GVLvNlW.exe
  2⤵
  PID:7732
- C:\Windows\System\teXySMQ.exe
  C:\Windows\System\teXySMQ.exe
  2⤵
  PID:7756
- C:\Windows\System\JZNDQWF.exe
  C:\Windows\System\JZNDQWF.exe
  2⤵
  PID:7788
- C:\Windows\System\ANptxjv.exe
  C:\Windows\System\ANptxjv.exe
  2⤵
  PID:7824
- C:\Windows\System\MEGnIHt.exe
  C:\Windows\System\MEGnIHt.exe
  2⤵
  PID:7852
- C:\Windows\System\nvvfYvh.exe
  C:\Windows\System\nvvfYvh.exe
  2⤵
  PID:7868
- C:\Windows\System\TSLvJQp.exe
  C:\Windows\System\TSLvJQp.exe
  2⤵
  PID:7896
- C:\Windows\System\NoiFrvn.exe
  C:\Windows\System\NoiFrvn.exe
  2⤵
  PID:7924
- C:\Windows\System\pYYgUQZ.exe
  C:\Windows\System\pYYgUQZ.exe
  2⤵
  PID:7964
- C:\Windows\System\YRgmMIv.exe
  C:\Windows\System\YRgmMIv.exe
  2⤵
  PID:7992
- C:\Windows\System\sZWPLBR.exe
  C:\Windows\System\sZWPLBR.exe
  2⤵
  PID:8012
- C:\Windows\System\vqoRFfP.exe
  C:\Windows\System\vqoRFfP.exe
  2⤵
  PID:8048
- C:\Windows\System\XneSWDA.exe
  C:\Windows\System\XneSWDA.exe
  2⤵
  PID:8076
- C:\Windows\System\bndRnIl.exe
  C:\Windows\System\bndRnIl.exe
  2⤵
  PID:8100
- C:\Windows\System\hMsvmec.exe
  C:\Windows\System\hMsvmec.exe
  2⤵
  PID:8136
- C:\Windows\System\pcAKXBZ.exe
  C:\Windows\System\pcAKXBZ.exe
  2⤵
  PID:8164
- C:\Windows\System\fwBvKfg.exe
  C:\Windows\System\fwBvKfg.exe
  2⤵
  PID:7176
- C:\Windows\System\mhQsMHr.exe
  C:\Windows\System\mhQsMHr.exe
  2⤵
  PID:7196
- C:\Windows\System\AsrInMi.exe
  C:\Windows\System\AsrInMi.exe
  2⤵
  PID:7272
- C:\Windows\System\vaoRkgm.exe
  C:\Windows\System\vaoRkgm.exe
  2⤵
  PID:7356
- C:\Windows\System\jwXFqOq.exe
  C:\Windows\System\jwXFqOq.exe
  2⤵
  PID:7396
- C:\Windows\System\ApETzxo.exe
  C:\Windows\System\ApETzxo.exe
  2⤵
  PID:7448
- C:\Windows\System\SaTtmxs.exe
  C:\Windows\System\SaTtmxs.exe
  2⤵
  PID:7552
- C:\Windows\System\GKtfpCL.exe
  C:\Windows\System\GKtfpCL.exe
  2⤵
  PID:7580
- C:\Windows\System\tlhLRqI.exe
  C:\Windows\System\tlhLRqI.exe
  2⤵
  PID:7652
- C:\Windows\System\dCDAXDp.exe
  C:\Windows\System\dCDAXDp.exe
  2⤵
  PID:7716
- C:\Windows\System\OpJxuIE.exe
  C:\Windows\System\OpJxuIE.exe
  2⤵
  PID:7796
- C:\Windows\System\LeBgHPA.exe
  C:\Windows\System\LeBgHPA.exe
  2⤵
  PID:7864
- C:\Windows\System\cChNSaT.exe
  C:\Windows\System\cChNSaT.exe
  2⤵
  PID:7932
- C:\Windows\System\fzOiEQF.exe
  C:\Windows\System\fzOiEQF.exe
  2⤵
  PID:7980
- C:\Windows\System\fmjUqhE.exe
  C:\Windows\System\fmjUqhE.exe
  2⤵
  PID:8036
- C:\Windows\System\AaOAmoe.exe
  C:\Windows\System\AaOAmoe.exe
  2⤵
  PID:8128
- C:\Windows\System\zGWFJbm.exe
  C:\Windows\System\zGWFJbm.exe
  2⤵
  PID:7200
- C:\Windows\System\ILHeJvh.exe
  C:\Windows\System\ILHeJvh.exe
  2⤵
  PID:7300
- C:\Windows\System\xJYiDLl.exe
  C:\Windows\System\xJYiDLl.exe
  2⤵
  PID:7516
- C:\Windows\System\OuoBtRS.exe
  C:\Windows\System\OuoBtRS.exe
  2⤵
  PID:7544
- C:\Windows\System\IBFmEGz.exe
  C:\Windows\System\IBFmEGz.exe
  2⤵
  PID:7840
- C:\Windows\System\XEMOrdG.exe
  C:\Windows\System\XEMOrdG.exe
  2⤵
  PID:7836
- C:\Windows\System\hzEhFna.exe
  C:\Windows\System\hzEhFna.exe
  2⤵
  PID:8088
- C:\Windows\System\lqrTXXl.exe
  C:\Windows\System\lqrTXXl.exe
  2⤵
  PID:7328
- C:\Windows\System\yQgTRSF.exe
  C:\Windows\System\yQgTRSF.exe
  2⤵
  PID:7772
- C:\Windows\System\iqVNArP.exe
  C:\Windows\System\iqVNArP.exe
  2⤵
  PID:7952
- C:\Windows\System\JvLfnuw.exe
  C:\Windows\System\JvLfnuw.exe
  2⤵
  PID:7488
- C:\Windows\System\UOtWFiy.exe
  C:\Windows\System\UOtWFiy.exe
  2⤵
  PID:8108
- C:\Windows\System\afZPJhm.exe
  C:\Windows\System\afZPJhm.exe
  2⤵
  PID:8212
- C:\Windows\System\lAjBMFP.exe
  C:\Windows\System\lAjBMFP.exe
  2⤵
  PID:8228
- C:\Windows\System\sLoMYZy.exe
  C:\Windows\System\sLoMYZy.exe
  2⤵
  PID:8244
- C:\Windows\System\RFgMfAu.exe
  C:\Windows\System\RFgMfAu.exe
  2⤵
  PID:8284
- C:\Windows\System\XtycquP.exe
  C:\Windows\System\XtycquP.exe
  2⤵
  PID:8300
- C:\Windows\System\VCkZlzY.exe
  C:\Windows\System\VCkZlzY.exe
  2⤵
  PID:8340
- C:\Windows\System\DxMoZKG.exe
  C:\Windows\System\DxMoZKG.exe
  2⤵
  PID:8356
- C:\Windows\System\GIYMDQC.exe
  C:\Windows\System\GIYMDQC.exe
  2⤵
  PID:8404
- C:\Windows\System\yHfpApq.exe
  C:\Windows\System\yHfpApq.exe
  2⤵
  PID:8424
- C:\Windows\System\ybWkjiy.exe
  C:\Windows\System\ybWkjiy.exe
  2⤵
  PID:8440
- C:\Windows\System\MyQUwme.exe
  C:\Windows\System\MyQUwme.exe
  2⤵
  PID:8468
- C:\Windows\System\DNVLJSG.exe
  C:\Windows\System\DNVLJSG.exe
  2⤵
  PID:8508
- C:\Windows\System\HSHohqd.exe
  C:\Windows\System\HSHohqd.exe
  2⤵
  PID:8552
- C:\Windows\System\CyGlfLE.exe
  C:\Windows\System\CyGlfLE.exe
  2⤵
  PID:8576
- C:\Windows\System\AvCterb.exe
  C:\Windows\System\AvCterb.exe
  2⤵
  PID:8604
- C:\Windows\System\BthzaWd.exe
  C:\Windows\System\BthzaWd.exe
  2⤵
  PID:8640
- C:\Windows\System\sbmfoqc.exe
  C:\Windows\System\sbmfoqc.exe
  2⤵
  PID:8664
- C:\Windows\System\rqZtRkU.exe
  C:\Windows\System\rqZtRkU.exe
  2⤵
  PID:8688
- C:\Windows\System\SLCpaOa.exe
  C:\Windows\System\SLCpaOa.exe
  2⤵
  PID:8704
- C:\Windows\System\ghnRweK.exe
  C:\Windows\System\ghnRweK.exe
  2⤵
  PID:8736
- C:\Windows\System\HcjmPlF.exe
  C:\Windows\System\HcjmPlF.exe
  2⤵
  PID:8764
- C:\Windows\System\RvbMjEi.exe
  C:\Windows\System\RvbMjEi.exe
  2⤵
  PID:8800
- C:\Windows\System\LVLqJua.exe
  C:\Windows\System\LVLqJua.exe
  2⤵
  PID:8828
- C:\Windows\System\zVvXdUR.exe
  C:\Windows\System\zVvXdUR.exe
  2⤵
  PID:8864
- C:\Windows\System\XXwhAdz.exe
  C:\Windows\System\XXwhAdz.exe
  2⤵
  PID:8884
- C:\Windows\System\WqSPqPd.exe
  C:\Windows\System\WqSPqPd.exe
  2⤵
  PID:8912
- C:\Windows\System\VeNqkAs.exe
  C:\Windows\System\VeNqkAs.exe
  2⤵
  PID:8940
- C:\Windows\System\ADvyjDx.exe
  C:\Windows\System\ADvyjDx.exe
  2⤵
  PID:8968
- C:\Windows\System\uPZXJVJ.exe
  C:\Windows\System\uPZXJVJ.exe
  2⤵
  PID:8992
- C:\Windows\System\bEypDXb.exe
  C:\Windows\System\bEypDXb.exe
  2⤵
  PID:9028
- C:\Windows\System\EEkSyVf.exe
  C:\Windows\System\EEkSyVf.exe
  2⤵
  PID:9044
- C:\Windows\System\FpXfeSn.exe
  C:\Windows\System\FpXfeSn.exe
  2⤵
  PID:9092
- C:\Windows\System\bWGSdvb.exe
  C:\Windows\System\bWGSdvb.exe
  2⤵
  PID:9112
- C:\Windows\System\uoxhRYG.exe
  C:\Windows\System\uoxhRYG.exe
  2⤵
  PID:9132
- C:\Windows\System\SBzeBMp.exe
  C:\Windows\System\SBzeBMp.exe
  2⤵
  PID:9168
- C:\Windows\System\OmQIbiZ.exe
  C:\Windows\System\OmQIbiZ.exe
  2⤵
  PID:9200
- C:\Windows\System\HmZJvgw.exe
  C:\Windows\System\HmZJvgw.exe
  2⤵
  PID:8092
- C:\Windows\System\wMTnkDh.exe
  C:\Windows\System\wMTnkDh.exe
  2⤵
  PID:8268
- C:\Windows\System\LbcWHxb.exe
  C:\Windows\System\LbcWHxb.exe
  2⤵
  PID:8376
- C:\Windows\System\KWbvEDF.exe
  C:\Windows\System\KWbvEDF.exe
  2⤵
  PID:8420
- C:\Windows\System\eZKNXNG.exe
  C:\Windows\System\eZKNXNG.exe
  2⤵
  PID:8452
- C:\Windows\System\mUjjCfU.exe
  C:\Windows\System\mUjjCfU.exe
  2⤵
  PID:8532
- C:\Windows\System\rTclTtD.exe
  C:\Windows\System\rTclTtD.exe
  2⤵
  PID:8592
- C:\Windows\System\defhuKf.exe
  C:\Windows\System\defhuKf.exe
  2⤵
  PID:8620
- C:\Windows\System\DzbKPZp.exe
  C:\Windows\System\DzbKPZp.exe
  2⤵
  PID:8728
- C:\Windows\System\KBHlElE.exe
  C:\Windows\System\KBHlElE.exe
  2⤵
  PID:8748
- C:\Windows\System\nKwLSpQ.exe
  C:\Windows\System\nKwLSpQ.exe
  2⤵
  PID:8780
- C:\Windows\System\aSLzVRe.exe
  C:\Windows\System\aSLzVRe.exe
  2⤵
  PID:8856
- C:\Windows\System\ycjFUBG.exe
  C:\Windows\System\ycjFUBG.exe
  2⤵
  PID:8932
- C:\Windows\System\kXxiYoe.exe
  C:\Windows\System\kXxiYoe.exe
  2⤵
  PID:9040
- C:\Windows\System\FIcFvZX.exe
  C:\Windows\System\FIcFvZX.exe
  2⤵
  PID:9056
- C:\Windows\System\mfLVLKt.exe
  C:\Windows\System\mfLVLKt.exe
  2⤵
  PID:9148
- C:\Windows\System\sYZkTqZ.exe
  C:\Windows\System\sYZkTqZ.exe
  2⤵
  PID:8328
- C:\Windows\System\CJXNtiY.exe
  C:\Windows\System\CJXNtiY.exe
  2⤵
  PID:8388
- C:\Windows\System\TpWyuAQ.exe
  C:\Windows\System\TpWyuAQ.exe
  2⤵
  PID:8528
- C:\Windows\System\vTzRoNJ.exe
  C:\Windows\System\vTzRoNJ.exe
  2⤵
  PID:8648
- C:\Windows\System\imAuEsQ.exe
  C:\Windows\System\imAuEsQ.exe
  2⤵
  PID:8812
- C:\Windows\System\dodBywx.exe
  C:\Windows\System\dodBywx.exe
  2⤵
  PID:9004
- C:\Windows\System\ZADRnJz.exe
  C:\Windows\System\ZADRnJz.exe
  2⤵
  PID:9120
- C:\Windows\System\KFwpulI.exe
  C:\Windows\System\KFwpulI.exe
  2⤵
  PID:9208
- C:\Windows\System\CEdPJRu.exe
  C:\Windows\System\CEdPJRu.exe
  2⤵
  PID:8716
- C:\Windows\System\ykyYlPK.exe
  C:\Windows\System\ykyYlPK.exe
  2⤵
  PID:8840
- C:\Windows\System\sHDRaBt.exe
  C:\Windows\System\sHDRaBt.exe
  2⤵
  PID:9212
- C:\Windows\System\edbPnMh.exe
  C:\Windows\System\edbPnMh.exe
  2⤵
  PID:8436
- C:\Windows\System\cHNYren.exe
  C:\Windows\System\cHNYren.exe
  2⤵
  PID:9244
- C:\Windows\System\WxnahBN.exe
  C:\Windows\System\WxnahBN.exe
  2⤵
  PID:9260
- C:\Windows\System\hfWPNXT.exe
  C:\Windows\System\hfWPNXT.exe
  2⤵
  PID:9288
- C:\Windows\System\JdllYQV.exe
  C:\Windows\System\JdllYQV.exe
  2⤵
  PID:9308
- C:\Windows\System\HOetMbP.exe
  C:\Windows\System\HOetMbP.exe
  2⤵
  PID:9336
- C:\Windows\System\JKMyceY.exe
  C:\Windows\System\JKMyceY.exe
  2⤵
  PID:9372
- C:\Windows\System\XMByaNM.exe
  C:\Windows\System\XMByaNM.exe
  2⤵
  PID:9412
- C:\Windows\System\DFJcTWU.exe
  C:\Windows\System\DFJcTWU.exe
  2⤵
  PID:9436
- C:\Windows\System\EGNMtHm.exe
  C:\Windows\System\EGNMtHm.exe
  2⤵
  PID:9476
- C:\Windows\System\nTDuavZ.exe
  C:\Windows\System\nTDuavZ.exe
  2⤵
  PID:9496
- C:\Windows\System\DQeecXr.exe
  C:\Windows\System\DQeecXr.exe
  2⤵
  PID:9516
- C:\Windows\System\PtbCHeO.exe
  C:\Windows\System\PtbCHeO.exe
  2⤵
  PID:9560
- C:\Windows\System\fVxNizg.exe
  C:\Windows\System\fVxNizg.exe
  2⤵
  PID:9580
- C:\Windows\System\SgxBlme.exe
  C:\Windows\System\SgxBlme.exe
  2⤵
  PID:9608
- C:\Windows\System\ZmDqSmi.exe
  C:\Windows\System\ZmDqSmi.exe
  2⤵
  PID:9636
- C:\Windows\System\kVpJaIv.exe
  C:\Windows\System\kVpJaIv.exe
  2⤵
  PID:9664
- C:\Windows\System\rKAnwxQ.exe
  C:\Windows\System\rKAnwxQ.exe
  2⤵
  PID:9692
- C:\Windows\System\qCrZwpa.exe
  C:\Windows\System\qCrZwpa.exe
  2⤵
  PID:9720
- C:\Windows\System\MoCkwTB.exe
  C:\Windows\System\MoCkwTB.exe
  2⤵
  PID:9748
- C:\Windows\System\tTCUdfb.exe
  C:\Windows\System\tTCUdfb.exe
  2⤵
  PID:9776
- C:\Windows\System\TJFAaYk.exe
  C:\Windows\System\TJFAaYk.exe
  2⤵
  PID:9804
- C:\Windows\System\meAZDwD.exe
  C:\Windows\System\meAZDwD.exe
  2⤵
  PID:9840
- C:\Windows\System\KVMmnAC.exe
  C:\Windows\System\KVMmnAC.exe
  2⤵
  PID:9860
- C:\Windows\System\mEjpTqn.exe
  C:\Windows\System\mEjpTqn.exe
  2⤵
  PID:9900
- C:\Windows\System\tKaktyC.exe
  C:\Windows\System\tKaktyC.exe
  2⤵
  PID:9920
- C:\Windows\System\cocsaEH.exe
  C:\Windows\System\cocsaEH.exe
  2⤵
  PID:9944
- C:\Windows\System\VEAjRTi.exe
  C:\Windows\System\VEAjRTi.exe
  2⤵
  PID:9972
- C:\Windows\System\SOEswJk.exe
  C:\Windows\System\SOEswJk.exe
  2⤵
  PID:10000
- C:\Windows\System\Eomptms.exe
  C:\Windows\System\Eomptms.exe
  2⤵
  PID:10028
- C:\Windows\System\HhtslfS.exe
  C:\Windows\System\HhtslfS.exe
  2⤵
  PID:10048
- C:\Windows\System\XmEfRfa.exe
  C:\Windows\System\XmEfRfa.exe
  2⤵
  PID:10068
- C:\Windows\System\nHooJga.exe
  C:\Windows\System\nHooJga.exe
  2⤵
  PID:10112
- C:\Windows\System\iRtEeKN.exe
  C:\Windows\System\iRtEeKN.exe
  2⤵
  PID:10128
- C:\Windows\System\BBZPPhN.exe
  C:\Windows\System\BBZPPhN.exe
  2⤵
  PID:10160
- C:\Windows\System\bcHRjGY.exe
  C:\Windows\System\bcHRjGY.exe
  2⤵
  PID:10192
- C:\Windows\System\ptHLgZT.exe
  C:\Windows\System\ptHLgZT.exe
  2⤵
  PID:10216
- C:\Windows\System\DRwdewU.exe
  C:\Windows\System\DRwdewU.exe
  2⤵
  PID:9184
- C:\Windows\System\DgXCivm.exe
  C:\Windows\System\DgXCivm.exe
  2⤵
  PID:9304
- C:\Windows\System\kesxPdu.exe
  C:\Windows\System\kesxPdu.exe
  2⤵
  PID:9332
- C:\Windows\System\OUlJXnl.exe
  C:\Windows\System\OUlJXnl.exe
  2⤵
  PID:9432
- C:\Windows\System\UCyeZKg.exe
  C:\Windows\System\UCyeZKg.exe
  2⤵
  PID:9492
- C:\Windows\System\GuSpEke.exe
  C:\Windows\System\GuSpEke.exe
  2⤵
  PID:9572
- C:\Windows\System\ArbYTty.exe
  C:\Windows\System\ArbYTty.exe
  2⤵
  PID:9624
- C:\Windows\System\ivZVbLQ.exe
  C:\Windows\System\ivZVbLQ.exe
  2⤵
  PID:9712
- C:\Windows\System\ZIaQPge.exe
  C:\Windows\System\ZIaQPge.exe
  2⤵
  PID:9772
- C:\Windows\System\zjxEvQC.exe
  C:\Windows\System\zjxEvQC.exe
  2⤵
  PID:9872
- C:\Windows\System\GHvSyXB.exe
  C:\Windows\System\GHvSyXB.exe
  2⤵
  PID:9916
- C:\Windows\System\ZhPhKWM.exe
  C:\Windows\System\ZhPhKWM.exe
  2⤵
  PID:9956
- C:\Windows\System\aXtODlr.exe
  C:\Windows\System\aXtODlr.exe
  2⤵
  PID:10020
- C:\Windows\System\gTsydjY.exe
  C:\Windows\System\gTsydjY.exe
  2⤵
  PID:10092
- C:\Windows\System\QDmgSeW.exe
  C:\Windows\System\QDmgSeW.exe
  2⤵
  PID:10080
- C:\Windows\System\CPAuNhR.exe
  C:\Windows\System\CPAuNhR.exe
  2⤵
  PID:10200
- C:\Windows\System\FoRNIqH.exe
  C:\Windows\System\FoRNIqH.exe
  2⤵
  PID:9324
- C:\Windows\System\VhJPlUn.exe
  C:\Windows\System\VhJPlUn.exe
  2⤵
  PID:9472
- C:\Windows\System\otTOKnI.exe
  C:\Windows\System\otTOKnI.exe
  2⤵
  PID:2376
- C:\Windows\System\xOYICpB.exe
  C:\Windows\System\xOYICpB.exe
  2⤵
  PID:9760
- C:\Windows\System\nuEHOMe.exe
  C:\Windows\System\nuEHOMe.exe
  2⤵
  PID:9884
- C:\Windows\System\LVhcCMZ.exe
  C:\Windows\System\LVhcCMZ.exe
  2⤵
  PID:10036
- C:\Windows\System\XvHEYvv.exe
  C:\Windows\System\XvHEYvv.exe
  2⤵
  PID:10060
- C:\Windows\System\FURXpox.exe
  C:\Windows\System\FURXpox.exe
  2⤵
  PID:1036
- C:\Windows\System\CDUfMsX.exe
  C:\Windows\System\CDUfMsX.exe
  2⤵
  PID:9736
- C:\Windows\System\uocTUbi.exe
  C:\Windows\System\uocTUbi.exe
  2⤵
  PID:10096
- C:\Windows\System\rEVsqqj.exe
  C:\Windows\System\rEVsqqj.exe
  2⤵
  PID:9848
- C:\Windows\System\MdbUsyk.exe
  C:\Windows\System\MdbUsyk.exe
  2⤵
  PID:9940
- C:\Windows\System\EWMWVex.exe
  C:\Windows\System\EWMWVex.exe
  2⤵
  PID:9984
- C:\Windows\System\KuaYdvp.exe
  C:\Windows\System\KuaYdvp.exe
  2⤵
  PID:10272
- C:\Windows\System\TeFdcVa.exe
  C:\Windows\System\TeFdcVa.exe
  2⤵
  PID:10288
- C:\Windows\System\YRanYuq.exe
  C:\Windows\System\YRanYuq.exe
  2⤵
  PID:10320
- C:\Windows\System\vxHxBES.exe
  C:\Windows\System\vxHxBES.exe
  2⤵
  PID:10344
- C:\Windows\System\SLZKqcS.exe
  C:\Windows\System\SLZKqcS.exe
  2⤵
  PID:10396
- C:\Windows\System\iLlSptn.exe
  C:\Windows\System\iLlSptn.exe
  2⤵
  PID:10420
- C:\Windows\System\pAnSlPZ.exe
  C:\Windows\System\pAnSlPZ.exe
  2⤵
  PID:10452
- C:\Windows\System\qEWsMfS.exe
  C:\Windows\System\qEWsMfS.exe
  2⤵
  PID:10476
- C:\Windows\System\XAfGlaO.exe
  C:\Windows\System\XAfGlaO.exe
  2⤵
  PID:10500
- C:\Windows\System\XZSvsFI.exe
  C:\Windows\System\XZSvsFI.exe
  2⤵
  PID:10528
- C:\Windows\System\OGMGjxA.exe
  C:\Windows\System\OGMGjxA.exe
  2⤵
  PID:10564
- C:\Windows\System\cHhAZkH.exe
  C:\Windows\System\cHhAZkH.exe
  2⤵
  PID:10584
- C:\Windows\System\HtZgeRk.exe
  C:\Windows\System\HtZgeRk.exe
  2⤵
  PID:10608
- C:\Windows\System\ztELDom.exe
  C:\Windows\System\ztELDom.exe
  2⤵
  PID:10640
- C:\Windows\System\sOEiwFh.exe
  C:\Windows\System\sOEiwFh.exe
  2⤵
  PID:10668
- C:\Windows\System\BgChZfe.exe
  C:\Windows\System\BgChZfe.exe
  2⤵
  PID:10696
- C:\Windows\System\YOSGrlZ.exe
  C:\Windows\System\YOSGrlZ.exe
  2⤵
  PID:10724
- C:\Windows\System\PSITdMw.exe
  C:\Windows\System\PSITdMw.exe
  2⤵
  PID:10760
- C:\Windows\System\cSpMTVL.exe
  C:\Windows\System\cSpMTVL.exe
  2⤵
  PID:10788
- C:\Windows\System\dVVdRsS.exe
  C:\Windows\System\dVVdRsS.exe
  2⤵
  PID:10808
- C:\Windows\System\rHPtCpc.exe
  C:\Windows\System\rHPtCpc.exe
  2⤵
  PID:10844
- C:\Windows\System\BlpzFUz.exe
  C:\Windows\System\BlpzFUz.exe
  2⤵
  PID:10864
- C:\Windows\System\qYExwAw.exe
  C:\Windows\System\qYExwAw.exe
  2⤵
  PID:10884
- C:\Windows\System\hYrUihI.exe
  C:\Windows\System\hYrUihI.exe
  2⤵
  PID:10920
- C:\Windows\System\hneGqAW.exe
  C:\Windows\System\hneGqAW.exe
  2⤵
  PID:10948
- C:\Windows\System\ggtkZvh.exe
  C:\Windows\System\ggtkZvh.exe
  2⤵
  PID:10988
- C:\Windows\System\GuJThNl.exe
  C:\Windows\System\GuJThNl.exe
  2⤵
  PID:11004
- C:\Windows\System\nwmefnO.exe
  C:\Windows\System\nwmefnO.exe
  2⤵
  PID:11044
- C:\Windows\System\rEKaNrp.exe
  C:\Windows\System\rEKaNrp.exe
  2⤵
  PID:11064
- C:\Windows\System\kZxJJXP.exe
  C:\Windows\System\kZxJJXP.exe
  2⤵
  PID:11088
- C:\Windows\System\WTfMPXc.exe
  C:\Windows\System\WTfMPXc.exe
  2⤵
  PID:11120
- C:\Windows\System\XlkXXzk.exe
  C:\Windows\System\XlkXXzk.exe
  2⤵
  PID:11156
- C:\Windows\System\OqIdGQG.exe
  C:\Windows\System\OqIdGQG.exe
  2⤵
  PID:11184
- C:\Windows\System\lZtfroI.exe
  C:\Windows\System\lZtfroI.exe
  2⤵
  PID:11212
- C:\Windows\System\DzyspKj.exe
  C:\Windows\System\DzyspKj.exe
  2⤵
  PID:11240
- C:\Windows\System\vDgRllT.exe
  C:\Windows\System\vDgRllT.exe
  2⤵
  PID:11260
- C:\Windows\System\GzVwIkC.exe
  C:\Windows\System\GzVwIkC.exe
  2⤵
  PID:9680
- C:\Windows\System\YBohPyb.exe
  C:\Windows\System\YBohPyb.exe
  2⤵
  PID:10352
- C:\Windows\System\SsvNVLI.exe
  C:\Windows\System\SsvNVLI.exe
  2⤵
  PID:10428
- C:\Windows\System\xCVowGw.exe
  C:\Windows\System\xCVowGw.exe
  2⤵
  PID:10492
- C:\Windows\System\NhMbgSW.exe
  C:\Windows\System\NhMbgSW.exe
  2⤵
  PID:10544
- C:\Windows\System\qELeqok.exe
  C:\Windows\System\qELeqok.exe
  2⤵
  PID:10576
- C:\Windows\System\afaRsbW.exe
  C:\Windows\System\afaRsbW.exe
  2⤵
  PID:1212
- C:\Windows\System\cXfRKXy.exe
  C:\Windows\System\cXfRKXy.exe
  2⤵
  PID:10684
- C:\Windows\System\UToTlnM.exe
  C:\Windows\System\UToTlnM.exe
  2⤵
  PID:10744
- C:\Windows\System\wIpeDct.exe
  C:\Windows\System\wIpeDct.exe
  2⤵
  PID:10804
- C:\Windows\System\hdweawa.exe
  C:\Windows\System\hdweawa.exe
  2⤵
  PID:10852
- C:\Windows\System\VtLkSru.exe
  C:\Windows\System\VtLkSru.exe
  2⤵
  PID:10880
- C:\Windows\System\LbqQqgo.exe
  C:\Windows\System\LbqQqgo.exe
  2⤵
  PID:10976
- C:\Windows\System\rZzuMvE.exe
  C:\Windows\System\rZzuMvE.exe
  2⤵
  PID:11072
- C:\Windows\System\MEFZfev.exe
  C:\Windows\System\MEFZfev.exe
  2⤵
  PID:11100
- C:\Windows\System\vfwaQKp.exe
  C:\Windows\System\vfwaQKp.exe
  2⤵
  PID:11140
- C:\Windows\System\UIhxTXZ.exe
  C:\Windows\System\UIhxTXZ.exe
  2⤵
  PID:11232
- C:\Windows\System\cVHcHEe.exe
  C:\Windows\System\cVHcHEe.exe
  2⤵
  PID:11256
- C:\Windows\System\TECqOYr.exe
  C:\Windows\System\TECqOYr.exe
  2⤵
  PID:10416
- C:\Windows\System\SDfuEme.exe
  C:\Windows\System\SDfuEme.exe
  2⤵
  PID:10512
- C:\Windows\System\zqJJLDL.exe
  C:\Windows\System\zqJJLDL.exe
  2⤵
  PID:2232
- C:\Windows\System\xsNWjcH.exe
  C:\Windows\System\xsNWjcH.exe
  2⤵
  PID:10688
- C:\Windows\System\GEBnAxv.exe
  C:\Windows\System\GEBnAxv.exe
  2⤵
  PID:10940
- C:\Windows\System\nnQxqjj.exe
  C:\Windows\System\nnQxqjj.exe
  2⤵
  PID:11084
- C:\Windows\System\fCrcRPE.exe
  C:\Windows\System\fCrcRPE.exe
  2⤵
  PID:11224
- C:\Windows\System\fVwtKBP.exe
  C:\Windows\System\fVwtKBP.exe
  2⤵
  PID:468
- C:\Windows\System\AAtwnNz.exe
  C:\Windows\System\AAtwnNz.exe
  2⤵
  PID:3608
- C:\Windows\System\mKSORUh.exe
  C:\Windows\System\mKSORUh.exe
  2⤵
  PID:11208
- C:\Windows\System\xrRLHPb.exe
  C:\Windows\System\xrRLHPb.exe
  2⤵
  PID:10284
- C:\Windows\System\iiViiXq.exe
  C:\Windows\System\iiViiXq.exe
  2⤵
  PID:2452
- C:\Windows\System\RquKySt.exe
  C:\Windows\System\RquKySt.exe
  2⤵
  PID:11288
- C:\Windows\System\oZOBJki.exe
  C:\Windows\System\oZOBJki.exe
  2⤵
  PID:11316
- C:\Windows\System\YzkaPLR.exe
  C:\Windows\System\YzkaPLR.exe
  2⤵
  PID:11344
- C:\Windows\System\TywHzQo.exe
  C:\Windows\System\TywHzQo.exe
  2⤵
  PID:11380
- C:\Windows\System\ktSEqNJ.exe
  C:\Windows\System\ktSEqNJ.exe
  2⤵
  PID:11404
- C:\Windows\System\uXPpDtN.exe
  C:\Windows\System\uXPpDtN.exe
  2⤵
  PID:11428
- C:\Windows\System\uhrzhDw.exe
  C:\Windows\System\uhrzhDw.exe
  2⤵
  PID:11456
- C:\Windows\System\fwfHOjY.exe
  C:\Windows\System\fwfHOjY.exe
  2⤵
  PID:11484
- C:\Windows\System\vSqibyT.exe
  C:\Windows\System\vSqibyT.exe
  2⤵
  PID:11504
- C:\Windows\System\RPfuAhx.exe
  C:\Windows\System\RPfuAhx.exe
  2⤵
  PID:11540
- C:\Windows\System\tsTmZgu.exe
  C:\Windows\System\tsTmZgu.exe
  2⤵
  PID:11556
- C:\Windows\System\dswCkop.exe
  C:\Windows\System\dswCkop.exe
  2⤵
  PID:11580
- C:\Windows\System\YOYPpzi.exe
  C:\Windows\System\YOYPpzi.exe
  2⤵
  PID:11600
- C:\Windows\System\pPwkaiK.exe
  C:\Windows\System\pPwkaiK.exe
  2⤵
  PID:11628
- C:\Windows\System\gyksOfi.exe
  C:\Windows\System\gyksOfi.exe
  2⤵
  PID:11656
- C:\Windows\System\TPjlgFi.exe
  C:\Windows\System\TPjlgFi.exe
  2⤵
  PID:11696
- C:\Windows\System\uRXpyuw.exe
  C:\Windows\System\uRXpyuw.exe
  2⤵
  PID:11736
- C:\Windows\System\zaKFuUU.exe
  C:\Windows\System\zaKFuUU.exe
  2⤵
  PID:11764
- C:\Windows\System\QTXAXCw.exe
  C:\Windows\System\QTXAXCw.exe
  2⤵
  PID:11804
- C:\Windows\System\mNypAbG.exe
  C:\Windows\System\mNypAbG.exe
  2⤵
  PID:11844
- C:\Windows\System\TuzZbyQ.exe
  C:\Windows\System\TuzZbyQ.exe
  2⤵
  PID:11860
- C:\Windows\System\gfkdlSO.exe
  C:\Windows\System\gfkdlSO.exe
  2⤵
  PID:11892
- C:\Windows\System\cywZfCO.exe
  C:\Windows\System\cywZfCO.exe
  2⤵
  PID:11912
- C:\Windows\System\tDQrkTj.exe
  C:\Windows\System\tDQrkTj.exe
  2⤵
  PID:11932
- C:\Windows\System\VJNjnQs.exe
  C:\Windows\System\VJNjnQs.exe
  2⤵
  PID:11964
- C:\Windows\System\KhfnkYF.exe
  C:\Windows\System\KhfnkYF.exe
  2⤵
  PID:12004
- C:\Windows\System\wSgMMLL.exe
  C:\Windows\System\wSgMMLL.exe
  2⤵
  PID:12032
- C:\Windows\System\sQVstFy.exe
  C:\Windows\System\sQVstFy.exe
  2⤵
  PID:12060
- C:\Windows\System\pxUbnWf.exe
  C:\Windows\System\pxUbnWf.exe
  2⤵
  PID:12088
- C:\Windows\System\zlebQGh.exe
  C:\Windows\System\zlebQGh.exe
  2⤵
  PID:12104
- C:\Windows\System\mXfRGVw.exe
  C:\Windows\System\mXfRGVw.exe
  2⤵
  PID:12124
- C:\Windows\System\osdjOaD.exe
  C:\Windows\System\osdjOaD.exe
  2⤵
  PID:12160
- C:\Windows\System\HKkVDJU.exe
  C:\Windows\System\HKkVDJU.exe
  2⤵
  PID:12188
- C:\Windows\System\srlAqaq.exe
  C:\Windows\System\srlAqaq.exe
  2⤵
  PID:12216
- C:\Windows\System\mclFUZm.exe
  C:\Windows\System\mclFUZm.exe
  2⤵
  PID:12244
- C:\Windows\System\fBzbhyx.exe
  C:\Windows\System\fBzbhyx.exe
  2⤵
  PID:12272
- C:\Windows\System\rSAYBLu.exe
  C:\Windows\System\rSAYBLu.exe
  2⤵
  PID:11016
- C:\Windows\System\NrkIoPF.exe
  C:\Windows\System\NrkIoPF.exe
  2⤵
  PID:11328
- C:\Windows\System\XwNGMKD.exe
  C:\Windows\System\XwNGMKD.exe
  2⤵
  PID:11364
- C:\Windows\System\RAREjUy.exe
  C:\Windows\System\RAREjUy.exe
  2⤵
  PID:11472
- C:\Windows\System\tHvGWpr.exe
  C:\Windows\System\tHvGWpr.exe
  2⤵
  PID:11520
- C:\Windows\System\zQVZzmj.exe
  C:\Windows\System\zQVZzmj.exe
  2⤵
  PID:11608
- C:\Windows\System\jdxxZSl.exe
  C:\Windows\System\jdxxZSl.exe
  2⤵
  PID:11620
- C:\Windows\System\xZXDJru.exe
  C:\Windows\System\xZXDJru.exe
  2⤵
  PID:11688
- C:\Windows\System\CMniYmr.exe
  C:\Windows\System\CMniYmr.exe
  2⤵
  PID:11720
- C:\Windows\System\vIBLdbe.exe
  C:\Windows\System\vIBLdbe.exe
  2⤵
  PID:11840
- C:\Windows\System\BHoDUjW.exe
  C:\Windows\System\BHoDUjW.exe
  2⤵
  PID:11900
- C:\Windows\System\nhZAhgm.exe
  C:\Windows\System\nhZAhgm.exe
  2⤵
  PID:11924
- C:\Windows\System\CVpRKaL.exe
  C:\Windows\System\CVpRKaL.exe
  2⤵
  PID:12000
- C:\Windows\System\JHsVbCb.exe
  C:\Windows\System\JHsVbCb.exe
  2⤵
  PID:3728
- C:\Windows\System\MAaunOr.exe
  C:\Windows\System\MAaunOr.exe
  2⤵
  PID:12096
- C:\Windows\System\OWgGgQp.exe
  C:\Windows\System\OWgGgQp.exe
  2⤵
  PID:12140
- C:\Windows\System\KYFntZe.exe
  C:\Windows\System\KYFntZe.exe
  2⤵
  PID:12172
- C:\Windows\System\NgpeiGs.exe
  C:\Windows\System\NgpeiGs.exe
  2⤵
  PID:12256
- C:\Windows\System\ZfoLQkT.exe
  C:\Windows\System\ZfoLQkT.exe
  2⤵
  PID:12280
- C:\Windows\System\EEcPJiL.exe
  C:\Windows\System\EEcPJiL.exe
  2⤵
  PID:11360
- C:\Windows\System\DjtrpNC.exe
  C:\Windows\System\DjtrpNC.exe
  2⤵
  PID:11548
- C:\Windows\System\tyWbOmv.exe
  C:\Windows\System\tyWbOmv.exe
  2⤵
  PID:11652
- C:\Windows\System\kDcxhjr.exe
  C:\Windows\System\kDcxhjr.exe
  2⤵
  PID:11816
- C:\Windows\System\rPuavvY.exe
  C:\Windows\System\rPuavvY.exe
  2⤵
  PID:11976
- C:\Windows\System\vpUXZMl.exe
  C:\Windows\System\vpUXZMl.exe
  2⤵
  PID:12080
- C:\Windows\System\QlpORwn.exe
  C:\Windows\System\QlpORwn.exe
  2⤵
  PID:12176
- C:\Windows\System\KccPliO.exe
  C:\Windows\System\KccPliO.exe
  2⤵
  PID:11272
- C:\Windows\System\lwUuSVB.exe
  C:\Windows\System\lwUuSVB.exe
  2⤵
  PID:11708
- C:\Windows\System\ZfqiEsZ.exe
  C:\Windows\System\ZfqiEsZ.exe
  2⤵
  PID:1356
- C:\Windows\System\BwiDfRQ.exe
  C:\Windows\System\BwiDfRQ.exe
  2⤵
  PID:12264
- C:\Windows\System\yNpouez.exe
  C:\Windows\System\yNpouez.exe
  2⤵
  PID:12292
- C:\Windows\System\bWLxLRr.exe
  C:\Windows\System\bWLxLRr.exe
  2⤵
  PID:12312
- C:\Windows\System\fQbpNTG.exe
  C:\Windows\System\fQbpNTG.exe
  2⤵
  PID:12348
- C:\Windows\System\VufODmZ.exe
  C:\Windows\System\VufODmZ.exe
  2⤵
  PID:12376
- C:\Windows\System\PqzBdLA.exe
  C:\Windows\System\PqzBdLA.exe
  2⤵
  PID:12400
- C:\Windows\System\wRKZutD.exe
  C:\Windows\System\wRKZutD.exe
  2⤵
  PID:12440
- C:\Windows\System\jjacjBU.exe
  C:\Windows\System\jjacjBU.exe
  2⤵
  PID:12488
- C:\Windows\System\bRCMUaL.exe
  C:\Windows\System\bRCMUaL.exe
  2⤵
  PID:12520
- C:\Windows\System\MhfwzPP.exe
  C:\Windows\System\MhfwzPP.exe
  2⤵
  PID:12536
- C:\Windows\System\tnoiamw.exe
  C:\Windows\System\tnoiamw.exe
  2⤵
  PID:12564
- C:\Windows\System\VvRulVn.exe
  C:\Windows\System\VvRulVn.exe
  2⤵
  PID:12604
- C:\Windows\System\EhxgEvD.exe
  C:\Windows\System\EhxgEvD.exe
  2⤵
  PID:12644
- C:\Windows\System\iqCESfU.exe
  C:\Windows\System\iqCESfU.exe
  2⤵
  PID:12672
- C:\Windows\System\nOYqbyc.exe
  C:\Windows\System\nOYqbyc.exe
  2⤵
  PID:12696
- C:\Windows\System\TghEhwy.exe
  C:\Windows\System\TghEhwy.exe
  2⤵
  PID:12728
- C:\Windows\System\RSFEeUy.exe
  C:\Windows\System\RSFEeUy.exe
  2⤵
  PID:12756
- C:\Windows\System\jkdqrPE.exe
  C:\Windows\System\jkdqrPE.exe
  2⤵
  PID:12784
- C:\Windows\System\SyqIIbS.exe
  C:\Windows\System\SyqIIbS.exe
  2⤵
  PID:12812
- C:\Windows\System\cPAgSIo.exe
  C:\Windows\System\cPAgSIo.exe
  2⤵
  PID:12840
- C:\Windows\System\RSYXQBb.exe
  C:\Windows\System\RSYXQBb.exe
  2⤵
  PID:12876
- C:\Windows\System\SNidliR.exe
  C:\Windows\System\SNidliR.exe
  2⤵
  PID:12896
- C:\Windows\System\SrgWFno.exe
  C:\Windows\System\SrgWFno.exe
  2⤵
  PID:12924
- C:\Windows\System\rpFEORV.exe
  C:\Windows\System\rpFEORV.exe
  2⤵
  PID:12952
- C:\Windows\System\atiyHxf.exe
  C:\Windows\System\atiyHxf.exe
  2⤵
  PID:12984
- C:\Windows\System\qVsUFDe.exe
  C:\Windows\System\qVsUFDe.exe
  2⤵
  PID:13004
- C:\Windows\System\QTPvERW.exe
  C:\Windows\System\QTPvERW.exe
  2⤵
  PID:13112
- C:\Windows\System\ciNoHUj.exe
  C:\Windows\System\ciNoHUj.exe
  2⤵
  PID:13128
- C:\Windows\System\nondtsk.exe
  C:\Windows\System\nondtsk.exe
  2⤵
  PID:13164
- C:\Windows\System\xRLkexi.exe
  C:\Windows\System\xRLkexi.exe
  2⤵
  PID:13196
- C:\Windows\System\QofFaBs.exe
  C:\Windows\System\QofFaBs.exe
  2⤵
  PID:13220
- C:\Windows\System\GdEILPN.exe
  C:\Windows\System\GdEILPN.exe
  2⤵
  PID:13252
- C:\Windows\System\kZyXHXl.exe
  C:\Windows\System\kZyXHXl.exe
  2⤵
  PID:13284
- C:\Windows\System\tCqBmGz.exe
  C:\Windows\System\tCqBmGz.exe
  2⤵
  PID:12028
- C:\Windows\System\AlVmzrA.exe
  C:\Windows\System\AlVmzrA.exe
  2⤵
  PID:12300
- C:\Windows\System\JWIOkry.exe
  C:\Windows\System\JWIOkry.exe
  2⤵
  PID:12336
- C:\Windows\System\eNuQlup.exe
  C:\Windows\System\eNuQlup.exe
  2⤵
  PID:12396
- C:\Windows\System\EJjOPJL.exe
  C:\Windows\System\EJjOPJL.exe
  2⤵
  PID:12432
- C:\Windows\System\zNasjqK.exe
  C:\Windows\System\zNasjqK.exe
  2⤵
  PID:12584
- C:\Windows\System\VimjxnU.exe
  C:\Windows\System\VimjxnU.exe
  2⤵
  PID:12616
- C:\Windows\System\aRElemr.exe
  C:\Windows\System\aRElemr.exe
  2⤵
  PID:12684
- C:\Windows\System\jxbYbsj.exe
  C:\Windows\System\jxbYbsj.exe
  2⤵
  PID:12740
- C:\Windows\System\lqZgwny.exe
  C:\Windows\System\lqZgwny.exe
  2⤵
  PID:12800
- C:\Windows\System\lBBdTqC.exe
  C:\Windows\System\lBBdTqC.exe
  2⤵
  PID:12892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dave4rbl.3nm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EvJMkee.exe

Filesize
2.6MB

MD5
4796b0f92b787327f2292d94ad6588fb

SHA1
1813063317c390a0e7ee03e623c9e24e21cc504f

SHA256
0ae865eb707bfbfb5a1f11d75383f4023aa0fcbe7131001067982c2b7be50e16

SHA512
e5e577076da0042a22899d20f094e425b4c81d39f6911d0e36d0bd36fa8d34fb9f40b20c9486fd43f857c28d9caf4a0f2fd17ab3b0aa6a66ad368b8f093d2793

Download Submit
C:\Windows\System\HjYOiql.exe

Filesize
2.6MB

MD5
bd1ca7deec27356be22425c7143ea676

SHA1
8c6346926e4468af35d1a51f90dff2e33a5e01fb

SHA256
879f213628f2c9006ecb293154c67a260c6058539afe60a2956cd3bd47b7854a

SHA512
3bfd89fd95b74fbb97a655cefadd85606db927ca6b609455c1dbb5aa057d968880d20c899d2da3ec188cdd417880b4688e5a28d1679669c46da5c535577fee2e

Download Submit
C:\Windows\System\JCohwlO.exe

Filesize
2.6MB

MD5
6d83f4f29f994cbc2c8316d0bed552d4

SHA1
9e1e97a3cc17e003c55745114f7d77e9ba1ab881

SHA256
eb43004066bde0d72ea26f6a8edf2d77d390fdde291b21801885981ef5d19040

SHA512
64af03a670f2e1443c07309cd7e073439951dee232dad6117471d56f1fbad025edf407d0fbc416e0cbbebb6f1e9b239bc02c43611b03c79f6b4f2af863aa33dc

Download Submit
C:\Windows\System\LZafCCb.exe

Filesize
2.6MB

MD5
39c13f23d9159adf3ee0ca16a1cc69a6

SHA1
de714a6cd54387c09d2e83c77e5200c593aac811

SHA256
db17b5dd8c15e4c68b211e352837b37d9d388f01bbc199b579789279b996339c

SHA512
3d602e9b4a6ba090e12d3063a87780684201b25442344278a8b33f4fd761eec3ddc4cfd2c331e2b94f238e8edd5e9843653a3022aaf6414b9f36235c488f44c5

Download Submit
C:\Windows\System\MORhIIE.exe

Filesize
2.6MB

MD5
756d5bd31f607c08bfeaae2288f4e763

SHA1
336f6fe6ada838816d464759f11c4c5974a99a50

SHA256
66935acca98eaa220d790098318d2cc7bf7b6e63043e2a0b47467d80b839eea9

SHA512
df97cc3dd4f6eeea5722b8be15fd2c2d4167ca38c9c84478eb4402bac79d09511c95e80c3199c5acedd1b2cdb0edd721f3b1065e32e95a8d6706e23643a9d365

Download Submit
C:\Windows\System\NLvstZr.exe

Filesize
2.6MB

MD5
40a1c9774606fbb46cfab342afe7c124

SHA1
e759e72b4221aaf35de1f30c6146ad0c48edbea4

SHA256
52b41472f10629f27d83ef41b84871f2463b51a4917dc2a1b7896515d59a0505

SHA512
d88ac5183e86743a2fd49f8d11d424e8cfe0714685f80d8decc5fc31fb2bdddfc890845d9db03527eb8d650d70037f22a1a2dec55c33fa943b4e92b345824d8f

Download Submit
C:\Windows\System\PVHBWRP.exe

Filesize
2.6MB

MD5
c86600c5af0a429191469613d9981465

SHA1
4ae392d99048b3fa13326b67f0cdb3e11034da4d

SHA256
3ccacc19391465fba37fbb2e57380568f4b1990ce505aedfabdd762d0f8dfaf3

SHA512
5dc3e0cd04f0293e6264655b530286ea2feac4fdb928dfa7b7d8f90ba0ec6d14dd18bc23fa87845cec28f8e4f8da7a8ae6c4be72fca3582c69579f44d06dc7f5

Download Submit
C:\Windows\System\QAzxEap.exe

Filesize
2.6MB

MD5
35cf04f4146171c7a4b38ca4748dae8f

SHA1
860ed96a316ea2ce9a6d5f443eb865b94224d229

SHA256
e0989ed5b414b6b12a626dcb39b35fa559579e63b68fb2f20a6a711437bcb4be

SHA512
82d943532d2226709f7d74d8d220c10eb2055832c580caa3fb5661a9b286a63bdfc215cce658fd83ce686c93970aa9e70e2ffaa330ff38e994d77f8a9406cc75

Download Submit
C:\Windows\System\QjsUSUP.exe

Filesize
2.6MB

MD5
d50209995cd6035b66176c8bfbf1b4a0

SHA1
d8169baccb5a016c2635f87dc8e7ff44a3c21c01

SHA256
ed37b4d1e62669f5bf97c7bcfbcb937e397180145d12aa6b0ec0fd0c5aa8635a

SHA512
3eb9117e241a719660c7f4baa0fba3128075cd8862e98be1ff703a93507485b18fc81026cce6fb7e377bcb4313dd3ecb3e13444a24db6cc5f1f50418311711a4

Download Submit
C:\Windows\System\QofWPpv.exe

Filesize
8B

MD5
f35342d1b171c234622382ea1b55ca22

SHA1
bf974068aec171c56a214f2ab5d303e3c0b3cbc8

SHA256
d184ab9490b4cb851da39589a6d65662311075fe1b21b130a35064db12fff155

SHA512
0c357986d250b9c4b9f2586a53caabb8fcd1271ff6e0653b5c76ef6d90683fb607d119683a3d68953684408060363537f169c2c23e08f04bcac73e2860df2b04

Download Submit
C:\Windows\System\RxwEWMs.exe

Filesize
2.6MB

MD5
9e1e2a10710cb4066f2bba270cc89ab7

SHA1
ed567a51f61831fcb41649a9b033f060a56300d6

SHA256
f01cc183f5e9e45f4f76b05210107f248ce6c9440f756344e254dbaeaf879367

SHA512
c7f9b7e48986551082318e1965097ddf8c4190b280144d2d203133edb3b84d167d82fa9765ca9597656547d6a7610ce014facc1087e46c5bdbb463407a847bb0

Download Submit
C:\Windows\System\SsueJKT.exe

Filesize
2.6MB

MD5
f806530409fd64b41317674d631e5257

SHA1
18942cc6c09cdaa272ccf7846564c04fc5df38c2

SHA256
79ce7497150e3a65442d471c928bfded6a82ce545d62219e644c4c8b93ab85d8

SHA512
a452754b956f31936720104f8da627bb3689a63a07a5f06bd231f74c869ada64a0fb3ea05e15ebfb75f02075ca5e621535cef8d04068109530368d46af445361

Download Submit
C:\Windows\System\VDwGTgq.exe

Filesize
2.6MB

MD5
88c5bbb269baa8b31edf075fce1dae66

SHA1
6a3cf68d6e2c9e02e80260535e56725abfc4e875

SHA256
3380adf733923b89d33a3af19629a6dd28d23ded83c46d1a6af2db0e2dff1a20

SHA512
348e144456730ab88cafe0fcf9c12839b9e70735808948ba5ba350371959080997db621d2a5b39bdcc722b4546323ff4c05c545e45a9159e9a88b8fff1842eec

Download Submit
C:\Windows\System\WTTQavZ.exe

Filesize
2.6MB

MD5
963d665c6a71dd2e6e18a91cc1eb7b54

SHA1
3e921ada5eff5d20ea04e2faccef88190afa460c

SHA256
ae62ca72ca3d81ebcba979727a172d30d22a601d165f882b92f4d090a06d2835

SHA512
d1ccec813440b3198f4157b191c1396acd567d63b68e7a2fa62d9233dcc751569e4189dd5ac7b7211504b55d368bd99fdcfd240137664e3861107ea0f0c9e433

Download Submit
C:\Windows\System\WhaQzBZ.exe

Filesize
2.6MB

MD5
70b3ffde5ec4108c97ddc17717fa69ab

SHA1
bfd815218d8dfd1b314cdb6c5282c15bed34eb0a

SHA256
d9ba3785818fcd90f881580e1c616bddfb7a2f9306e4c87ee598c6ae08d65912

SHA512
dfbafe7701fd2dc5a53afd53a81cfa28cd6477a5fd186c981875169701ff44f750235ad9f20515476b947fbf129f8dcac0e77a47d9fe08cfde3a3bf89edbbe67

Download Submit
C:\Windows\System\WhmAhqT.exe

Filesize
2.6MB

MD5
2bc75ed744fee4c3287f8fc0c57d4381

SHA1
04f0a9adb2557cd00396cef1104c4c4bbdac059a

SHA256
38291dd1b31c810e0e8ae126a58fe6650bb3b925e4dc1f344b96ee43930fa0c2

SHA512
843f433382344387d13ae977ea493d448bd2d33e7fe50fbd78749acd224d0cdc530a5345e5932b652a443a7935cfdfdd126df6a5330785e29f21c77f5f8e6b10

Download Submit
C:\Windows\System\YejNxby.exe

Filesize
2.6MB

MD5
d7b263706ce0bd19fab05be6e7325061

SHA1
7ec17fe06d023c3a14bd4e920dea8dd198342230

SHA256
39b612bc577ddeee3e607264e082f975812de708ab4ed9b72374a6b729608ffd

SHA512
b6b33484d114c5dcd024502c129dfd8dd1366c3936d45b24742dd61fa3488128dc450deb3e5a138cc6bed77a7edda74d23a7bcc3ee51c39a57ad6ee3f1f07835

Download Submit
C:\Windows\System\akczftt.exe

Filesize
2.6MB

MD5
bac30cf4eed555bc2cf3778a7f2c6184

SHA1
dd526d288b298835b403a7174b80ce7b4fd5c0bd

SHA256
d6642fe7366a507e8e98f930fc9f64328a3f96cb581b2806315ee75382545d05

SHA512
9c541fe59b72a4e20045f40a001fcbb4c384d226284db2f1199bb50160ec96d079f35cfb571a685c38fe8927e259682c8edcb8e3ce840f0dfda995c16146e073

Download Submit
C:\Windows\System\apuTMDy.exe

Filesize
2.6MB

MD5
91e8613e302124cc05cec952503c32e3

SHA1
1a32898ebfec849ed477539689036cf49bc52cb4

SHA256
5d7e84da746a149cf0e60e5fc7586a1735103b5d099e8f0f1cafdca9a03a2a1a

SHA512
364db59d6c6318dd404ba0582b08c7d6381a9dbbcde3f4383e6d1b120e095812985ef72652500283e1e48c325767baf9001049b49ff63a2c423621d3d2e3e6ad

Download Submit
C:\Windows\System\dWiLsTv.exe

Filesize
2.6MB

MD5
6bbc59edf6f5b40ea5e4995ce256b95f

SHA1
eea2a8e023cb2a1769f1a2901daea155abce6cd2

SHA256
28b95662925d6210d81b8af7c335f6decd853bce2e0f9b5c12069d6e1dab3532

SHA512
cda71a6e3a55d9dba8d68870da2a46c170c9f715af568ee596b61006e4a713e5975aaf834668a5fc97748189dfcd60f924676390ee6a043c66191d953825b8e7

Download Submit
C:\Windows\System\eOzhEMK.exe

Filesize
2.6MB

MD5
ff5990802aa924b947efeb79e1401fc6

SHA1
690fa49a109a4de31b92fb7fb5c68e113574bd5a

SHA256
c340e22b8a05ea17dc7fcda78809213bbc32b2d9f101d8cc3b234c1a7118dde6

SHA512
34ee5c7c04060fd0db2f4ed80af460703ff74c328ab4a57a00ee2b57f7ce1d056142424be7c2cc9b07cf8969b9986b2b5ee5192ff7af3e37b139db1d5d62cdab

Download Submit
C:\Windows\System\edVoOrM.exe

Filesize
2.6MB

MD5
41f07a631e75da184be2fc4646efcb4c

SHA1
25472e2501c492b509549be10d79c89308ab75cb

SHA256
f4f743f9e5fb138f90ef2e7b9896c53f2f375eb42f922f4580285f263a0ddb03

SHA512
fba84d5cb5e9836e42419601e139a5aa398c69c968df52bad41a9fb73240988b0f9910aa59c683d54e4f023a2cafac4139fb84c3160ec0ada8140f516a428ccd

Download Submit
C:\Windows\System\hYyAvRw.exe

Filesize
2.6MB

MD5
09a3816c4681c08e37a0a7afebf669a0

SHA1
75d057ca72fda11299b45dd2bd44f5e79717d132

SHA256
4da6c418db9dc3cc5d155ec3c184a84c4a718f11ccb03c091cc3dfc4de108a1a

SHA512
552dcbbcccdfc2b60f09a8ff917fe69fd0ed45da4e4b672d8ae118e9d052be5e45041bb1971937deba4699bccb0066e43ee1c3e943b0992aeca0832691472b3b

Download Submit
C:\Windows\System\ibBAsss.exe

Filesize
2.6MB

MD5
43dc101dfea905e9aae491284b24ae12

SHA1
3ea1e0daeb03aeac9ca14ca12d06f62930501ebe

SHA256
e355cdd9435f4eda09274dd6063bc070f75d5004c49fa2ba3c25b299c909d974

SHA512
05db617555d286b9acde4a9aab9bd5f2ae5b3a801d9952a2438e9fe325b0d2966501ca0059c1345934a5438c39fbcbf9c2d960c17880d04724ed1e46471010ff

Download Submit
C:\Windows\System\inqMznX.exe

Filesize
2.6MB

MD5
60238b232ce2a9a962ceeadeb341ddfe

SHA1
9781e4dd3fdd39b0ced8a92b60fe58c7320d843a

SHA256
4f4b38814ac407eed8fbdcac412cfe3001b67298e5cca7991de37fc1cb234bdc

SHA512
f22e981a924642286e46e26ce4b04c77dc5911b7164a345b9a70d64b79307980a2f04a8a499375dc03e5f22630d99c3f4bae201c9668a1bd17570cb23d4b91a5

Download Submit
C:\Windows\System\jQBbPmc.exe

Filesize
2.6MB

MD5
b1b766f230fe609eb097eb2e24d437d8

SHA1
bad6d1efe82fbc32f60d3b8b09d5a0c8095a3d8c

SHA256
4093c3f3866de83c3008027488b4f5a47eca2d18f60d949a379cd80021a2286f

SHA512
afeecdca6d441add4d049e2a3da04098c5138f0fe4928f10911fe847bce0ed80fadb46680736ffa3b480d623e3c6910f1b27098e794f7480ead8b5bb0fdc2d63

Download Submit
C:\Windows\System\lizMjsT.exe

Filesize
2.6MB

MD5
c7d7e7ad45de2827cc441d5b1573d69f

SHA1
78d0ae10b3dc2b1c9c3e3cdb9421669026131e76

SHA256
eaeb4ee855b4814d238712aff60498cba775c1392a5cef4eeec19c7259aa90b1

SHA512
5098401299c4e8d3cd92a35de68c62a54e6f625263aca5e9651b0502ab95464c28f1dd87bb941072ac341cc17404c4a63806b934c26cce82f2bc44a2094f9985

Download Submit
C:\Windows\System\lljZyny.exe

Filesize
2.6MB

MD5
39dc41f8199aac5358c5812d64ce635c

SHA1
8b5065904687cadafac1a951ef67f1d49e3fa25f

SHA256
6d97a89ebafb3c2c6e65cb968d7d94154a93b5fff5088178a91403d202411ba0

SHA512
32ffb1b70b89956f6d95e4854d8470a075f904c471c91d170ac506dc97304015865f81d12552c66dbbaf5f5f521a52933d044f65bfaf1e3c2fbc600a47d3a761

Download Submit
C:\Windows\System\pitKwlL.exe

Filesize
2.6MB

MD5
530a421f7e9cf3c075c9287f8739d633

SHA1
f70da21de8c45f5faab40f44dbf6d8f13f357f5b

SHA256
074ce354d1d57464e780a1de16897570d9607822c3444966359a30debecfa177

SHA512
c3dfe9ea0632a284400f7d8e20997d0213c42731ace47354466c664aa306cf247f5db98a8b84d067aa8187da57ca471369d2c5847ea7977fb980195565eca82b

Download Submit
C:\Windows\System\qNLxThf.exe

Filesize
2.6MB

MD5
b27e9cef426d7ed9ff05e311f2b49eb0

SHA1
ac2f1a8a73f5abc8346a0a77d638900e4d53eeb8

SHA256
542e068c206b2e9050145a4d4857ad55a68e8d2e3a94e17fcbd08aaea2686371

SHA512
1d15c8557eace40e9a3f55e7d5edc4a8afe00e25a13cd6277579fa4942162859aeb31826051be2415a3d0ce492baae093e8f339a9242e120b08ab53afbd5b7bd

Download Submit
C:\Windows\System\tUpEIvU.exe

Filesize
2.6MB

MD5
b39c57be22be8f52286b630c591aa1e9

SHA1
cdb55977290521aa5844d777e5d34e06b790fa2f

SHA256
1427abd8d83e19314fb80f353f399076499a835b92f02f97ae7b28d933995741

SHA512
3808d6a8ace1dfb3feea5414a2e5036c47d496cfd8b8d18c9351da36870bca32f2dff3608af2a11c0c5718be156360b90e03225a60e99e27cd6d85b18b746a9c

Download Submit
C:\Windows\System\wQWNTPC.exe

Filesize
2.6MB

MD5
aeceb9c29f837ef895b5da5ae994b739

SHA1
e13d763b9f844856a5e7955fe31aa02ba9334e41

SHA256
633127b8bbf7db590acf19c7f7e55f282c787e167b83b8a9b38dca332b01234e

SHA512
b973d9136a4e08ba34385797f5a81f89967a10c246dd827d33a8f5e81ae98692bd8e586b4719c290cfa048cbdeb08e7097ca3123b52674bc46512763c81b53c5

Download Submit
C:\Windows\System\zPANPoY.exe

Filesize
2.6MB

MD5
14138c95cd5c3324615d6db81758980f

SHA1
8034b478f44bb3e29e0c2932747ff55e0c346c66

SHA256
894417dd23d83c5ff1ab0cde78ba62055555162c91346239b95106c94dde5335

SHA512
d39737e4300f6804b4f73cd4e145c7187a292e5370dc29cecd10f98e8eae14e3fa256315745928a8a1ea1d3c67f6fa128ec002e68f3d9bb72f6207eae8a8bea7

Download Submit
memory/752-2223-0x00007FF6D02E0000-0x00007FF6D06D6000-memory.dmp

Filesize
4.0MB

Download
memory/752-45-0x00007FF6D02E0000-0x00007FF6D06D6000-memory.dmp

Filesize
4.0MB

Download
memory/760-2237-0x00007FF707CD0000-0x00007FF7080C6000-memory.dmp

Filesize
4.0MB

Download
memory/760-193-0x00007FF707CD0000-0x00007FF7080C6000-memory.dmp

Filesize
4.0MB

Download
memory/840-184-0x00007FF71D450000-0x00007FF71D846000-memory.dmp

Filesize
4.0MB

Download
memory/840-2234-0x00007FF71D450000-0x00007FF71D846000-memory.dmp

Filesize
4.0MB

Download
memory/848-166-0x00007FF7A4490000-0x00007FF7A4886000-memory.dmp

Filesize
4.0MB

Download
memory/848-2243-0x00007FF7A4490000-0x00007FF7A4886000-memory.dmp

Filesize
4.0MB

Download
memory/1384-190-0x00007FF78EED0000-0x00007FF78F2C6000-memory.dmp

Filesize
4.0MB

Download
memory/1384-2235-0x00007FF78EED0000-0x00007FF78F2C6000-memory.dmp

Filesize
4.0MB

Download
memory/1644-2244-0x00007FF703F70000-0x00007FF704366000-memory.dmp

Filesize
4.0MB

Download
memory/1644-186-0x00007FF703F70000-0x00007FF704366000-memory.dmp

Filesize
4.0MB

Download
memory/1996-187-0x00007FF816410000-0x00007FF816ED1000-memory.dmp

Filesize
10.8MB

Download
memory/1996-31-0x00007FF816410000-0x00007FF816ED1000-memory.dmp

Filesize
10.8MB

Download
memory/1996-116-0x000001F5E78A0000-0x000001F5E78C2000-memory.dmp

Filesize
136KB

Download
memory/1996-5-0x00007FF816413000-0x00007FF816415000-memory.dmp

Filesize
8KB

Download
memory/2184-2242-0x00007FF7E99F0000-0x00007FF7E9DE6000-memory.dmp

Filesize
4.0MB

Download
memory/2184-191-0x00007FF7E99F0000-0x00007FF7E9DE6000-memory.dmp

Filesize
4.0MB

Download
memory/2352-159-0x00007FF706C10000-0x00007FF707006000-memory.dmp

Filesize
4.0MB

Download
memory/2352-2232-0x00007FF706C10000-0x00007FF707006000-memory.dmp

Filesize
4.0MB

Download
memory/2468-2241-0x00007FF610E40000-0x00007FF611236000-memory.dmp

Filesize
4.0MB

Download
memory/2468-180-0x00007FF610E40000-0x00007FF611236000-memory.dmp

Filesize
4.0MB

Download
memory/2476-2231-0x00007FF6BD0B0000-0x00007FF6BD4A6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-161-0x00007FF6BD0B0000-0x00007FF6BD4A6000-memory.dmp

Filesize
4.0MB

Download
memory/3000-2245-0x00007FF600AF0000-0x00007FF600EE6000-memory.dmp

Filesize
4.0MB

Download
memory/3000-192-0x00007FF600AF0000-0x00007FF600EE6000-memory.dmp

Filesize
4.0MB

Download
memory/3040-183-0x00007FF79C0B0000-0x00007FF79C4A6000-memory.dmp

Filesize
4.0MB

Download
memory/3040-2240-0x00007FF79C0B0000-0x00007FF79C4A6000-memory.dmp

Filesize
4.0MB

Download
memory/3944-2236-0x00007FF689C50000-0x00007FF68A046000-memory.dmp

Filesize
4.0MB

Download
memory/3944-179-0x00007FF689C50000-0x00007FF68A046000-memory.dmp

Filesize
4.0MB

Download
memory/4308-93-0x00007FF7F23D0000-0x00007FF7F27C6000-memory.dmp

Filesize
4.0MB

Download
memory/4308-2229-0x00007FF7F23D0000-0x00007FF7F27C6000-memory.dmp

Filesize
4.0MB

Download
memory/4340-188-0x00007FF6E6340000-0x00007FF6E6736000-memory.dmp

Filesize
4.0MB

Download
memory/4340-2228-0x00007FF6E6340000-0x00007FF6E6736000-memory.dmp

Filesize
4.0MB

Download
memory/4364-185-0x00007FF6AE150000-0x00007FF6AE546000-memory.dmp

Filesize
4.0MB

Download
memory/4364-2246-0x00007FF6AE150000-0x00007FF6AE546000-memory.dmp

Filesize
4.0MB

Download
memory/4376-1-0x000001ED3B960000-0x000001ED3B970000-memory.dmp

Filesize
64KB

Download
memory/4376-0-0x00007FF7F9050000-0x00007FF7F9446000-memory.dmp

Filesize
4.0MB

Download
memory/4400-87-0x00007FF7F56D0000-0x00007FF7F5AC6000-memory.dmp

Filesize
4.0MB

Download
memory/4400-2230-0x00007FF7F56D0000-0x00007FF7F5AC6000-memory.dmp

Filesize
4.0MB

Download
memory/4640-2233-0x00007FF7AFCA0000-0x00007FF7B0096000-memory.dmp

Filesize
4.0MB

Download
memory/4640-189-0x00007FF7AFCA0000-0x00007FF7B0096000-memory.dmp

Filesize
4.0MB

Download
memory/4660-74-0x00007FF66FD00000-0x00007FF6700F6000-memory.dmp

Filesize
4.0MB

Download
memory/4660-2225-0x00007FF66FD00000-0x00007FF6700F6000-memory.dmp

Filesize
4.0MB

Download
memory/4692-2227-0x00007FF60AD30000-0x00007FF60B126000-memory.dmp

Filesize
4.0MB

Download
memory/4692-160-0x00007FF60AD30000-0x00007FF60B126000-memory.dmp

Filesize
4.0MB

Download
memory/4932-59-0x00007FF69D2B0000-0x00007FF69D6A6000-memory.dmp

Filesize
4.0MB

Download
memory/4932-2224-0x00007FF69D2B0000-0x00007FF69D6A6000-memory.dmp

Filesize
4.0MB

Download
memory/5048-2238-0x00007FF758030000-0x00007FF758426000-memory.dmp

Filesize
4.0MB

Download
memory/5048-182-0x00007FF758030000-0x00007FF758426000-memory.dmp

Filesize
4.0MB

Download
memory/5080-2226-0x00007FF6C77A0000-0x00007FF6C7B96000-memory.dmp

Filesize
4.0MB

Download
memory/5080-144-0x00007FF6C77A0000-0x00007FF6C7B96000-memory.dmp

Filesize
4.0MB

Download
memory/5084-181-0x00007FF6965E0000-0x00007FF6969D6000-memory.dmp

Filesize
4.0MB

Download
memory/5084-2239-0x00007FF6965E0000-0x00007FF6969D6000-memory.dmp

Filesize
4.0MB

Download