xmrig | 3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
Size

2.0MB
MD5

32212570dc60682063620f5d4672bccc
SHA1

91c021d594c203104775269bbe01b89a9e8b573e
SHA256

3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd
SHA512

a3ee0fbbf0d6174173d85167424a8b4b20f3e49c0a30ed0cb2c56a89afb49ff95a1974210db765240f4811b9775f093d02846c09801733bbe557212e2850fd95
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SIhmHJlp/:NABI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/736-77-0x00007FF712770000-0x00007FF712B62000-memory.dmp	xmrig
behavioral2/memory/2364-122-0x00007FF7F21E0000-0x00007FF7F25D2000-memory.dmp	xmrig
behavioral2/memory/1296-163-0x00007FF74B750000-0x00007FF74BB42000-memory.dmp	xmrig
behavioral2/memory/2924-182-0x00007FF640D20000-0x00007FF641112000-memory.dmp	xmrig
behavioral2/memory/4428-176-0x00007FF78F920000-0x00007FF78FD12000-memory.dmp	xmrig
behavioral2/memory/1688-175-0x00007FF7C0AC0000-0x00007FF7C0EB2000-memory.dmp	xmrig
behavioral2/memory/4832-169-0x00007FF620BC0000-0x00007FF620FB2000-memory.dmp	xmrig
behavioral2/memory/1240-157-0x00007FF71BD80000-0x00007FF71C172000-memory.dmp	xmrig
behavioral2/memory/4928-146-0x00007FF79F0E0000-0x00007FF79F4D2000-memory.dmp	xmrig
behavioral2/memory/3872-140-0x00007FF7BE230000-0x00007FF7BE622000-memory.dmp	xmrig
behavioral2/memory/3116-134-0x00007FF6D08D0000-0x00007FF6D0CC2000-memory.dmp	xmrig
behavioral2/memory/2120-128-0x00007FF6AABA0000-0x00007FF6AAF92000-memory.dmp	xmrig
behavioral2/memory/1200-116-0x00007FF785F40000-0x00007FF786332000-memory.dmp	xmrig
behavioral2/memory/3256-110-0x00007FF6706E0000-0x00007FF670AD2000-memory.dmp	xmrig
behavioral2/memory/3180-109-0x00007FF7518A0000-0x00007FF751C92000-memory.dmp	xmrig
behavioral2/memory/676-101-0x00007FF699380000-0x00007FF699772000-memory.dmp	xmrig
behavioral2/memory/3168-93-0x00007FF66C7A0000-0x00007FF66CB92000-memory.dmp	xmrig
behavioral2/memory/1372-90-0x00007FF7FEAB0000-0x00007FF7FEEA2000-memory.dmp	xmrig
behavioral2/memory/800-82-0x00007FF6AC780000-0x00007FF6ACB72000-memory.dmp	xmrig
behavioral2/memory/3584-81-0x00007FF64B7C0000-0x00007FF64BBB2000-memory.dmp	xmrig
behavioral2/memory/2260-72-0x00007FF723380000-0x00007FF723772000-memory.dmp	xmrig
behavioral2/memory/5084-68-0x00007FF766DF0000-0x00007FF7671E2000-memory.dmp	xmrig
behavioral2/memory/4352-64-0x00007FF786690000-0x00007FF786A82000-memory.dmp	xmrig
behavioral2/memory/876-15-0x00007FF7DB440000-0x00007FF7DB832000-memory.dmp	xmrig
behavioral2/memory/876-2234-0x00007FF7DB440000-0x00007FF7DB832000-memory.dmp	xmrig
behavioral2/memory/800-2236-0x00007FF6AC780000-0x00007FF6ACB72000-memory.dmp	xmrig
behavioral2/memory/4352-2238-0x00007FF786690000-0x00007FF786A82000-memory.dmp	xmrig
behavioral2/memory/5084-2240-0x00007FF766DF0000-0x00007FF7671E2000-memory.dmp	xmrig
behavioral2/memory/736-2242-0x00007FF712770000-0x00007FF712B62000-memory.dmp	xmrig
behavioral2/memory/2260-2246-0x00007FF723380000-0x00007FF723772000-memory.dmp	xmrig
behavioral2/memory/3584-2248-0x00007FF64B7C0000-0x00007FF64BBB2000-memory.dmp	xmrig
behavioral2/memory/3168-2250-0x00007FF66C7A0000-0x00007FF66CB92000-memory.dmp	xmrig
behavioral2/memory/1372-2244-0x00007FF7FEAB0000-0x00007FF7FEEA2000-memory.dmp	xmrig
behavioral2/memory/2364-2254-0x00007FF7F21E0000-0x00007FF7F25D2000-memory.dmp	xmrig
behavioral2/memory/3116-2253-0x00007FF6D08D0000-0x00007FF6D0CC2000-memory.dmp	xmrig
behavioral2/memory/1240-2270-0x00007FF71BD80000-0x00007FF71C172000-memory.dmp	xmrig
behavioral2/memory/1296-2272-0x00007FF74B750000-0x00007FF74BB42000-memory.dmp	xmrig
behavioral2/memory/3872-2268-0x00007FF7BE230000-0x00007FF7BE622000-memory.dmp	xmrig
behavioral2/memory/4928-2266-0x00007FF79F0E0000-0x00007FF79F4D2000-memory.dmp	xmrig
behavioral2/memory/2120-2257-0x00007FF6AABA0000-0x00007FF6AAF92000-memory.dmp	xmrig
behavioral2/memory/1200-2264-0x00007FF785F40000-0x00007FF786332000-memory.dmp	xmrig
behavioral2/memory/3180-2263-0x00007FF7518A0000-0x00007FF751C92000-memory.dmp	xmrig
behavioral2/memory/3256-2261-0x00007FF6706E0000-0x00007FF670AD2000-memory.dmp	xmrig
behavioral2/memory/676-2259-0x00007FF699380000-0x00007FF699772000-memory.dmp	xmrig
behavioral2/memory/1688-2280-0x00007FF7C0AC0000-0x00007FF7C0EB2000-memory.dmp	xmrig
behavioral2/memory/4832-2279-0x00007FF620BC0000-0x00007FF620FB2000-memory.dmp	xmrig
behavioral2/memory/4428-2276-0x00007FF78F920000-0x00007FF78FD12000-memory.dmp	xmrig
behavioral2/memory/2924-2275-0x00007FF640D20000-0x00007FF641112000-memory.dmp	xmrig

Blocklisted process makes network request 10 IoCs

flow	pid	Process
9	1376	powershell.exe
11	1376	powershell.exe
26	1376	powershell.exe
27	1376	powershell.exe
28	1376	powershell.exe
30	1376	powershell.exe
31	1376	powershell.exe
32	1376	powershell.exe
33	1376	powershell.exe
34	1376	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1376	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
876	WGZYTId.exe
800	hFfRcwX.exe
4352	yFgFQJT.exe
5084	RmjUOQt.exe
1372	AGArPQd.exe
2260	oOgLyju.exe
736	phUjadi.exe
3584	AmmBfEA.exe
3168	HEGLTxx.exe
676	LNXmnSc.exe
3180	rAaxFWN.exe
3256	bphhXHA.exe
1200	CjxpwVA.exe
2120	rABRgYE.exe
2364	XLqFrDE.exe
3116	SjHPgvJ.exe
3872	vpbhrmt.exe
4928	oVASdFK.exe
1240	XSYqTgd.exe
1296	yEPQigx.exe
4832	GGGqybj.exe
1688	yLmXcGi.exe
4428	DDEDarX.exe
2924	RvrUhou.exe
856	YyTGoAj.exe
3160	IouCMhU.exe
392	LEazopR.exe
316	HlzhOqt.exe
4416	RVqgeDy.exe
1192	QmGzSuT.exe
756	QHjmNjh.exe
4488	njkKuqk.exe
1844	TRUkwSX.exe
3908	IgDknlF.exe
3236	MRBIfKS.exe
3560	IJUIiKz.exe
3528	FRlpQtr.exe
2740	nEOBqzh.exe
464	rvNLTMw.exe
3212	fITFAlj.exe
2612	haCcIOO.exe
3060	bwSTkln.exe
632	hsjZOVL.exe
3676	WAYgsBG.exe
3808	ToeNoWp.exe
2300	AlRDizb.exe
4976	PDONWry.exe
4448	GLgZYqH.exe
4424	aTfuNCH.exe
220	Zsbntle.exe
1056	UmFgVwH.exe
4624	nXeJxeg.exe
1784	uyQJrBk.exe
3748	GcBaiAx.exe
1216	hiRREZT.exe
4664	iIrzUbz.exe
3680	gjlXMPc.exe
1484	ikIYsse.exe
3660	bliTUgZ.exe
3896	TWYotZS.exe
1472	ktOzYmt.exe
4464	MjmeBok.exe
2452	iHlviyv.exe
4768	uBKCxXq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2168-0-0x00007FF7497E0000-0x00007FF749BD2000-memory.dmp	upx
behavioral2/files/0x000a0000000233e5-5.dat	upx
behavioral2/files/0x00070000000233ee-9.dat	upx
behavioral2/files/0x00070000000233ed-10.dat	upx
behavioral2/files/0x00070000000233ef-19.dat	upx
behavioral2/files/0x00070000000233f3-38.dat	upx
behavioral2/files/0x00070000000233f4-57.dat	upx
behavioral2/files/0x00070000000233f5-67.dat	upx
behavioral2/files/0x00070000000233f8-69.dat	upx
behavioral2/memory/736-77-0x00007FF712770000-0x00007FF712B62000-memory.dmp	upx
behavioral2/files/0x00090000000233ea-104.dat	upx
behavioral2/memory/2364-122-0x00007FF7F21E0000-0x00007FF7F25D2000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-131.dat	upx
behavioral2/files/0x0007000000023401-143.dat	upx
behavioral2/memory/1296-163-0x00007FF74B750000-0x00007FF74BB42000-memory.dmp	upx
behavioral2/files/0x0007000000023408-193.dat	upx
behavioral2/files/0x000700000002340b-200.dat	upx
behavioral2/files/0x0007000000023409-198.dat	upx
behavioral2/files/0x000700000002340a-195.dat	upx
behavioral2/files/0x0007000000023407-188.dat	upx
behavioral2/files/0x0007000000023406-183.dat	upx
behavioral2/memory/2924-182-0x00007FF640D20000-0x00007FF641112000-memory.dmp	upx
behavioral2/files/0x0007000000023405-177.dat	upx
behavioral2/memory/4428-176-0x00007FF78F920000-0x00007FF78FD12000-memory.dmp	upx
behavioral2/memory/1688-175-0x00007FF7C0AC0000-0x00007FF7C0EB2000-memory.dmp	upx
behavioral2/files/0x0007000000023404-170.dat	upx
behavioral2/memory/4832-169-0x00007FF620BC0000-0x00007FF620FB2000-memory.dmp	upx
behavioral2/files/0x0007000000023403-164.dat	upx
behavioral2/files/0x0007000000023402-158.dat	upx
behavioral2/memory/1240-157-0x00007FF71BD80000-0x00007FF71C172000-memory.dmp	upx
behavioral2/files/0x0007000000023400-147.dat	upx
behavioral2/memory/4928-146-0x00007FF79F0E0000-0x00007FF79F4D2000-memory.dmp	upx
behavioral2/memory/3872-140-0x00007FF7BE230000-0x00007FF7BE622000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-135.dat	upx
behavioral2/memory/3116-134-0x00007FF6D08D0000-0x00007FF6D0CC2000-memory.dmp	upx
behavioral2/files/0x00070000000233fd-129.dat	upx
behavioral2/memory/2120-128-0x00007FF6AABA0000-0x00007FF6AAF92000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-123.dat	upx
behavioral2/files/0x00070000000233fb-117.dat	upx
behavioral2/memory/1200-116-0x00007FF785F40000-0x00007FF786332000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-111.dat	upx
behavioral2/memory/3256-110-0x00007FF6706E0000-0x00007FF670AD2000-memory.dmp	upx
behavioral2/memory/3180-109-0x00007FF7518A0000-0x00007FF751C92000-memory.dmp	upx
behavioral2/files/0x00080000000233f6-102.dat	upx
behavioral2/memory/676-101-0x00007FF699380000-0x00007FF699772000-memory.dmp	upx
behavioral2/memory/3168-93-0x00007FF66C7A0000-0x00007FF66CB92000-memory.dmp	upx
behavioral2/memory/1372-90-0x00007FF7FEAB0000-0x00007FF7FEEA2000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-87.dat	upx
behavioral2/files/0x00080000000233f7-85.dat	upx
behavioral2/memory/800-82-0x00007FF6AC780000-0x00007FF6ACB72000-memory.dmp	upx
behavioral2/memory/3584-81-0x00007FF64B7C0000-0x00007FF64BBB2000-memory.dmp	upx
behavioral2/memory/2260-72-0x00007FF723380000-0x00007FF723772000-memory.dmp	upx
behavioral2/memory/5084-68-0x00007FF766DF0000-0x00007FF7671E2000-memory.dmp	upx
behavioral2/memory/4352-64-0x00007FF786690000-0x00007FF786A82000-memory.dmp	upx
behavioral2/files/0x00070000000233f2-44.dat	upx
behavioral2/files/0x00070000000233f0-39.dat	upx
behavioral2/files/0x00070000000233f1-31.dat	upx
behavioral2/memory/876-15-0x00007FF7DB440000-0x00007FF7DB832000-memory.dmp	upx
behavioral2/memory/876-2234-0x00007FF7DB440000-0x00007FF7DB832000-memory.dmp	upx
behavioral2/memory/800-2236-0x00007FF6AC780000-0x00007FF6ACB72000-memory.dmp	upx
behavioral2/memory/4352-2238-0x00007FF786690000-0x00007FF786A82000-memory.dmp	upx
behavioral2/memory/5084-2240-0x00007FF766DF0000-0x00007FF7671E2000-memory.dmp	upx
behavioral2/memory/736-2242-0x00007FF712770000-0x00007FF712B62000-memory.dmp	upx
behavioral2/memory/2260-2246-0x00007FF723380000-0x00007FF723772000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QmTpAzt.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\MvQfjoo.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\lFfOjtq.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\kTqhtXS.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\EVUgsec.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\XDCvOLJ.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\SGgwrXg.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\DXXvBja.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\xqMHmtJ.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\vwXgRvl.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\kwWrFqB.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\IVIBRWG.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\MAyrfyv.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\cKtoDrW.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\bMuISbL.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\BWIemYR.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\OfnPUjU.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\DZofUmS.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\MKlIlEP.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\jexBSbD.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\uelRbof.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\nZAkESB.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\sKivuAW.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\lJAgumk.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\yEPQigx.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\IgDknlF.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\vwWnLtu.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\ZZnhEUm.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\BlUAyyh.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\iOcYzcz.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\mebRgnC.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\dNOrFae.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\HRRAvII.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\LBBavWG.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\PMsZgcf.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\JdddhxQ.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\ADdzSfG.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\OXxuPIK.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\itlmvhr.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\WZagrli.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\PkcbLjc.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\oLmZNYh.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\tnKWfPJ.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\YgeyNED.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\PorpgXW.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\LXgPzOt.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\yAnLZhk.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\DSrveXh.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\MvQmNYV.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\mzGpQuH.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\EtRtpOw.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\MHzTDzx.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\tLTTraJ.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\EKKwotp.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\LXtbiHi.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\kyLeiTx.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\ubOTMlc.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\cAUxtNF.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\GCVaRJV.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\jLkZrVx.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\oOgLyju.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\SrDTDaX.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\GLgZYqH.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
File created	C:\Windows\System\zwWDlsY.exe	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1376	powershell.exe
1376	powershell.exe
1376	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeLockMemoryPrivilege	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
Token: SeLockMemoryPrivilege	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1376	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	82
PID 2168 wrote to memory of 1376	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	82
PID 2168 wrote to memory of 876	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	83
PID 2168 wrote to memory of 876	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	83
PID 2168 wrote to memory of 800	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	84
PID 2168 wrote to memory of 800	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	84
PID 2168 wrote to memory of 4352	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	85
PID 2168 wrote to memory of 4352	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	85
PID 2168 wrote to memory of 5084	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	86
PID 2168 wrote to memory of 5084	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	86
PID 2168 wrote to memory of 1372	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	87
PID 2168 wrote to memory of 1372	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	87
PID 2168 wrote to memory of 2260	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	88
PID 2168 wrote to memory of 2260	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	88
PID 2168 wrote to memory of 736	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	89
PID 2168 wrote to memory of 736	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	89
PID 2168 wrote to memory of 3584	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	90
PID 2168 wrote to memory of 3584	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	90
PID 2168 wrote to memory of 3168	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	91
PID 2168 wrote to memory of 3168	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	91
PID 2168 wrote to memory of 676	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	92
PID 2168 wrote to memory of 676	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	92
PID 2168 wrote to memory of 3180	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	93
PID 2168 wrote to memory of 3180	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	93
PID 2168 wrote to memory of 3256	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	94
PID 2168 wrote to memory of 3256	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	94
PID 2168 wrote to memory of 1200	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	95
PID 2168 wrote to memory of 1200	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	95
PID 2168 wrote to memory of 2120	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	96
PID 2168 wrote to memory of 2120	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	96
PID 2168 wrote to memory of 2364	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	97
PID 2168 wrote to memory of 2364	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	97
PID 2168 wrote to memory of 3116	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	98
PID 2168 wrote to memory of 3116	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	98
PID 2168 wrote to memory of 3872	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	99
PID 2168 wrote to memory of 3872	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	99
PID 2168 wrote to memory of 4928	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	100
PID 2168 wrote to memory of 4928	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	100
PID 2168 wrote to memory of 1240	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	101
PID 2168 wrote to memory of 1240	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	101
PID 2168 wrote to memory of 1296	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	102
PID 2168 wrote to memory of 1296	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	102
PID 2168 wrote to memory of 4832	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	103
PID 2168 wrote to memory of 4832	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	103
PID 2168 wrote to memory of 1688	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	104
PID 2168 wrote to memory of 1688	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	104
PID 2168 wrote to memory of 4428	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	105
PID 2168 wrote to memory of 4428	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	105
PID 2168 wrote to memory of 2924	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	106
PID 2168 wrote to memory of 2924	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	106
PID 2168 wrote to memory of 856	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	107
PID 2168 wrote to memory of 856	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	107
PID 2168 wrote to memory of 3160	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	108
PID 2168 wrote to memory of 3160	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	108
PID 2168 wrote to memory of 392	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	109
PID 2168 wrote to memory of 392	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	109
PID 2168 wrote to memory of 316	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	110
PID 2168 wrote to memory of 316	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	110
PID 2168 wrote to memory of 4416	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	111
PID 2168 wrote to memory of 4416	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	111
PID 2168 wrote to memory of 1192	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	112
PID 2168 wrote to memory of 1192	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	112
PID 2168 wrote to memory of 756	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	113
PID 2168 wrote to memory of 756	2168	3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe	113

C:\Users\Admin\AppData\Local\Temp\3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe
"C:\Users\Admin\AppData\Local\Temp\3e6ad3e0120a9b8881884abd51f2241a17a004deb38a8e734a6972a6bc9bfafd.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\System\WGZYTId.exe
  C:\Windows\System\WGZYTId.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\hFfRcwX.exe
  C:\Windows\System\hFfRcwX.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\yFgFQJT.exe
  C:\Windows\System\yFgFQJT.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\RmjUOQt.exe
  C:\Windows\System\RmjUOQt.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\AGArPQd.exe
  C:\Windows\System\AGArPQd.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\oOgLyju.exe
  C:\Windows\System\oOgLyju.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\phUjadi.exe
  C:\Windows\System\phUjadi.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\AmmBfEA.exe
  C:\Windows\System\AmmBfEA.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\HEGLTxx.exe
  C:\Windows\System\HEGLTxx.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\LNXmnSc.exe
  C:\Windows\System\LNXmnSc.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\rAaxFWN.exe
  C:\Windows\System\rAaxFWN.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\bphhXHA.exe
  C:\Windows\System\bphhXHA.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\CjxpwVA.exe
  C:\Windows\System\CjxpwVA.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\rABRgYE.exe
  C:\Windows\System\rABRgYE.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\XLqFrDE.exe
  C:\Windows\System\XLqFrDE.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\SjHPgvJ.exe
  C:\Windows\System\SjHPgvJ.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\vpbhrmt.exe
  C:\Windows\System\vpbhrmt.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\oVASdFK.exe
  C:\Windows\System\oVASdFK.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\XSYqTgd.exe
  C:\Windows\System\XSYqTgd.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\yEPQigx.exe
  C:\Windows\System\yEPQigx.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\GGGqybj.exe
  C:\Windows\System\GGGqybj.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\yLmXcGi.exe
  C:\Windows\System\yLmXcGi.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\DDEDarX.exe
  C:\Windows\System\DDEDarX.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\RvrUhou.exe
  C:\Windows\System\RvrUhou.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\YyTGoAj.exe
  C:\Windows\System\YyTGoAj.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\IouCMhU.exe
  C:\Windows\System\IouCMhU.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\LEazopR.exe
  C:\Windows\System\LEazopR.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\HlzhOqt.exe
  C:\Windows\System\HlzhOqt.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\RVqgeDy.exe
  C:\Windows\System\RVqgeDy.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\QmGzSuT.exe
  C:\Windows\System\QmGzSuT.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\QHjmNjh.exe
  C:\Windows\System\QHjmNjh.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\njkKuqk.exe
  C:\Windows\System\njkKuqk.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\TRUkwSX.exe
  C:\Windows\System\TRUkwSX.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\IgDknlF.exe
  C:\Windows\System\IgDknlF.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\MRBIfKS.exe
  C:\Windows\System\MRBIfKS.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\IJUIiKz.exe
  C:\Windows\System\IJUIiKz.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\FRlpQtr.exe
  C:\Windows\System\FRlpQtr.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\nEOBqzh.exe
  C:\Windows\System\nEOBqzh.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\rvNLTMw.exe
  C:\Windows\System\rvNLTMw.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\fITFAlj.exe
  C:\Windows\System\fITFAlj.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\haCcIOO.exe
  C:\Windows\System\haCcIOO.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\bwSTkln.exe
  C:\Windows\System\bwSTkln.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\hsjZOVL.exe
  C:\Windows\System\hsjZOVL.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\WAYgsBG.exe
  C:\Windows\System\WAYgsBG.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\ToeNoWp.exe
  C:\Windows\System\ToeNoWp.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\AlRDizb.exe
  C:\Windows\System\AlRDizb.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\PDONWry.exe
  C:\Windows\System\PDONWry.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\GLgZYqH.exe
  C:\Windows\System\GLgZYqH.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\aTfuNCH.exe
  C:\Windows\System\aTfuNCH.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\Zsbntle.exe
  C:\Windows\System\Zsbntle.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\UmFgVwH.exe
  C:\Windows\System\UmFgVwH.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\nXeJxeg.exe
  C:\Windows\System\nXeJxeg.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\uyQJrBk.exe
  C:\Windows\System\uyQJrBk.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\GcBaiAx.exe
  C:\Windows\System\GcBaiAx.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\hiRREZT.exe
  C:\Windows\System\hiRREZT.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\iIrzUbz.exe
  C:\Windows\System\iIrzUbz.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\gjlXMPc.exe
  C:\Windows\System\gjlXMPc.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\ikIYsse.exe
  C:\Windows\System\ikIYsse.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\bliTUgZ.exe
  C:\Windows\System\bliTUgZ.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\TWYotZS.exe
  C:\Windows\System\TWYotZS.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\ktOzYmt.exe
  C:\Windows\System\ktOzYmt.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\MjmeBok.exe
  C:\Windows\System\MjmeBok.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\iHlviyv.exe
  C:\Windows\System\iHlviyv.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\uBKCxXq.exe
  C:\Windows\System\uBKCxXq.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\lgDnJSJ.exe
  C:\Windows\System\lgDnJSJ.exe
  2⤵
  PID:3028
- C:\Windows\System\QnfMXYP.exe
  C:\Windows\System\QnfMXYP.exe
  2⤵
  PID:2856
- C:\Windows\System\fgNDfEl.exe
  C:\Windows\System\fgNDfEl.exe
  2⤵
  PID:3736
- C:\Windows\System\nQEqPnt.exe
  C:\Windows\System\nQEqPnt.exe
  2⤵
  PID:2324
- C:\Windows\System\tpUmxSA.exe
  C:\Windows\System\tpUmxSA.exe
  2⤵
  PID:820
- C:\Windows\System\RZkJIhb.exe
  C:\Windows\System\RZkJIhb.exe
  2⤵
  PID:2180
- C:\Windows\System\xJABkEw.exe
  C:\Windows\System\xJABkEw.exe
  2⤵
  PID:2136
- C:\Windows\System\wAttgls.exe
  C:\Windows\System\wAttgls.exe
  2⤵
  PID:2504
- C:\Windows\System\MljxKjX.exe
  C:\Windows\System\MljxKjX.exe
  2⤵
  PID:2572
- C:\Windows\System\czkzHWf.exe
  C:\Windows\System\czkzHWf.exe
  2⤵
  PID:3372
- C:\Windows\System\LeqwDPE.exe
  C:\Windows\System\LeqwDPE.exe
  2⤵
  PID:3456
- C:\Windows\System\MeOVQBb.exe
  C:\Windows\System\MeOVQBb.exe
  2⤵
  PID:1088
- C:\Windows\System\pAijgIm.exe
  C:\Windows\System\pAijgIm.exe
  2⤵
  PID:4200
- C:\Windows\System\tjypOVO.exe
  C:\Windows\System\tjypOVO.exe
  2⤵
  PID:3564
- C:\Windows\System\mebRgnC.exe
  C:\Windows\System\mebRgnC.exe
  2⤵
  PID:3228
- C:\Windows\System\guqleMT.exe
  C:\Windows\System\guqleMT.exe
  2⤵
  PID:4476
- C:\Windows\System\LXtbiHi.exe
  C:\Windows\System\LXtbiHi.exe
  2⤵
  PID:5148
- C:\Windows\System\kjEUVIT.exe
  C:\Windows\System\kjEUVIT.exe
  2⤵
  PID:5176
- C:\Windows\System\rrrpujX.exe
  C:\Windows\System\rrrpujX.exe
  2⤵
  PID:5204
- C:\Windows\System\LQOqfNk.exe
  C:\Windows\System\LQOqfNk.exe
  2⤵
  PID:5236
- C:\Windows\System\HTNmaCm.exe
  C:\Windows\System\HTNmaCm.exe
  2⤵
  PID:5260
- C:\Windows\System\UfiAPwZ.exe
  C:\Windows\System\UfiAPwZ.exe
  2⤵
  PID:5292
- C:\Windows\System\JaqSvvz.exe
  C:\Windows\System\JaqSvvz.exe
  2⤵
  PID:5316
- C:\Windows\System\PVqmEfz.exe
  C:\Windows\System\PVqmEfz.exe
  2⤵
  PID:5344
- C:\Windows\System\jexBSbD.exe
  C:\Windows\System\jexBSbD.exe
  2⤵
  PID:5376
- C:\Windows\System\DepBTHq.exe
  C:\Windows\System\DepBTHq.exe
  2⤵
  PID:5404
- C:\Windows\System\NvzBVFu.exe
  C:\Windows\System\NvzBVFu.exe
  2⤵
  PID:5432
- C:\Windows\System\BYJmllV.exe
  C:\Windows\System\BYJmllV.exe
  2⤵
  PID:5456
- C:\Windows\System\uqnctYN.exe
  C:\Windows\System\uqnctYN.exe
  2⤵
  PID:5488
- C:\Windows\System\PHZDjID.exe
  C:\Windows\System\PHZDjID.exe
  2⤵
  PID:5516
- C:\Windows\System\czByMvX.exe
  C:\Windows\System\czByMvX.exe
  2⤵
  PID:5544
- C:\Windows\System\QJLphdj.exe
  C:\Windows\System\QJLphdj.exe
  2⤵
  PID:5572
- C:\Windows\System\XHNQzxr.exe
  C:\Windows\System\XHNQzxr.exe
  2⤵
  PID:5604
- C:\Windows\System\skyWTAt.exe
  C:\Windows\System\skyWTAt.exe
  2⤵
  PID:5628
- C:\Windows\System\ZuxIADZ.exe
  C:\Windows\System\ZuxIADZ.exe
  2⤵
  PID:5656
- C:\Windows\System\mXXydPm.exe
  C:\Windows\System\mXXydPm.exe
  2⤵
  PID:5684
- C:\Windows\System\Evhgqnz.exe
  C:\Windows\System\Evhgqnz.exe
  2⤵
  PID:5712
- C:\Windows\System\gAwzhTq.exe
  C:\Windows\System\gAwzhTq.exe
  2⤵
  PID:5740
- C:\Windows\System\JDeBEKr.exe
  C:\Windows\System\JDeBEKr.exe
  2⤵
  PID:5768
- C:\Windows\System\QcIwLAn.exe
  C:\Windows\System\QcIwLAn.exe
  2⤵
  PID:5796
- C:\Windows\System\kyLeiTx.exe
  C:\Windows\System\kyLeiTx.exe
  2⤵
  PID:5824
- C:\Windows\System\KpcskFJ.exe
  C:\Windows\System\KpcskFJ.exe
  2⤵
  PID:5852
- C:\Windows\System\TWXkgaw.exe
  C:\Windows\System\TWXkgaw.exe
  2⤵
  PID:5880
- C:\Windows\System\pctTzjG.exe
  C:\Windows\System\pctTzjG.exe
  2⤵
  PID:5908
- C:\Windows\System\HyKZqnP.exe
  C:\Windows\System\HyKZqnP.exe
  2⤵
  PID:5936
- C:\Windows\System\bWLibjO.exe
  C:\Windows\System\bWLibjO.exe
  2⤵
  PID:5960
- C:\Windows\System\yrCWhMj.exe
  C:\Windows\System\yrCWhMj.exe
  2⤵
  PID:5992
- C:\Windows\System\XiEMWIg.exe
  C:\Windows\System\XiEMWIg.exe
  2⤵
  PID:6020
- C:\Windows\System\XuExmFT.exe
  C:\Windows\System\XuExmFT.exe
  2⤵
  PID:6048
- C:\Windows\System\SrDTDaX.exe
  C:\Windows\System\SrDTDaX.exe
  2⤵
  PID:6068
- C:\Windows\System\kwTgGuV.exe
  C:\Windows\System\kwTgGuV.exe
  2⤵
  PID:6104
- C:\Windows\System\MkLJfpe.exe
  C:\Windows\System\MkLJfpe.exe
  2⤵
  PID:6132
- C:\Windows\System\NjoxeAJ.exe
  C:\Windows\System\NjoxeAJ.exe
  2⤵
  PID:1860
- C:\Windows\System\EVTfOYH.exe
  C:\Windows\System\EVTfOYH.exe
  2⤵
  PID:3172
- C:\Windows\System\hAXLjAA.exe
  C:\Windows\System\hAXLjAA.exe
  2⤵
  PID:3536
- C:\Windows\System\kwdjlBo.exe
  C:\Windows\System\kwdjlBo.exe
  2⤵
  PID:4888
- C:\Windows\System\pxIEwgh.exe
  C:\Windows\System\pxIEwgh.exe
  2⤵
  PID:228
- C:\Windows\System\kKozLjy.exe
  C:\Windows\System\kKozLjy.exe
  2⤵
  PID:5188
- C:\Windows\System\cAUxtNF.exe
  C:\Windows\System\cAUxtNF.exe
  2⤵
  PID:5252
- C:\Windows\System\wwHMrwI.exe
  C:\Windows\System\wwHMrwI.exe
  2⤵
  PID:5308
- C:\Windows\System\xPaBYmY.exe
  C:\Windows\System\xPaBYmY.exe
  2⤵
  PID:5368
- C:\Windows\System\lnlJEWd.exe
  C:\Windows\System\lnlJEWd.exe
  2⤵
  PID:5424
- C:\Windows\System\GEYoeUo.exe
  C:\Windows\System\GEYoeUo.exe
  2⤵
  PID:5500
- C:\Windows\System\mzGpQuH.exe
  C:\Windows\System\mzGpQuH.exe
  2⤵
  PID:5556
- C:\Windows\System\lupUVPV.exe
  C:\Windows\System\lupUVPV.exe
  2⤵
  PID:4288
- C:\Windows\System\hIBIdOc.exe
  C:\Windows\System\hIBIdOc.exe
  2⤵
  PID:5672
- C:\Windows\System\haISCXY.exe
  C:\Windows\System\haISCXY.exe
  2⤵
  PID:5728
- C:\Windows\System\JTBNaKD.exe
  C:\Windows\System\JTBNaKD.exe
  2⤵
  PID:5808
- C:\Windows\System\HaWtrkW.exe
  C:\Windows\System\HaWtrkW.exe
  2⤵
  PID:5864
- C:\Windows\System\SGgwrXg.exe
  C:\Windows\System\SGgwrXg.exe
  2⤵
  PID:3096
- C:\Windows\System\cvWenWd.exe
  C:\Windows\System\cvWenWd.exe
  2⤵
  PID:5976
- C:\Windows\System\CpOlVbM.exe
  C:\Windows\System\CpOlVbM.exe
  2⤵
  PID:6040
- C:\Windows\System\MwEewvM.exe
  C:\Windows\System\MwEewvM.exe
  2⤵
  PID:6092
- C:\Windows\System\OXgzPCk.exe
  C:\Windows\System\OXgzPCk.exe
  2⤵
  PID:6128
- C:\Windows\System\kggLtJs.exe
  C:\Windows\System\kggLtJs.exe
  2⤵
  PID:4900
- C:\Windows\System\odHzunk.exe
  C:\Windows\System\odHzunk.exe
  2⤵
  PID:3992
- C:\Windows\System\lfVFtgF.exe
  C:\Windows\System\lfVFtgF.exe
  2⤵
  PID:2332
- C:\Windows\System\WvUvelv.exe
  C:\Windows\System\WvUvelv.exe
  2⤵
  PID:5284
- C:\Windows\System\cKtoDrW.exe
  C:\Windows\System\cKtoDrW.exe
  2⤵
  PID:5644
- C:\Windows\System\jZIsoiu.exe
  C:\Windows\System\jZIsoiu.exe
  2⤵
  PID:5760
- C:\Windows\System\knUsMYG.exe
  C:\Windows\System\knUsMYG.exe
  2⤵
  PID:5836
- C:\Windows\System\ecgiRYZ.exe
  C:\Windows\System\ecgiRYZ.exe
  2⤵
  PID:5956
- C:\Windows\System\UnRjJkp.exe
  C:\Windows\System\UnRjJkp.exe
  2⤵
  PID:620
- C:\Windows\System\bqpfppJ.exe
  C:\Windows\System\bqpfppJ.exe
  2⤵
  PID:3332
- C:\Windows\System\mLTSlKt.exe
  C:\Windows\System\mLTSlKt.exe
  2⤵
  PID:4568
- C:\Windows\System\OxGbglK.exe
  C:\Windows\System\OxGbglK.exe
  2⤵
  PID:3104
- C:\Windows\System\yWcQFhW.exe
  C:\Windows\System\yWcQFhW.exe
  2⤵
  PID:3196
- C:\Windows\System\SGsZzHx.exe
  C:\Windows\System\SGsZzHx.exe
  2⤵
  PID:5612
- C:\Windows\System\FUwKyot.exe
  C:\Windows\System\FUwKyot.exe
  2⤵
  PID:1656
- C:\Windows\System\YnSRKrp.exe
  C:\Windows\System\YnSRKrp.exe
  2⤵
  PID:4324
- C:\Windows\System\ctiCCfU.exe
  C:\Windows\System\ctiCCfU.exe
  2⤵
  PID:1636
- C:\Windows\System\jpMxCDT.exe
  C:\Windows\System\jpMxCDT.exe
  2⤵
  PID:2888
- C:\Windows\System\bVTkPjR.exe
  C:\Windows\System\bVTkPjR.exe
  2⤵
  PID:5784
- C:\Windows\System\ehIJVJt.exe
  C:\Windows\System\ehIJVJt.exe
  2⤵
  PID:5948
- C:\Windows\System\wlPEUzo.exe
  C:\Windows\System\wlPEUzo.exe
  2⤵
  PID:1800
- C:\Windows\System\oWIBsAe.exe
  C:\Windows\System\oWIBsAe.exe
  2⤵
  PID:3864
- C:\Windows\System\WSZSYwS.exe
  C:\Windows\System\WSZSYwS.exe
  2⤵
  PID:1392
- C:\Windows\System\SuUAfAX.exe
  C:\Windows\System\SuUAfAX.exe
  2⤵
  PID:4656
- C:\Windows\System\QuXhBZU.exe
  C:\Windows\System\QuXhBZU.exe
  2⤵
  PID:2304
- C:\Windows\System\UXPTpHI.exe
  C:\Windows\System\UXPTpHI.exe
  2⤵
  PID:5724
- C:\Windows\System\RkInIap.exe
  C:\Windows\System\RkInIap.exe
  2⤵
  PID:5280
- C:\Windows\System\dNOrFae.exe
  C:\Windows\System\dNOrFae.exe
  2⤵
  PID:1036
- C:\Windows\System\jrrlqYK.exe
  C:\Windows\System\jrrlqYK.exe
  2⤵
  PID:3932
- C:\Windows\System\LnhKegg.exe
  C:\Windows\System\LnhKegg.exe
  2⤵
  PID:6012
- C:\Windows\System\WoJVODX.exe
  C:\Windows\System\WoJVODX.exe
  2⤵
  PID:6164
- C:\Windows\System\nFhNLaz.exe
  C:\Windows\System\nFhNLaz.exe
  2⤵
  PID:6184
- C:\Windows\System\bfPiWhz.exe
  C:\Windows\System\bfPiWhz.exe
  2⤵
  PID:6212
- C:\Windows\System\vpjNAsE.exe
  C:\Windows\System\vpjNAsE.exe
  2⤵
  PID:6232
- C:\Windows\System\obtCIiG.exe
  C:\Windows\System\obtCIiG.exe
  2⤵
  PID:6280
- C:\Windows\System\ShtPafo.exe
  C:\Windows\System\ShtPafo.exe
  2⤵
  PID:6304
- C:\Windows\System\FQuOYeq.exe
  C:\Windows\System\FQuOYeq.exe
  2⤵
  PID:6344
- C:\Windows\System\IUDijWS.exe
  C:\Windows\System\IUDijWS.exe
  2⤵
  PID:6368
- C:\Windows\System\bXFrUwL.exe
  C:\Windows\System\bXFrUwL.exe
  2⤵
  PID:6396
- C:\Windows\System\tdOvdgG.exe
  C:\Windows\System\tdOvdgG.exe
  2⤵
  PID:6424
- C:\Windows\System\uelRbof.exe
  C:\Windows\System\uelRbof.exe
  2⤵
  PID:6452
- C:\Windows\System\ADdzSfG.exe
  C:\Windows\System\ADdzSfG.exe
  2⤵
  PID:6480
- C:\Windows\System\zXjNVFW.exe
  C:\Windows\System\zXjNVFW.exe
  2⤵
  PID:6500
- C:\Windows\System\iPKbgzb.exe
  C:\Windows\System\iPKbgzb.exe
  2⤵
  PID:6520
- C:\Windows\System\UiOQkuw.exe
  C:\Windows\System\UiOQkuw.exe
  2⤵
  PID:6548
- C:\Windows\System\wPXLxnu.exe
  C:\Windows\System\wPXLxnu.exe
  2⤵
  PID:6572
- C:\Windows\System\FlOsvxw.exe
  C:\Windows\System\FlOsvxw.exe
  2⤵
  PID:6616
- C:\Windows\System\DXXvBja.exe
  C:\Windows\System\DXXvBja.exe
  2⤵
  PID:6644
- C:\Windows\System\aytCqnh.exe
  C:\Windows\System\aytCqnh.exe
  2⤵
  PID:6660
- C:\Windows\System\goaSaiM.exe
  C:\Windows\System\goaSaiM.exe
  2⤵
  PID:6680
- C:\Windows\System\gwifYDo.exe
  C:\Windows\System\gwifYDo.exe
  2⤵
  PID:6704
- C:\Windows\System\qbsLBmc.exe
  C:\Windows\System\qbsLBmc.exe
  2⤵
  PID:6724
- C:\Windows\System\uaVfjRQ.exe
  C:\Windows\System\uaVfjRQ.exe
  2⤵
  PID:6744
- C:\Windows\System\golFHqt.exe
  C:\Windows\System\golFHqt.exe
  2⤵
  PID:6792
- C:\Windows\System\nOdzvjX.exe
  C:\Windows\System\nOdzvjX.exe
  2⤵
  PID:6816
- C:\Windows\System\HwTUGgh.exe
  C:\Windows\System\HwTUGgh.exe
  2⤵
  PID:6868
- C:\Windows\System\IgWkssk.exe
  C:\Windows\System\IgWkssk.exe
  2⤵
  PID:6892
- C:\Windows\System\KXvnvfQ.exe
  C:\Windows\System\KXvnvfQ.exe
  2⤵
  PID:6916
- C:\Windows\System\LXegdcO.exe
  C:\Windows\System\LXegdcO.exe
  2⤵
  PID:6952
- C:\Windows\System\PMsZgcf.exe
  C:\Windows\System\PMsZgcf.exe
  2⤵
  PID:6972
- C:\Windows\System\QmTpAzt.exe
  C:\Windows\System\QmTpAzt.exe
  2⤵
  PID:7016
- C:\Windows\System\GCVaRJV.exe
  C:\Windows\System\GCVaRJV.exe
  2⤵
  PID:7036
- C:\Windows\System\tligSjj.exe
  C:\Windows\System\tligSjj.exe
  2⤵
  PID:7052
- C:\Windows\System\eDOsaAQ.exe
  C:\Windows\System\eDOsaAQ.exe
  2⤵
  PID:7092
- C:\Windows\System\KRAmPlc.exe
  C:\Windows\System\KRAmPlc.exe
  2⤵
  PID:7112
- C:\Windows\System\MJycZPb.exe
  C:\Windows\System\MJycZPb.exe
  2⤵
  PID:7136
- C:\Windows\System\XecTkxY.exe
  C:\Windows\System\XecTkxY.exe
  2⤵
  PID:4144
- C:\Windows\System\vwWnLtu.exe
  C:\Windows\System\vwWnLtu.exe
  2⤵
  PID:6192
- C:\Windows\System\XsAMcJh.exe
  C:\Windows\System\XsAMcJh.exe
  2⤵
  PID:6228
- C:\Windows\System\zLkzhRO.exe
  C:\Windows\System\zLkzhRO.exe
  2⤵
  PID:6336
- C:\Windows\System\jYjSvMh.exe
  C:\Windows\System\jYjSvMh.exe
  2⤵
  PID:6404
- C:\Windows\System\ivNcIJY.exe
  C:\Windows\System\ivNcIJY.exe
  2⤵
  PID:6488
- C:\Windows\System\DCCWXNo.exe
  C:\Windows\System\DCCWXNo.exe
  2⤵
  PID:6516
- C:\Windows\System\XqhflJR.exe
  C:\Windows\System\XqhflJR.exe
  2⤵
  PID:6588
- C:\Windows\System\iLTqHmB.exe
  C:\Windows\System\iLTqHmB.exe
  2⤵
  PID:6640
- C:\Windows\System\YUHYCSS.exe
  C:\Windows\System\YUHYCSS.exe
  2⤵
  PID:6676
- C:\Windows\System\HMLPwrH.exe
  C:\Windows\System\HMLPwrH.exe
  2⤵
  PID:6716
- C:\Windows\System\bCVHREb.exe
  C:\Windows\System\bCVHREb.exe
  2⤵
  PID:6784
- C:\Windows\System\jaXdTJu.exe
  C:\Windows\System\jaXdTJu.exe
  2⤵
  PID:1348
- C:\Windows\System\KQSlMgw.exe
  C:\Windows\System\KQSlMgw.exe
  2⤵
  PID:6984
- C:\Windows\System\tzBETaP.exe
  C:\Windows\System\tzBETaP.exe
  2⤵
  PID:7032
- C:\Windows\System\drQqIEp.exe
  C:\Windows\System\drQqIEp.exe
  2⤵
  PID:7068
- C:\Windows\System\qEqldGi.exe
  C:\Windows\System\qEqldGi.exe
  2⤵
  PID:7100
- C:\Windows\System\FxPapxq.exe
  C:\Windows\System\FxPapxq.exe
  2⤵
  PID:7156
- C:\Windows\System\bnuMmln.exe
  C:\Windows\System\bnuMmln.exe
  2⤵
  PID:6220
- C:\Windows\System\FXENKxG.exe
  C:\Windows\System\FXENKxG.exe
  2⤵
  PID:6416
- C:\Windows\System\pGXiCmH.exe
  C:\Windows\System\pGXiCmH.exe
  2⤵
  PID:6604
- C:\Windows\System\RUliGyE.exe
  C:\Windows\System\RUliGyE.exe
  2⤵
  PID:6800
- C:\Windows\System\JdddhxQ.exe
  C:\Windows\System\JdddhxQ.exe
  2⤵
  PID:6836
- C:\Windows\System\ZjXtuqR.exe
  C:\Windows\System\ZjXtuqR.exe
  2⤵
  PID:2620
- C:\Windows\System\EEGCleC.exe
  C:\Windows\System\EEGCleC.exe
  2⤵
  PID:6152
- C:\Windows\System\BTZGfwA.exe
  C:\Windows\System\BTZGfwA.exe
  2⤵
  PID:6360
- C:\Windows\System\gwBTmAj.exe
  C:\Windows\System\gwBTmAj.exe
  2⤵
  PID:6940
- C:\Windows\System\nZAkESB.exe
  C:\Windows\System\nZAkESB.exe
  2⤵
  PID:6176
- C:\Windows\System\EjPXoTf.exe
  C:\Windows\System\EjPXoTf.exe
  2⤵
  PID:6936
- C:\Windows\System\yNUpGMH.exe
  C:\Windows\System\yNUpGMH.exe
  2⤵
  PID:7196
- C:\Windows\System\ZgEBUxx.exe
  C:\Windows\System\ZgEBUxx.exe
  2⤵
  PID:7216
- C:\Windows\System\tPytSEh.exe
  C:\Windows\System\tPytSEh.exe
  2⤵
  PID:7240
- C:\Windows\System\TsquahS.exe
  C:\Windows\System\TsquahS.exe
  2⤵
  PID:7264
- C:\Windows\System\hYMyOCB.exe
  C:\Windows\System\hYMyOCB.exe
  2⤵
  PID:7296
- C:\Windows\System\DyDPyqc.exe
  C:\Windows\System\DyDPyqc.exe
  2⤵
  PID:7316
- C:\Windows\System\EtRtpOw.exe
  C:\Windows\System\EtRtpOw.exe
  2⤵
  PID:7336
- C:\Windows\System\mgGyINN.exe
  C:\Windows\System\mgGyINN.exe
  2⤵
  PID:7356
- C:\Windows\System\iTfHjkx.exe
  C:\Windows\System\iTfHjkx.exe
  2⤵
  PID:7380
- C:\Windows\System\OXxuPIK.exe
  C:\Windows\System\OXxuPIK.exe
  2⤵
  PID:7400
- C:\Windows\System\MHzTDzx.exe
  C:\Windows\System\MHzTDzx.exe
  2⤵
  PID:7456
- C:\Windows\System\OuYJTSQ.exe
  C:\Windows\System\OuYJTSQ.exe
  2⤵
  PID:7508
- C:\Windows\System\THBqrJq.exe
  C:\Windows\System\THBqrJq.exe
  2⤵
  PID:7524
- C:\Windows\System\bqRnSUf.exe
  C:\Windows\System\bqRnSUf.exe
  2⤵
  PID:7552
- C:\Windows\System\mlSkNrY.exe
  C:\Windows\System\mlSkNrY.exe
  2⤵
  PID:7572
- C:\Windows\System\BmiHbiq.exe
  C:\Windows\System\BmiHbiq.exe
  2⤵
  PID:7592
- C:\Windows\System\MvQfjoo.exe
  C:\Windows\System\MvQfjoo.exe
  2⤵
  PID:7624
- C:\Windows\System\qbtsWmq.exe
  C:\Windows\System\qbtsWmq.exe
  2⤵
  PID:7672
- C:\Windows\System\YYiWPnm.exe
  C:\Windows\System\YYiWPnm.exe
  2⤵
  PID:7688
- C:\Windows\System\goMRgVx.exe
  C:\Windows\System\goMRgVx.exe
  2⤵
  PID:7708
- C:\Windows\System\DZofUmS.exe
  C:\Windows\System\DZofUmS.exe
  2⤵
  PID:7732
- C:\Windows\System\BtWEekz.exe
  C:\Windows\System\BtWEekz.exe
  2⤵
  PID:7752
- C:\Windows\System\UEKNRPf.exe
  C:\Windows\System\UEKNRPf.exe
  2⤵
  PID:7780
- C:\Windows\System\SnYwKnz.exe
  C:\Windows\System\SnYwKnz.exe
  2⤵
  PID:7808
- C:\Windows\System\nvSUzUM.exe
  C:\Windows\System\nvSUzUM.exe
  2⤵
  PID:7844
- C:\Windows\System\msHbjbA.exe
  C:\Windows\System\msHbjbA.exe
  2⤵
  PID:7868
- C:\Windows\System\zwWDlsY.exe
  C:\Windows\System\zwWDlsY.exe
  2⤵
  PID:7888
- C:\Windows\System\xDVvCNG.exe
  C:\Windows\System\xDVvCNG.exe
  2⤵
  PID:7916
- C:\Windows\System\HSGxqsJ.exe
  C:\Windows\System\HSGxqsJ.exe
  2⤵
  PID:7932
- C:\Windows\System\WCSrXXP.exe
  C:\Windows\System\WCSrXXP.exe
  2⤵
  PID:7972
- C:\Windows\System\rCAiFJr.exe
  C:\Windows\System\rCAiFJr.exe
  2⤵
  PID:8028
- C:\Windows\System\UutNDOx.exe
  C:\Windows\System\UutNDOx.exe
  2⤵
  PID:8052
- C:\Windows\System\zyfNBWS.exe
  C:\Windows\System\zyfNBWS.exe
  2⤵
  PID:8072
- C:\Windows\System\esnxMJl.exe
  C:\Windows\System\esnxMJl.exe
  2⤵
  PID:8128
- C:\Windows\System\wKQrbbi.exe
  C:\Windows\System\wKQrbbi.exe
  2⤵
  PID:8156
- C:\Windows\System\PMIikbQ.exe
  C:\Windows\System\PMIikbQ.exe
  2⤵
  PID:8180
- C:\Windows\System\nGCNKfE.exe
  C:\Windows\System\nGCNKfE.exe
  2⤵
  PID:7172
- C:\Windows\System\NOHbqnW.exe
  C:\Windows\System\NOHbqnW.exe
  2⤵
  PID:7236
- C:\Windows\System\aEndOCn.exe
  C:\Windows\System\aEndOCn.exe
  2⤵
  PID:7260
- C:\Windows\System\bnbnfrS.exe
  C:\Windows\System\bnbnfrS.exe
  2⤵
  PID:7364
- C:\Windows\System\wqWeszT.exe
  C:\Windows\System\wqWeszT.exe
  2⤵
  PID:7432
- C:\Windows\System\kAJVlDj.exe
  C:\Windows\System\kAJVlDj.exe
  2⤵
  PID:7516
- C:\Windows\System\LCCwvXL.exe
  C:\Windows\System\LCCwvXL.exe
  2⤵
  PID:7580
- C:\Windows\System\YJGGxdh.exe
  C:\Windows\System\YJGGxdh.exe
  2⤵
  PID:7664
- C:\Windows\System\pYIvySM.exe
  C:\Windows\System\pYIvySM.exe
  2⤵
  PID:7700
- C:\Windows\System\MyTVpsz.exe
  C:\Windows\System\MyTVpsz.exe
  2⤵
  PID:7764
- C:\Windows\System\yqIyeDN.exe
  C:\Windows\System\yqIyeDN.exe
  2⤵
  PID:7804
- C:\Windows\System\NaPGmUh.exe
  C:\Windows\System\NaPGmUh.exe
  2⤵
  PID:7908
- C:\Windows\System\SXhFGOH.exe
  C:\Windows\System\SXhFGOH.exe
  2⤵
  PID:7896
- C:\Windows\System\wHZerFa.exe
  C:\Windows\System\wHZerFa.exe
  2⤵
  PID:8040
- C:\Windows\System\jTAGLJp.exe
  C:\Windows\System\jTAGLJp.exe
  2⤵
  PID:8104
- C:\Windows\System\XlLJGST.exe
  C:\Windows\System\XlLJGST.exe
  2⤵
  PID:8152
- C:\Windows\System\XlUtChp.exe
  C:\Windows\System\XlUtChp.exe
  2⤵
  PID:7204
- C:\Windows\System\efFqOXp.exe
  C:\Windows\System\efFqOXp.exe
  2⤵
  PID:7208
- C:\Windows\System\vPftsuL.exe
  C:\Windows\System\vPftsuL.exe
  2⤵
  PID:7396
- C:\Windows\System\fINIGjP.exe
  C:\Windows\System\fINIGjP.exe
  2⤵
  PID:7608
- C:\Windows\System\ylYcVIX.exe
  C:\Windows\System\ylYcVIX.exe
  2⤵
  PID:7616
- C:\Windows\System\zrFehGd.exe
  C:\Windows\System\zrFehGd.exe
  2⤵
  PID:7880
- C:\Windows\System\FdoqxEg.exe
  C:\Windows\System\FdoqxEg.exe
  2⤵
  PID:8140
- C:\Windows\System\ZLnhGsR.exe
  C:\Windows\System\ZLnhGsR.exe
  2⤵
  PID:7472
- C:\Windows\System\BmhnKyF.exe
  C:\Windows\System\BmhnKyF.exe
  2⤵
  PID:7644
- C:\Windows\System\oHIwAUO.exe
  C:\Windows\System\oHIwAUO.exe
  2⤵
  PID:7864
- C:\Windows\System\GLlDlIH.exe
  C:\Windows\System\GLlDlIH.exe
  2⤵
  PID:8168
- C:\Windows\System\ynGeHNe.exe
  C:\Windows\System\ynGeHNe.exe
  2⤵
  PID:7392
- C:\Windows\System\iffSJPC.exe
  C:\Windows\System\iffSJPC.exe
  2⤵
  PID:8264
- C:\Windows\System\krxlNeZ.exe
  C:\Windows\System\krxlNeZ.exe
  2⤵
  PID:8312
- C:\Windows\System\iXNWKUV.exe
  C:\Windows\System\iXNWKUV.exe
  2⤵
  PID:8328
- C:\Windows\System\DbiKbSO.exe
  C:\Windows\System\DbiKbSO.exe
  2⤵
  PID:8348
- C:\Windows\System\vBbEcwc.exe
  C:\Windows\System\vBbEcwc.exe
  2⤵
  PID:8376
- C:\Windows\System\lRIrxNx.exe
  C:\Windows\System\lRIrxNx.exe
  2⤵
  PID:8396
- C:\Windows\System\FaRUCLD.exe
  C:\Windows\System\FaRUCLD.exe
  2⤵
  PID:8448
- C:\Windows\System\BXNYhGl.exe
  C:\Windows\System\BXNYhGl.exe
  2⤵
  PID:8484
- C:\Windows\System\ELLrnJU.exe
  C:\Windows\System\ELLrnJU.exe
  2⤵
  PID:8508
- C:\Windows\System\MTLfvJS.exe
  C:\Windows\System\MTLfvJS.exe
  2⤵
  PID:8528
- C:\Windows\System\gzmtNzj.exe
  C:\Windows\System\gzmtNzj.exe
  2⤵
  PID:8548
- C:\Windows\System\bMshdNv.exe
  C:\Windows\System\bMshdNv.exe
  2⤵
  PID:8616
- C:\Windows\System\ozJGTXo.exe
  C:\Windows\System\ozJGTXo.exe
  2⤵
  PID:8636
- C:\Windows\System\iLhLaIc.exe
  C:\Windows\System\iLhLaIc.exe
  2⤵
  PID:8764
- C:\Windows\System\aGoQNcL.exe
  C:\Windows\System\aGoQNcL.exe
  2⤵
  PID:8780
- C:\Windows\System\UxGTlVr.exe
  C:\Windows\System\UxGTlVr.exe
  2⤵
  PID:8804
- C:\Windows\System\fesHtze.exe
  C:\Windows\System\fesHtze.exe
  2⤵
  PID:8820
- C:\Windows\System\XLjHejP.exe
  C:\Windows\System\XLjHejP.exe
  2⤵
  PID:8844
- C:\Windows\System\HmeVVXs.exe
  C:\Windows\System\HmeVVXs.exe
  2⤵
  PID:8864
- C:\Windows\System\eUVsDkr.exe
  C:\Windows\System\eUVsDkr.exe
  2⤵
  PID:8908
- C:\Windows\System\XkVgEBX.exe
  C:\Windows\System\XkVgEBX.exe
  2⤵
  PID:8932
- C:\Windows\System\YFMfSEg.exe
  C:\Windows\System\YFMfSEg.exe
  2⤵
  PID:8952
- C:\Windows\System\yDClPqm.exe
  C:\Windows\System\yDClPqm.exe
  2⤵
  PID:8972
- C:\Windows\System\olBjStT.exe
  C:\Windows\System\olBjStT.exe
  2⤵
  PID:8992
- C:\Windows\System\JJBUUpm.exe
  C:\Windows\System\JJBUUpm.exe
  2⤵
  PID:9032
- C:\Windows\System\xsmacmR.exe
  C:\Windows\System\xsmacmR.exe
  2⤵
  PID:9056
- C:\Windows\System\MKlIlEP.exe
  C:\Windows\System\MKlIlEP.exe
  2⤵
  PID:9084
- C:\Windows\System\YKrajbz.exe
  C:\Windows\System\YKrajbz.exe
  2⤵
  PID:9116
- C:\Windows\System\DSrveXh.exe
  C:\Windows\System\DSrveXh.exe
  2⤵
  PID:9152
- C:\Windows\System\hjxCEGk.exe
  C:\Windows\System\hjxCEGk.exe
  2⤵
  PID:9172
- C:\Windows\System\WlxzIuZ.exe
  C:\Windows\System\WlxzIuZ.exe
  2⤵
  PID:9204
- C:\Windows\System\QIochMJ.exe
  C:\Windows\System\QIochMJ.exe
  2⤵
  PID:8220
- C:\Windows\System\LAvCHeI.exe
  C:\Windows\System\LAvCHeI.exe
  2⤵
  PID:8252
- C:\Windows\System\gvFUJzv.exe
  C:\Windows\System\gvFUJzv.exe
  2⤵
  PID:8204
- C:\Windows\System\rosUdyz.exe
  C:\Windows\System\rosUdyz.exe
  2⤵
  PID:8224
- C:\Windows\System\gJcwrux.exe
  C:\Windows\System\gJcwrux.exe
  2⤵
  PID:8308
- C:\Windows\System\fpZWvtE.exe
  C:\Windows\System\fpZWvtE.exe
  2⤵
  PID:8392
- C:\Windows\System\bCrMiEK.exe
  C:\Windows\System\bCrMiEK.exe
  2⤵
  PID:8444
- C:\Windows\System\xkIgLng.exe
  C:\Windows\System\xkIgLng.exe
  2⤵
  PID:8324
- C:\Windows\System\SCAihZO.exe
  C:\Windows\System\SCAihZO.exe
  2⤵
  PID:8496
- C:\Windows\System\zxZEmyH.exe
  C:\Windows\System\zxZEmyH.exe
  2⤵
  PID:8672
- C:\Windows\System\KaDQfjz.exe
  C:\Windows\System\KaDQfjz.exe
  2⤵
  PID:8752
- C:\Windows\System\yXzreUk.exe
  C:\Windows\System\yXzreUk.exe
  2⤵
  PID:8776
- C:\Windows\System\bvzyncm.exe
  C:\Windows\System\bvzyncm.exe
  2⤵
  PID:8828
- C:\Windows\System\iVKNfRF.exe
  C:\Windows\System\iVKNfRF.exe
  2⤵
  PID:8916
- C:\Windows\System\ZZnhEUm.exe
  C:\Windows\System\ZZnhEUm.exe
  2⤵
  PID:8984
- C:\Windows\System\uMtscul.exe
  C:\Windows\System\uMtscul.exe
  2⤵
  PID:9004
- C:\Windows\System\aLbhfrP.exe
  C:\Windows\System\aLbhfrP.exe
  2⤵
  PID:9028
- C:\Windows\System\gqaRERf.exe
  C:\Windows\System\gqaRERf.exe
  2⤵
  PID:9164
- C:\Windows\System\AzdZHOS.exe
  C:\Windows\System\AzdZHOS.exe
  2⤵
  PID:8196
- C:\Windows\System\wroDxcj.exe
  C:\Windows\System\wroDxcj.exe
  2⤵
  PID:8248
- C:\Windows\System\WuTeXUt.exe
  C:\Windows\System\WuTeXUt.exe
  2⤵
  PID:8256
- C:\Windows\System\VqNuNzz.exe
  C:\Windows\System\VqNuNzz.exe
  2⤵
  PID:8388
- C:\Windows\System\BItXjfC.exe
  C:\Windows\System\BItXjfC.exe
  2⤵
  PID:8480
- C:\Windows\System\cpAxNpA.exe
  C:\Windows\System\cpAxNpA.exe
  2⤵
  PID:8660
- C:\Windows\System\hWktHDK.exe
  C:\Windows\System\hWktHDK.exe
  2⤵
  PID:8876
- C:\Windows\System\BpCqsnq.exe
  C:\Windows\System\BpCqsnq.exe
  2⤵
  PID:8968
- C:\Windows\System\fcnHdLK.exe
  C:\Windows\System\fcnHdLK.exe
  2⤵
  PID:9064
- C:\Windows\System\WPeVOmV.exe
  C:\Windows\System\WPeVOmV.exe
  2⤵
  PID:8096
- C:\Windows\System\rKyMjew.exe
  C:\Windows\System\rKyMjew.exe
  2⤵
  PID:8464
- C:\Windows\System\djdufmp.exe
  C:\Windows\System\djdufmp.exe
  2⤵
  PID:8600
- C:\Windows\System\ITwCPDM.exe
  C:\Windows\System\ITwCPDM.exe
  2⤵
  PID:2968
- C:\Windows\System\RPauiAp.exe
  C:\Windows\System\RPauiAp.exe
  2⤵
  PID:8284
- C:\Windows\System\vQGUgfA.exe
  C:\Windows\System\vQGUgfA.exe
  2⤵
  PID:8668
- C:\Windows\System\AZjnonT.exe
  C:\Windows\System\AZjnonT.exe
  2⤵
  PID:8856
- C:\Windows\System\UVocmYB.exe
  C:\Windows\System\UVocmYB.exe
  2⤵
  PID:9240
- C:\Windows\System\jnlGMGX.exe
  C:\Windows\System\jnlGMGX.exe
  2⤵
  PID:9280
- C:\Windows\System\BydzUIn.exe
  C:\Windows\System\BydzUIn.exe
  2⤵
  PID:9304
- C:\Windows\System\tLTTraJ.exe
  C:\Windows\System\tLTTraJ.exe
  2⤵
  PID:9324
- C:\Windows\System\ehXROrs.exe
  C:\Windows\System\ehXROrs.exe
  2⤵
  PID:9344
- C:\Windows\System\PFYPKNy.exe
  C:\Windows\System\PFYPKNy.exe
  2⤵
  PID:9368
- C:\Windows\System\IbsQkyA.exe
  C:\Windows\System\IbsQkyA.exe
  2⤵
  PID:9392
- C:\Windows\System\YLdcsut.exe
  C:\Windows\System\YLdcsut.exe
  2⤵
  PID:9428
- C:\Windows\System\vuwUePS.exe
  C:\Windows\System\vuwUePS.exe
  2⤵
  PID:9452
- C:\Windows\System\bFqqmOv.exe
  C:\Windows\System\bFqqmOv.exe
  2⤵
  PID:9496
- C:\Windows\System\lFfOjtq.exe
  C:\Windows\System\lFfOjtq.exe
  2⤵
  PID:9520
- C:\Windows\System\dddgWzE.exe
  C:\Windows\System\dddgWzE.exe
  2⤵
  PID:9540
- C:\Windows\System\wpNSMww.exe
  C:\Windows\System\wpNSMww.exe
  2⤵
  PID:9576
- C:\Windows\System\TqNBAqn.exe
  C:\Windows\System\TqNBAqn.exe
  2⤵
  PID:9616
- C:\Windows\System\PorpgXW.exe
  C:\Windows\System\PorpgXW.exe
  2⤵
  PID:9640
- C:\Windows\System\HsuTSzI.exe
  C:\Windows\System\HsuTSzI.exe
  2⤵
  PID:9668
- C:\Windows\System\KeopKoZ.exe
  C:\Windows\System\KeopKoZ.exe
  2⤵
  PID:9684
- C:\Windows\System\ehzNtyY.exe
  C:\Windows\System\ehzNtyY.exe
  2⤵
  PID:9704
- C:\Windows\System\BWIemYR.exe
  C:\Windows\System\BWIemYR.exe
  2⤵
  PID:9736
- C:\Windows\System\bMuISbL.exe
  C:\Windows\System\bMuISbL.exe
  2⤵
  PID:9772
- C:\Windows\System\OOGJhOs.exe
  C:\Windows\System\OOGJhOs.exe
  2⤵
  PID:9816
- C:\Windows\System\pdUhcFZ.exe
  C:\Windows\System\pdUhcFZ.exe
  2⤵
  PID:9836
- C:\Windows\System\WQOgVPB.exe
  C:\Windows\System\WQOgVPB.exe
  2⤵
  PID:9864
- C:\Windows\System\kTqhtXS.exe
  C:\Windows\System\kTqhtXS.exe
  2⤵
  PID:9888
- C:\Windows\System\BHQRSaH.exe
  C:\Windows\System\BHQRSaH.exe
  2⤵
  PID:9912
- C:\Windows\System\sZVcDic.exe
  C:\Windows\System\sZVcDic.exe
  2⤵
  PID:9940
- C:\Windows\System\FQXSHOM.exe
  C:\Windows\System\FQXSHOM.exe
  2⤵
  PID:9968
- C:\Windows\System\ubOTMlc.exe
  C:\Windows\System\ubOTMlc.exe
  2⤵
  PID:9984
- C:\Windows\System\PZAwmRT.exe
  C:\Windows\System\PZAwmRT.exe
  2⤵
  PID:10012
- C:\Windows\System\LfIEzZg.exe
  C:\Windows\System\LfIEzZg.exe
  2⤵
  PID:10040
- C:\Windows\System\rwoZFlA.exe
  C:\Windows\System\rwoZFlA.exe
  2⤵
  PID:10092
- C:\Windows\System\XNFjijH.exe
  C:\Windows\System\XNFjijH.exe
  2⤵
  PID:10112
- C:\Windows\System\AlpfCup.exe
  C:\Windows\System\AlpfCup.exe
  2⤵
  PID:10136
- C:\Windows\System\KLoHqYu.exe
  C:\Windows\System\KLoHqYu.exe
  2⤵
  PID:10156
- C:\Windows\System\iFWvmPm.exe
  C:\Windows\System\iFWvmPm.exe
  2⤵
  PID:10184
- C:\Windows\System\LOOwBKf.exe
  C:\Windows\System\LOOwBKf.exe
  2⤵
  PID:10228
- C:\Windows\System\YizDAIE.exe
  C:\Windows\System\YizDAIE.exe
  2⤵
  PID:9232
- C:\Windows\System\LXgPzOt.exe
  C:\Windows\System\LXgPzOt.exe
  2⤵
  PID:9300
- C:\Windows\System\FahXVPJ.exe
  C:\Windows\System\FahXVPJ.exe
  2⤵
  PID:9352
- C:\Windows\System\cSTaZeU.exe
  C:\Windows\System\cSTaZeU.exe
  2⤵
  PID:9444
- C:\Windows\System\OfnPUjU.exe
  C:\Windows\System\OfnPUjU.exe
  2⤵
  PID:9476
- C:\Windows\System\lSJBDhY.exe
  C:\Windows\System\lSJBDhY.exe
  2⤵
  PID:9572
- C:\Windows\System\JUnTAEL.exe
  C:\Windows\System\JUnTAEL.exe
  2⤵
  PID:9628
- C:\Windows\System\WvlYvnh.exe
  C:\Windows\System\WvlYvnh.exe
  2⤵
  PID:9696
- C:\Windows\System\UGobRfT.exe
  C:\Windows\System\UGobRfT.exe
  2⤵
  PID:9724
- C:\Windows\System\EqBvNvZ.exe
  C:\Windows\System\EqBvNvZ.exe
  2⤵
  PID:9812
- C:\Windows\System\vIkrlVA.exe
  C:\Windows\System\vIkrlVA.exe
  2⤵
  PID:9860
- C:\Windows\System\nUGNVJo.exe
  C:\Windows\System\nUGNVJo.exe
  2⤵
  PID:9908
- C:\Windows\System\iaTHPMW.exe
  C:\Windows\System\iaTHPMW.exe
  2⤵
  PID:9964
- C:\Windows\System\MMKHTHV.exe
  C:\Windows\System\MMKHTHV.exe
  2⤵
  PID:10048
- C:\Windows\System\auKKgPn.exe
  C:\Windows\System\auKKgPn.exe
  2⤵
  PID:10148
- C:\Windows\System\XBiISFI.exe
  C:\Windows\System\XBiISFI.exe
  2⤵
  PID:10164
- C:\Windows\System\fyKNiXV.exe
  C:\Windows\System\fyKNiXV.exe
  2⤵
  PID:10224
- C:\Windows\System\JvQlLlS.exe
  C:\Windows\System\JvQlLlS.exe
  2⤵
  PID:3632
- C:\Windows\System\LarLGCb.exe
  C:\Windows\System\LarLGCb.exe
  2⤵
  PID:8944
- C:\Windows\System\ZwKpuka.exe
  C:\Windows\System\ZwKpuka.exe
  2⤵
  PID:9488
- C:\Windows\System\EVUgsec.exe
  C:\Windows\System\EVUgsec.exe
  2⤵
  PID:9608
- C:\Windows\System\GzQikSC.exe
  C:\Windows\System\GzQikSC.exe
  2⤵
  PID:4408
- C:\Windows\System\mHojPKI.exe
  C:\Windows\System\mHojPKI.exe
  2⤵
  PID:9896
- C:\Windows\System\gQCLWCf.exe
  C:\Windows\System\gQCLWCf.exe
  2⤵
  PID:10108
- C:\Windows\System\UjIXYpV.exe
  C:\Windows\System\UjIXYpV.exe
  2⤵
  PID:9316
- C:\Windows\System\jLkZrVx.exe
  C:\Windows\System\jLkZrVx.exe
  2⤵
  PID:9420
- C:\Windows\System\IqmIHLY.exe
  C:\Windows\System\IqmIHLY.exe
  2⤵
  PID:3020
- C:\Windows\System\klPxiFM.exe
  C:\Windows\System\klPxiFM.exe
  2⤵
  PID:9832
- C:\Windows\System\XDCvOLJ.exe
  C:\Windows\System\XDCvOLJ.exe
  2⤵
  PID:1176
- C:\Windows\System\HRRAvII.exe
  C:\Windows\System\HRRAvII.exe
  2⤵
  PID:9784
- C:\Windows\System\sAmvcTl.exe
  C:\Windows\System\sAmvcTl.exe
  2⤵
  PID:10248
- C:\Windows\System\CmAQsmK.exe
  C:\Windows\System\CmAQsmK.exe
  2⤵
  PID:10276
- C:\Windows\System\vCJBYRu.exe
  C:\Windows\System\vCJBYRu.exe
  2⤵
  PID:10304
- C:\Windows\System\cwxauoG.exe
  C:\Windows\System\cwxauoG.exe
  2⤵
  PID:10332
- C:\Windows\System\HcPWsgy.exe
  C:\Windows\System\HcPWsgy.exe
  2⤵
  PID:10360
- C:\Windows\System\mGigAxZ.exe
  C:\Windows\System\mGigAxZ.exe
  2⤵
  PID:10388
- C:\Windows\System\cwohhWD.exe
  C:\Windows\System\cwohhWD.exe
  2⤵
  PID:10416
- C:\Windows\System\OUakXdu.exe
  C:\Windows\System\OUakXdu.exe
  2⤵
  PID:10444
- C:\Windows\System\BWYykSC.exe
  C:\Windows\System\BWYykSC.exe
  2⤵
  PID:10464
- C:\Windows\System\xsKhGrD.exe
  C:\Windows\System\xsKhGrD.exe
  2⤵
  PID:10504
- C:\Windows\System\awDXvyy.exe
  C:\Windows\System\awDXvyy.exe
  2⤵
  PID:10528
- C:\Windows\System\itlmvhr.exe
  C:\Windows\System\itlmvhr.exe
  2⤵
  PID:10548
- C:\Windows\System\KkcmFto.exe
  C:\Windows\System\KkcmFto.exe
  2⤵
  PID:10580
- C:\Windows\System\VKfHHjv.exe
  C:\Windows\System\VKfHHjv.exe
  2⤵
  PID:10608
- C:\Windows\System\DxPTpzo.exe
  C:\Windows\System\DxPTpzo.exe
  2⤵
  PID:10640
- C:\Windows\System\oVZgTES.exe
  C:\Windows\System\oVZgTES.exe
  2⤵
  PID:10664
- C:\Windows\System\izmdsRv.exe
  C:\Windows\System\izmdsRv.exe
  2⤵
  PID:10712
- C:\Windows\System\axYyxQp.exe
  C:\Windows\System\axYyxQp.exe
  2⤵
  PID:10736
- C:\Windows\System\MppoAPC.exe
  C:\Windows\System\MppoAPC.exe
  2⤵
  PID:10764
- C:\Windows\System\VPRlVBB.exe
  C:\Windows\System\VPRlVBB.exe
  2⤵
  PID:10784
- C:\Windows\System\vwXgRvl.exe
  C:\Windows\System\vwXgRvl.exe
  2⤵
  PID:10808
- C:\Windows\System\dYexJKK.exe
  C:\Windows\System\dYexJKK.exe
  2⤵
  PID:10832
- C:\Windows\System\XxAYPot.exe
  C:\Windows\System\XxAYPot.exe
  2⤵
  PID:10860
- C:\Windows\System\zdynGQX.exe
  C:\Windows\System\zdynGQX.exe
  2⤵
  PID:10888
- C:\Windows\System\nxGBXSa.exe
  C:\Windows\System\nxGBXSa.exe
  2⤵
  PID:10908
- C:\Windows\System\aJtdwyC.exe
  C:\Windows\System\aJtdwyC.exe
  2⤵
  PID:10932
- C:\Windows\System\RFJnFyB.exe
  C:\Windows\System\RFJnFyB.exe
  2⤵
  PID:10956
- C:\Windows\System\hoKxaIz.exe
  C:\Windows\System\hoKxaIz.exe
  2⤵
  PID:10976
- C:\Windows\System\BlUAyyh.exe
  C:\Windows\System\BlUAyyh.exe
  2⤵
  PID:11004
- C:\Windows\System\WZagrli.exe
  C:\Windows\System\WZagrli.exe
  2⤵
  PID:11024
- C:\Windows\System\RWIfqJQ.exe
  C:\Windows\System\RWIfqJQ.exe
  2⤵
  PID:11068
- C:\Windows\System\YzhYwFp.exe
  C:\Windows\System\YzhYwFp.exe
  2⤵
  PID:11088
- C:\Windows\System\HxyVAUY.exe
  C:\Windows\System\HxyVAUY.exe
  2⤵
  PID:11136
- C:\Windows\System\vHTUxWp.exe
  C:\Windows\System\vHTUxWp.exe
  2⤵
  PID:11172
- C:\Windows\System\hgQEPPR.exe
  C:\Windows\System\hgQEPPR.exe
  2⤵
  PID:11212
- C:\Windows\System\qxXfnFo.exe
  C:\Windows\System\qxXfnFo.exe
  2⤵
  PID:11236
- C:\Windows\System\rIXWOHq.exe
  C:\Windows\System\rIXWOHq.exe
  2⤵
  PID:11260
- C:\Windows\System\SCPhfUB.exe
  C:\Windows\System\SCPhfUB.exe
  2⤵
  PID:10340
- C:\Windows\System\EvWaNxB.exe
  C:\Windows\System\EvWaNxB.exe
  2⤵
  PID:10396
- C:\Windows\System\chEMKpq.exe
  C:\Windows\System\chEMKpq.exe
  2⤵
  PID:10432
- C:\Windows\System\kwWrFqB.exe
  C:\Windows\System\kwWrFqB.exe
  2⤵
  PID:10480
- C:\Windows\System\aPEODkL.exe
  C:\Windows\System\aPEODkL.exe
  2⤵
  PID:10540
- C:\Windows\System\EPtzXxK.exe
  C:\Windows\System\EPtzXxK.exe
  2⤵
  PID:10592
- C:\Windows\System\MvQmNYV.exe
  C:\Windows\System\MvQmNYV.exe
  2⤵
  PID:10628
- C:\Windows\System\EXaWlib.exe
  C:\Windows\System\EXaWlib.exe
  2⤵
  PID:3640
- C:\Windows\System\IVIBRWG.exe
  C:\Windows\System\IVIBRWG.exe
  2⤵
  PID:10816
- C:\Windows\System\CwMxSfv.exe
  C:\Windows\System\CwMxSfv.exe
  2⤵
  PID:10904
- C:\Windows\System\RvgckBI.exe
  C:\Windows\System\RvgckBI.exe
  2⤵
  PID:10968
- C:\Windows\System\QNTTsLK.exe
  C:\Windows\System\QNTTsLK.exe
  2⤵
  PID:11020
- C:\Windows\System\AxcWUZk.exe
  C:\Windows\System\AxcWUZk.exe
  2⤵
  PID:11080
- C:\Windows\System\VdrqnSn.exe
  C:\Windows\System\VdrqnSn.exe
  2⤵
  PID:11128
- C:\Windows\System\VAGpDGQ.exe
  C:\Windows\System\VAGpDGQ.exe
  2⤵
  PID:10212
- C:\Windows\System\cnLwXQP.exe
  C:\Windows\System\cnLwXQP.exe
  2⤵
  PID:10292
- C:\Windows\System\GqRjQua.exe
  C:\Windows\System\GqRjQua.exe
  2⤵
  PID:10456
- C:\Windows\System\zAMVLCC.exe
  C:\Windows\System\zAMVLCC.exe
  2⤵
  PID:10576
- C:\Windows\System\FkLhQlo.exe
  C:\Windows\System\FkLhQlo.exe
  2⤵
  PID:10756
- C:\Windows\System\PkcbLjc.exe
  C:\Windows\System\PkcbLjc.exe
  2⤵
  PID:10924
- C:\Windows\System\ffnquxY.exe
  C:\Windows\System\ffnquxY.exe
  2⤵
  PID:11064
- C:\Windows\System\YpMtCSs.exe
  C:\Windows\System\YpMtCSs.exe
  2⤵
  PID:11228
- C:\Windows\System\ZtqAQzs.exe
  C:\Windows\System\ZtqAQzs.exe
  2⤵
  PID:10460
- C:\Windows\System\AtfGrTT.exe
  C:\Windows\System\AtfGrTT.exe
  2⤵
  PID:10868
- C:\Windows\System\BVlSDPF.exe
  C:\Windows\System\BVlSDPF.exe
  2⤵
  PID:11036
- C:\Windows\System\vIiXGkr.exe
  C:\Windows\System\vIiXGkr.exe
  2⤵
  PID:10356
- C:\Windows\System\MUDFkkc.exe
  C:\Windows\System\MUDFkkc.exe
  2⤵
  PID:11272
- C:\Windows\System\SIGsUDv.exe
  C:\Windows\System\SIGsUDv.exe
  2⤵
  PID:11296
- C:\Windows\System\keVIjRN.exe
  C:\Windows\System\keVIjRN.exe
  2⤵
  PID:11312
- C:\Windows\System\wsRrMWe.exe
  C:\Windows\System\wsRrMWe.exe
  2⤵
  PID:11340
- C:\Windows\System\qqyxipb.exe
  C:\Windows\System\qqyxipb.exe
  2⤵
  PID:11372
- C:\Windows\System\RqDaeOf.exe
  C:\Windows\System\RqDaeOf.exe
  2⤵
  PID:11404
- C:\Windows\System\JwSVwpT.exe
  C:\Windows\System\JwSVwpT.exe
  2⤵
  PID:11428
- C:\Windows\System\qaGCIbR.exe
  C:\Windows\System\qaGCIbR.exe
  2⤵
  PID:11476
- C:\Windows\System\kBPVzCQ.exe
  C:\Windows\System\kBPVzCQ.exe
  2⤵
  PID:11504
- C:\Windows\System\TRQLxYi.exe
  C:\Windows\System\TRQLxYi.exe
  2⤵
  PID:11524
- C:\Windows\System\JQITHxN.exe
  C:\Windows\System\JQITHxN.exe
  2⤵
  PID:11548
- C:\Windows\System\jQoLgwz.exe
  C:\Windows\System\jQoLgwz.exe
  2⤵
  PID:11568
- C:\Windows\System\yAnLZhk.exe
  C:\Windows\System\yAnLZhk.exe
  2⤵
  PID:11600
- C:\Windows\System\EKKwotp.exe
  C:\Windows\System\EKKwotp.exe
  2⤵
  PID:11620
- C:\Windows\System\xurTcNv.exe
  C:\Windows\System\xurTcNv.exe
  2⤵
  PID:11648
- C:\Windows\System\ZOFmImU.exe
  C:\Windows\System\ZOFmImU.exe
  2⤵
  PID:11668
- C:\Windows\System\mOjQGuL.exe
  C:\Windows\System\mOjQGuL.exe
  2⤵
  PID:11688
- C:\Windows\System\QweEyjX.exe
  C:\Windows\System\QweEyjX.exe
  2⤵
  PID:11728
- C:\Windows\System\xsraiUN.exe
  C:\Windows\System\xsraiUN.exe
  2⤵
  PID:11760
- C:\Windows\System\GpNiyEb.exe
  C:\Windows\System\GpNiyEb.exe
  2⤵
  PID:11800
- C:\Windows\System\UnxxubC.exe
  C:\Windows\System\UnxxubC.exe
  2⤵
  PID:11840
- C:\Windows\System\kyOuujs.exe
  C:\Windows\System\kyOuujs.exe
  2⤵
  PID:11860
- C:\Windows\System\MzYiBfe.exe
  C:\Windows\System\MzYiBfe.exe
  2⤵
  PID:11884
- C:\Windows\System\XmfsLGr.exe
  C:\Windows\System\XmfsLGr.exe
  2⤵
  PID:11940
- C:\Windows\System\jrnDrdV.exe
  C:\Windows\System\jrnDrdV.exe
  2⤵
  PID:11956
- C:\Windows\System\rFgtDTN.exe
  C:\Windows\System\rFgtDTN.exe
  2⤵
  PID:11980
- C:\Windows\System\kddVJLu.exe
  C:\Windows\System\kddVJLu.exe
  2⤵
  PID:12000
- C:\Windows\System\yFyxnHq.exe
  C:\Windows\System\yFyxnHq.exe
  2⤵
  PID:12036
- C:\Windows\System\ZoXCFog.exe
  C:\Windows\System\ZoXCFog.exe
  2⤵
  PID:12064
- C:\Windows\System\DmqpBpa.exe
  C:\Windows\System\DmqpBpa.exe
  2⤵
  PID:12084
- C:\Windows\System\uVVORMy.exe
  C:\Windows\System\uVVORMy.exe
  2⤵
  PID:12116
- C:\Windows\System\sLGqOWA.exe
  C:\Windows\System\sLGqOWA.exe
  2⤵
  PID:12136
- C:\Windows\System\qoOjcdx.exe
  C:\Windows\System\qoOjcdx.exe
  2⤵
  PID:12168
- C:\Windows\System\RDVQmbG.exe
  C:\Windows\System\RDVQmbG.exe
  2⤵
  PID:12204
- C:\Windows\System\xqMHmtJ.exe
  C:\Windows\System\xqMHmtJ.exe
  2⤵
  PID:12232
- C:\Windows\System\FLyvzFx.exe
  C:\Windows\System\FLyvzFx.exe
  2⤵
  PID:12252
- C:\Windows\System\DepKHmf.exe
  C:\Windows\System\DepKHmf.exe
  2⤵
  PID:11284
- C:\Windows\System\NiVzNHm.exe
  C:\Windows\System\NiVzNHm.exe
  2⤵
  PID:11304
- C:\Windows\System\iCKrUmT.exe
  C:\Windows\System\iCKrUmT.exe
  2⤵
  PID:11328
- C:\Windows\System\PxkJCAf.exe
  C:\Windows\System\PxkJCAf.exe
  2⤵
  PID:11400
- C:\Windows\System\CanCKQj.exe
  C:\Windows\System\CanCKQj.exe
  2⤵
  PID:11472
- C:\Windows\System\ALjgews.exe
  C:\Windows\System\ALjgews.exe
  2⤵
  PID:11512
- C:\Windows\System\qHotucM.exe
  C:\Windows\System\qHotucM.exe
  2⤵
  PID:11584
- C:\Windows\System\XyIaqLN.exe
  C:\Windows\System\XyIaqLN.exe
  2⤵
  PID:11660
- C:\Windows\System\JzqNufv.exe
  C:\Windows\System\JzqNufv.exe
  2⤵
  PID:11596
- C:\Windows\System\MnEcGSh.exe
  C:\Windows\System\MnEcGSh.exe
  2⤵
  PID:11768
- C:\Windows\System\WphVuxY.exe
  C:\Windows\System\WphVuxY.exe
  2⤵
  PID:11876
- C:\Windows\System\LtzEhMF.exe
  C:\Windows\System\LtzEhMF.exe
  2⤵
  PID:11952
- C:\Windows\System\dqKYmir.exe
  C:\Windows\System\dqKYmir.exe
  2⤵
  PID:12020
- C:\Windows\System\LQPEAoB.exe
  C:\Windows\System\LQPEAoB.exe
  2⤵
  PID:3384
- C:\Windows\System\NGjdstS.exe
  C:\Windows\System\NGjdstS.exe
  2⤵
  PID:12132
- C:\Windows\System\mNhtZsz.exe
  C:\Windows\System\mNhtZsz.exe
  2⤵
  PID:12184
- C:\Windows\System\usDVUMD.exe
  C:\Windows\System\usDVUMD.exe
  2⤵
  PID:12224
- C:\Windows\System\llcOmBx.exe
  C:\Windows\System\llcOmBx.exe
  2⤵
  PID:11288
- C:\Windows\System\iTDuOJr.exe
  C:\Windows\System\iTDuOJr.exe
  2⤵
  PID:11416
- C:\Windows\System\DrqjZHt.exe
  C:\Windows\System\DrqjZHt.exe
  2⤵
  PID:11500
- C:\Windows\System\sKivuAW.exe
  C:\Windows\System\sKivuAW.exe
  2⤵
  PID:11644
- C:\Windows\System\CcTzHMl.exe
  C:\Windows\System\CcTzHMl.exe
  2⤵
  PID:11904
- C:\Windows\System\SfKzozw.exe
  C:\Windows\System\SfKzozw.exe
  2⤵
  PID:11992
- C:\Windows\System\LBBavWG.exe
  C:\Windows\System\LBBavWG.exe
  2⤵
  PID:12192
- C:\Windows\System\GPivoGN.exe
  C:\Windows\System\GPivoGN.exe
  2⤵
  PID:224
- C:\Windows\System\ghUfFuV.exe
  C:\Windows\System\ghUfFuV.exe
  2⤵
  PID:11684
- C:\Windows\System\wYObIvs.exe
  C:\Windows\System\wYObIvs.exe
  2⤵
  PID:12012
- C:\Windows\System\oApWmNU.exe
  C:\Windows\System\oApWmNU.exe
  2⤵
  PID:12220
- C:\Windows\System\YsozHAu.exe
  C:\Windows\System\YsozHAu.exe
  2⤵
  PID:11580
- C:\Windows\System\JIkJkUt.exe
  C:\Windows\System\JIkJkUt.exe
  2⤵
  PID:12304
- C:\Windows\System\ADjGbwO.exe
  C:\Windows\System\ADjGbwO.exe
  2⤵
  PID:12324
- C:\Windows\System\sktwhxe.exe
  C:\Windows\System\sktwhxe.exe
  2⤵
  PID:12356
- C:\Windows\System\dTIdJKM.exe
  C:\Windows\System\dTIdJKM.exe
  2⤵
  PID:12396
- C:\Windows\System\LBQQCga.exe
  C:\Windows\System\LBQQCga.exe
  2⤵
  PID:12420
- C:\Windows\System\OBoBUGZ.exe
  C:\Windows\System\OBoBUGZ.exe
  2⤵
  PID:12448
- C:\Windows\System\iOcYzcz.exe
  C:\Windows\System\iOcYzcz.exe
  2⤵
  PID:12468
- C:\Windows\System\uWMIMOk.exe
  C:\Windows\System\uWMIMOk.exe
  2⤵
  PID:12508
- C:\Windows\System\SoDPJvX.exe
  C:\Windows\System\SoDPJvX.exe
  2⤵
  PID:12528
- C:\Windows\System\IdGgbPp.exe
  C:\Windows\System\IdGgbPp.exe
  2⤵
  PID:12568
- C:\Windows\System\IyPkWtf.exe
  C:\Windows\System\IyPkWtf.exe
  2⤵
  PID:12592
- C:\Windows\System\UFEELam.exe
  C:\Windows\System\UFEELam.exe
  2⤵
  PID:12620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lazum4eo.ohi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AGArPQd.exe

Filesize
2.0MB

MD5
639b2d732d7560a63a6d7bce36f3215b

SHA1
5cbcb34ae63d1c86081f19919368c7ad44bb580a

SHA256
d1d5932cf2c0546e945a6d7e128128d4d77e18226ed77853bd7148adac2a5e4a

SHA512
57b7f2b7fe13bd44725ac3b65f5027d97bff63473b5f18b7a70652971ad015ed141ee76b43b41924187fcae836be7b127fccb5634eacc3e595d8a7b6cb9552eb

Download Submit
C:\Windows\System\AmmBfEA.exe

Filesize
2.0MB

MD5
a4c347ae1ae6135dba130ce83a4af8be

SHA1
7922cdee5e6e4aa14d81f5de69528003bb57c27c

SHA256
86c09f695139e578f31c01f3bab09d02ec4323262baa7a86c3e5f5343f111f9c

SHA512
9af5bdefc66e900bbce85bc331c98984ccfd16974a891acb4390d51f84de88ba9a0774fac7faf9ff868d0723c749fd6c2c8579c6b549fd3c23dcc1e9eb205e0e

Download Submit
C:\Windows\System\CjxpwVA.exe

Filesize
2.0MB

MD5
dff41744d06845d0e17179198c43e2be

SHA1
9abb93e661301d5be89443fc2a7d279c8fd57545

SHA256
5b677352dee39cb75f3685e011856d2ee8df5e2ca3ebd7c022ba87febdf6e48e

SHA512
cf4f9fcc280690254f8e17e5d8b6dc5f48e3de2273f2a4e05545fb49a398f41daffd5c86d527f2e1097dcb7fbd91864ae7430b38ecb0177d7eeb0557c623f54d

Download Submit
C:\Windows\System\DDEDarX.exe

Filesize
2.0MB

MD5
4ec62c06da95decf6b7d4a13a79b480e

SHA1
7a431f3b79a9fbe89dc44698ba596c5408fbf905

SHA256
4f774b7f223a239ae7e2abe69b3e04e9559f74a67898cfa7e3b1c0c2c6382162

SHA512
9c69748ecc95b8d58b7cb889364abaa69f781fcc92c9cb4d3c9e8e7528344e2fb1d961ab1ac201e387083935f1659698fbef0846d04077f875d5bff30e4fa2b2

Download Submit
C:\Windows\System\GGGqybj.exe

Filesize
2.0MB

MD5
7f7520d9d38b4f57b8a4fecb8422be45

SHA1
179773b09986d2080b5c6a9ddf19bc228210bea6

SHA256
79dd4c6961a9f15010c249dd1ae992ed0deebe064d461e41c6b7e2b7cf21102e

SHA512
4713f68efa38e2097d2baa1e6f36148f786c261e7f329f04eba947d3bfbc1d6c14a17b95038a197ebf6abea2c725d70a1a9780d882cf860675f946b769ea2828

Download Submit
C:\Windows\System\HEGLTxx.exe

Filesize
2.0MB

MD5
6d8870be20502fc0096180aebfdc7520

SHA1
b3eab6395dbc5be90940e13f4950ee2f3fcde94f

SHA256
c8db1f39419a9ef8d46073280f216817f71966d3fe5dea09ba5e5eb7c992410a

SHA512
72ee22f69537547639d45764f188058c920f85974b8c77a7683dea1d183a1f5cd4d530fde9c58d470371573466f4397b495ca6a117fde43f857f6df77a3086a2

Download Submit
C:\Windows\System\HlzhOqt.exe

Filesize
2.0MB

MD5
5eb20a252c4df477ae8afed6e07a22ff

SHA1
d86f3a3b73c77309d13547838e0198335fdbf477

SHA256
743265cc6b9892786dfa493518a438c9c551edc0dbe7c6a54e192811ab6ba58e

SHA512
f8127e4bf3b91c024536cb15a6e999b8f5391e29131a7c0bb9613f990cc4898d61cc27a84c02237d5d0967a3590e02b7a188efe1a1ac335cd5f6277c4a6fe8a4

Download Submit
C:\Windows\System\IouCMhU.exe

Filesize
2.0MB

MD5
859c6c224635d481bdd0a60565029cf7

SHA1
9eb77d2358094365db7f2f67d895931694588f7d

SHA256
0120fcb1e638246e11b9f8898749f05d385046a7446d3a102732a9b9633d0082

SHA512
e5232298aff522f35645e471f348fff3068c5e4cfa9a2c250552909b11fabf8d8151cf27ca7d0d0fc120e30ea4c1323c011e84d9af926fc8b2f9cde206f32181

Download Submit
C:\Windows\System\LEazopR.exe

Filesize
2.0MB

MD5
36d82df99133be05ca875982155dbb45

SHA1
2369323138c2ab520b7139d15500e43b093e47e9

SHA256
c731e367f63fd5b05a117d956ba750a8c80fffaac7a7c03c64ec822c843af592

SHA512
f02beba3871388ea7a930a1c838d0f002b7f7dfe5ec982c5d9962356402ebc4313ec72e79305cc27783b8a7cfe404356155e2a74834ef8eb5ddee410507fb8f8

Download Submit
C:\Windows\System\LNXmnSc.exe

Filesize
2.0MB

MD5
43b00f71cdfa42a8a00e7507d55afd7f

SHA1
83c61752c3df6eb8508e8d24dee5648bde37364a

SHA256
e308c92fc9b6f496362c385008498023da6a91546f9aa66ae025f33420709d66

SHA512
04b4734875c2681322797bcdb13c8b125131d38aebc17e8e9ea9c2383c8dbf358c07867619768ffd046e8162aff1feffe941da3ccfca34f14393f59bd70b12ae

Download Submit
C:\Windows\System\QHjmNjh.exe

Filesize
2.0MB

MD5
98db95ef1f93058b7a5210397a054585

SHA1
c0c3659a06e95b79afd95ee18b9e0eea6bda9d84

SHA256
50cd0938ec6a35d2508b149ea6b58fcd522c8308480824086739f19d10047f90

SHA512
60c54ee815ad86c02c190881c035694a47dec947a2b4e2413b1828c9bafd11081de94763b1a7b9e9bc557d9f2319032550bea5b8c4f190506aba44daa25af139

Download Submit
C:\Windows\System\QmGzSuT.exe

Filesize
2.0MB

MD5
2a2b10a396f72f8c9c77d3c955fb2791

SHA1
81b25298ee1dfa53674cc0bcb4a7c90f4584e780

SHA256
76df9274a078ed4fd10126f4920254b627107393b96e6f172fa7d37537ae858c

SHA512
4c7f8270b944d5e8d1c4568b28102e571ddef78232fc256c0207bf63317031cd005bfbd0e7c4986eb635c4aa8ba29a58a6de965062c98261f9d23621e881b74f

Download Submit
C:\Windows\System\RVqgeDy.exe

Filesize
2.0MB

MD5
7934665363928434d950abc8e9624e94

SHA1
02fcf1e3229a354d402f76669cdb01f8a2f5e48a

SHA256
39b7f0c3d205eeae491178e713bcdef0da80f813a20a3d935d264d43cc6554e3

SHA512
143b79084b244211b5fb4220a36c2e3857f0eed8e1a8f69c83ef249ae0c427f2ad16e1e8285ee1130a25f97f080da37b5eb0f5256764825206c865054e645d4b

Download Submit
C:\Windows\System\RmjUOQt.exe

Filesize
2.0MB

MD5
21b6c031b6381aa0dfdefbf5bee73798

SHA1
0073839f952bee6fc53fb6c06a9b49108b0e1a1a

SHA256
127bbc8cba13d8a55af438d50530b27c6792fa496a8cf41f98947d4c8bde0089

SHA512
7b2ba5609d43381c16437b7927e47a513b6475f422f236c2797d6b20ccc3646cf3dc13e4adffe457262a8a3fd2bbdb48f35be8fd79b6ca6c70dd6d610387f2d3

Download Submit
C:\Windows\System\RvrUhou.exe

Filesize
2.0MB

MD5
c3c79f14adcd2814bb93d98ad42fcd33

SHA1
abfabe1a89841d444a966c6d6d72717ddd4792c2

SHA256
e76a47eeb944d1432e5796aa0a64b58888532cf4bbb4873389fd58bfe85c5712

SHA512
9873ff34a7299017f4a6192510e858c96a90b02c710d273285fe6fa8f4aef2faa62ae8ae91eec741b4f34e5e5680575c3a8e6312cb7c52514603a6b6593a5bb6

Download Submit
C:\Windows\System\SjHPgvJ.exe

Filesize
2.0MB

MD5
9bbdef9fd8ecdc18ab82fe3cc35347e3

SHA1
4fbad7c4c82ad5f0cbfb540eb47190fcd145f981

SHA256
8516e8a23f9a926323746d6b9168f004447e0fba7081d406fa30c81ae5974be8

SHA512
e4dda7f7e8f7a4b53994a4d1ce87cdba9b43d6ca65f54ff36b7ff5a965dc90f82322e8eeb3211f4dab22fce684050695a74a298d1e45fc51b542af357f77fe8f

Download Submit
C:\Windows\System\TRUkwSX.exe

Filesize
2.0MB

MD5
43f946871b7515cb7ea4eb7ce8bc388f

SHA1
92022a1d371c6e825ac1f2444a9b19bcfc07bcd7

SHA256
77d28a3cc3bbefd725751b27ebb740ec0849ddc14767758f01dd5b3e47693d06

SHA512
e5ab18d57f5ba03402190d08e927c5c3e42851ae9b5fe98d8f245f3f1fc1d5d8293828c5cd8b66609da4ae6efb81c91aad9ece4f1e0479ded5dcfa2f6347cb60

Download Submit
C:\Windows\System\WGZYTId.exe

Filesize
2.0MB

MD5
40c88b15aafba9f805ff0b0437aa72b7

SHA1
1f45c61865add79945140050898905f3ccc9f552

SHA256
6cde6cf0eba57b7c52d34b8b8348118d9b019439ba641b1d7d54333de0020013

SHA512
e0c20c47e189fa43f66dfa8e513391c754b9d7e44679bc2b18ceebaaf0dd1b57b7bb45de30d5678696885a7bb84ea9d80705037db43338eb3f6ac1ed08bdef89

Download Submit
C:\Windows\System\XLqFrDE.exe

Filesize
2.0MB

MD5
d6a609ad08ee0a3ae071c7843b6b2e0d

SHA1
9071c4e92c652522d64202336c390ec0b1c09766

SHA256
5ea28664892e853a35f8d9b1a3d5e4bd6d365f5c71ed06ab3ec721b033f9faa9

SHA512
5582ee367034b108bd2fc42f9184ccb60e64a0a528e32bfa75fabee8c850343234a64a0a9fa8b4b2e6826a35a29f9aa5379f189bf67a951a8df6a6796f8d1cec

Download Submit
C:\Windows\System\XSYqTgd.exe

Filesize
2.0MB

MD5
faab77d25f726295761bdfe92b4b3061

SHA1
315bfa4f7b64ab3e3d6baa64d7740f305b8d432f

SHA256
f684181ac024aa546b62c447105d8dfc187e49620236f683ac4f31d75e61f3f7

SHA512
30677245f334ce11635e4832c0cc96960fedb08eb56905e58222b979e1b6e8a9eb04a5edd3e52924d2a50eab4a8a88fa30eb839011885305e67c6f215bc5c46e

Download Submit
C:\Windows\System\YyTGoAj.exe

Filesize
2.0MB

MD5
293534826bfa20e84a7eefef1743e53c

SHA1
261dadec13a5020118639fb08a9770f5f775a139

SHA256
164a6d0721d6144f507d9650c69a916be9f655be66e1a5c4e2d197ce02cd8f4b

SHA512
5fbe2d6a002738797b173bf05379c8ff939ccc860c0bae292dde2e8341382b075de55efa3214efe00bfa519c64efff2b6af7f47ba1165cf22659f5b90cc323d7

Download Submit
C:\Windows\System\bphhXHA.exe

Filesize
2.0MB

MD5
2bfd818b66a8d801cc036fde2a636129

SHA1
891f16ac3cef05016c3c33a84d321eac61df5af3

SHA256
5ba4e53169e2159a7ee2a181c0a6126596de7bc6e9c75ba5a182a4b8a664ee6e

SHA512
e5ef2800cab783a306f507833c27100d33eb0d19e70d2b1ff5631f7c00735fbda14c59c6c32186db463194b9d9127f3192fd51d81656ccad59781b4c6acaf3c5

Download Submit
C:\Windows\System\hFfRcwX.exe

Filesize
2.0MB

MD5
8f7ab7e1266f19469bb3e775ad010413

SHA1
2cd969395969999d31a654f6a02835b129d72ffe

SHA256
e4bdaff9a596110b321e008299eaea89fa314857bff8f499de74ad8e5dd7761e

SHA512
35c999368fc4fb12ec6062c56717f8116b3f66f48232202fc31c3e79eee39050495b4dab9bad76a0d9d13df009e5d358c2ba09516132e35c48c0740297698656

Download Submit
C:\Windows\System\ndPJlRy.exe

Filesize
8B

MD5
22cacd7d3bd9019903a59ff06bcd8478

SHA1
d1f910928dcd392d84d2992fb865de60e7dfc54b

SHA256
705aa9dd34996e4e385c6f042286c7208120ebc134fa299633cabd108fcaeed4

SHA512
bd865b4e44550de1d3a085a76bb9dfaf94b4d5645b3fb5a24c248b53778403f41b054f3ae1c053cb6f64269ebc7818e8260f30c857e38421c0423c14aefd838d

Download Submit
C:\Windows\System\njkKuqk.exe

Filesize
2.0MB

MD5
9627344c8dab681a609dd667bec580ba

SHA1
f5db3550d009fbf260288a104c74c7abd0e5b366

SHA256
209f0f10821ae1c03935654705feb6868f54f8a9989a7af0bd9e6f7f00c7ac34

SHA512
88f9e170643f4035662e634ca34afc02122a58961f7dddec5c7b3a39854b3e589120bdb947e640cbbd6e9d15e61d5adecf7c0b838cd46bc7e09ba38dbdf39f22

Download Submit
C:\Windows\System\oOgLyju.exe

Filesize
2.0MB

MD5
ded1bc8c870f96011b353d56e4d29100

SHA1
c86c27ae1af7bd9229ccaef5d6ba69e09b706907

SHA256
e86e558d4383e596187fbf4cf0a0755cd7cec6c5af2cdd62287170d3e208a398

SHA512
8be8affa46086558a297840d428ad0b1859b714e9dea8c8a2e1796c17d4121c90dcf08c8c499d1720214368575dc38ad40a80fc2833e97c9008700fe44a19579

Download Submit
C:\Windows\System\oVASdFK.exe

Filesize
2.0MB

MD5
5a5f47139507f75e7a30c9850ff22e73

SHA1
04b5302a9d6421f179c8c172c18cac920bdd888f

SHA256
427e31ac8555ffe2f48f3bbc934ae1365e6150db5155f3883b707b9aab3bdac7

SHA512
f33ea2e6a71da24987a4abf385c0e7c95a698e77df09c0671ad57d5b9fec1b2785638bd0f6863d17064a7403911a2b757507817b10bf64c9fb0c83c1197d225e

Download Submit
C:\Windows\System\phUjadi.exe

Filesize
2.0MB

MD5
036ccd8292830e10df3451ffae96dae2

SHA1
d22df0d795b659f5a5684f4bdc6ef61ec8eec556

SHA256
8313156942567b856c78ebb6b9b86bc76fc1b0d2490073d9163d41a38c0444a9

SHA512
db7dbb392c36037bcb7ca760a47a673de326adbce6740da5c83d9b14ccaa8ce77dda00912a6306b02803251f01f0bfa70f5d3f19178f5aab2df6f3fd7d84f0bf

Download Submit
C:\Windows\System\rABRgYE.exe

Filesize
2.0MB

MD5
2461dac74a6412c011149111c40e4535

SHA1
dc8053bd5622f4655e63d20fc88f3da2a7d74155

SHA256
fe2eb99578ac18ea4461c86c34700119bb6162d9c9fa1844b061b3e9120e8783

SHA512
effa059b87b05f9f54b6c2643e913c6d4f0e1240d2f4e3a46760389de8bc92e8f30bf16cb020d02b534f90e9e29d448459e221afc363e33a6d8f9b90345ba900

Download Submit
C:\Windows\System\rAaxFWN.exe

Filesize
2.0MB

MD5
71ef9c08f6c661f2ca9118a4e99f6f7c

SHA1
ae2f738a780bd7204fa2631880062825bddc03f1

SHA256
2e22205968fca16c89479b8a39b2a046fea8db409a73c818ec67599c8fa275a8

SHA512
0bc03947c1db80659b5127aaef53b763ec39a4f715e7c6e3be0c6cd74d520da56ccbd63552bea7ef06798434e16172040b90a821fb6d06f3893aba01f529ecd3

Download Submit
C:\Windows\System\vpbhrmt.exe

Filesize
2.0MB

MD5
bb2bffe5d6ab7528596c12967911c853

SHA1
08dd0c819a591f59287a0b702dce8b125db2635b

SHA256
f458462f27cfdaba5b14a9af3e0c96965189654054c624cd07c4ed629f3e2fda

SHA512
d4f98b3e8d89b341f2bf97dc7dd7f806089d1889db60890950b0552f9befe152495f6a1563b1de3210594acbe2c07fef3e5f4ddd00659b59742bca954f75888d

Download Submit
C:\Windows\System\yEPQigx.exe

Filesize
2.0MB

MD5
e93e8108a1901a2ed385374020231bff

SHA1
3726ce5c45e6353c3bd29449764a1a66af0c1789

SHA256
2d0328d463f7845860fc5bde6a415338f438abc9e729ff00a5a48eb788574d2f

SHA512
1afa7d19e927cab90351ed934b76c8d836a7e139a8d7ea0b55f43665665fb34735ef878a08bdd9ba3db193d1021040c1b8dfe8467b485a7fc3bbf7a01174f937

Download Submit
C:\Windows\System\yFgFQJT.exe

Filesize
2.0MB

MD5
8b146ec5e57324186c57a8d6ca98618e

SHA1
6078ef022b5ea29a9a76b93857b92eaacb736851

SHA256
3c072eca746d8696eca35f0a42d6f6a84bba54490fa81791abddf72a04a7e110

SHA512
d785bcf7e01bcf6f7f5cd8e9259ff96e13793ce27c04240938a9a31b13821c7c0325547166b5ee42fa7aed6c86b51e403c913f83cdc2cf3141a076327609da80

Download Submit
C:\Windows\System\yLmXcGi.exe

Filesize
2.0MB

MD5
1bbc6f6279e6c398cab154989e0b91f6

SHA1
a4bbbb29aed110f53b134fe8adfc9182032bf0ab

SHA256
2292c1f57ba8514520198831a6743853d221746638f5018c8aafaf1acbeaa3a5

SHA512
de0edc227ae06b64970fc31546c4c4df7a758a8f54c7b19d14cb0de8dd3294c3bd1d43697c06347e789c19768d2b6e52825a2da23b24fe571ce789a7b7ef6772

Download Submit
memory/676-101-0x00007FF699380000-0x00007FF699772000-memory.dmp

Filesize
3.9MB

Download
memory/676-2259-0x00007FF699380000-0x00007FF699772000-memory.dmp

Filesize
3.9MB

Download
memory/736-2242-0x00007FF712770000-0x00007FF712B62000-memory.dmp

Filesize
3.9MB

Download
memory/736-77-0x00007FF712770000-0x00007FF712B62000-memory.dmp

Filesize
3.9MB

Download
memory/800-82-0x00007FF6AC780000-0x00007FF6ACB72000-memory.dmp

Filesize
3.9MB

Download
memory/800-2236-0x00007FF6AC780000-0x00007FF6ACB72000-memory.dmp

Filesize
3.9MB

Download
memory/876-2234-0x00007FF7DB440000-0x00007FF7DB832000-memory.dmp

Filesize
3.9MB

Download
memory/876-15-0x00007FF7DB440000-0x00007FF7DB832000-memory.dmp

Filesize
3.9MB

Download
memory/1200-116-0x00007FF785F40000-0x00007FF786332000-memory.dmp

Filesize
3.9MB

Download
memory/1200-2264-0x00007FF785F40000-0x00007FF786332000-memory.dmp

Filesize
3.9MB

Download
memory/1240-157-0x00007FF71BD80000-0x00007FF71C172000-memory.dmp

Filesize
3.9MB

Download
memory/1240-2270-0x00007FF71BD80000-0x00007FF71C172000-memory.dmp

Filesize
3.9MB

Download
memory/1296-163-0x00007FF74B750000-0x00007FF74BB42000-memory.dmp

Filesize
3.9MB

Download
memory/1296-2272-0x00007FF74B750000-0x00007FF74BB42000-memory.dmp

Filesize
3.9MB

Download
memory/1372-2244-0x00007FF7FEAB0000-0x00007FF7FEEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1372-90-0x00007FF7FEAB0000-0x00007FF7FEEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1376-2221-0x00007FFFF3A33000-0x00007FFFF3A35000-memory.dmp

Filesize
8KB

Download
memory/1376-21-0x00007FFFF3A33000-0x00007FFFF3A35000-memory.dmp

Filesize
8KB

Download
memory/1376-60-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp

Filesize
10.8MB

Download
memory/1376-55-0x000001F028540000-0x000001F028562000-memory.dmp

Filesize
136KB

Download
memory/1376-2199-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp

Filesize
10.8MB

Download
memory/1376-41-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp

Filesize
10.8MB

Download
memory/1376-444-0x000001F029330000-0x000001F029AD6000-memory.dmp

Filesize
7.6MB

Download
memory/1688-175-0x00007FF7C0AC0000-0x00007FF7C0EB2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-2280-0x00007FF7C0AC0000-0x00007FF7C0EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-2257-0x00007FF6AABA0000-0x00007FF6AAF92000-memory.dmp

Filesize
3.9MB

Download
memory/2120-128-0x00007FF6AABA0000-0x00007FF6AAF92000-memory.dmp

Filesize
3.9MB

Download
memory/2168-0-0x00007FF7497E0000-0x00007FF749BD2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-1-0x000001A40A3E0000-0x000001A40A3F0000-memory.dmp

Filesize
64KB

Download
memory/2260-72-0x00007FF723380000-0x00007FF723772000-memory.dmp

Filesize
3.9MB

Download
memory/2260-2246-0x00007FF723380000-0x00007FF723772000-memory.dmp

Filesize
3.9MB

Download
memory/2364-122-0x00007FF7F21E0000-0x00007FF7F25D2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-2254-0x00007FF7F21E0000-0x00007FF7F25D2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-2275-0x00007FF640D20000-0x00007FF641112000-memory.dmp

Filesize
3.9MB

Download
memory/2924-182-0x00007FF640D20000-0x00007FF641112000-memory.dmp

Filesize
3.9MB

Download
memory/3116-134-0x00007FF6D08D0000-0x00007FF6D0CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3116-2253-0x00007FF6D08D0000-0x00007FF6D0CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-93-0x00007FF66C7A0000-0x00007FF66CB92000-memory.dmp

Filesize
3.9MB

Download
memory/3168-2250-0x00007FF66C7A0000-0x00007FF66CB92000-memory.dmp

Filesize
3.9MB

Download
memory/3180-109-0x00007FF7518A0000-0x00007FF751C92000-memory.dmp

Filesize
3.9MB

Download
memory/3180-2263-0x00007FF7518A0000-0x00007FF751C92000-memory.dmp

Filesize
3.9MB

Download
memory/3256-110-0x00007FF6706E0000-0x00007FF670AD2000-memory.dmp

Filesize
3.9MB

Download
memory/3256-2261-0x00007FF6706E0000-0x00007FF670AD2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-2248-0x00007FF64B7C0000-0x00007FF64BBB2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-81-0x00007FF64B7C0000-0x00007FF64BBB2000-memory.dmp

Filesize
3.9MB

Download
memory/3872-140-0x00007FF7BE230000-0x00007FF7BE622000-memory.dmp

Filesize
3.9MB

Download
memory/3872-2268-0x00007FF7BE230000-0x00007FF7BE622000-memory.dmp

Filesize
3.9MB

Download
memory/4352-2238-0x00007FF786690000-0x00007FF786A82000-memory.dmp

Filesize
3.9MB

Download
memory/4352-64-0x00007FF786690000-0x00007FF786A82000-memory.dmp

Filesize
3.9MB

Download
memory/4428-2276-0x00007FF78F920000-0x00007FF78FD12000-memory.dmp

Filesize
3.9MB

Download
memory/4428-176-0x00007FF78F920000-0x00007FF78FD12000-memory.dmp

Filesize
3.9MB

Download
memory/4832-169-0x00007FF620BC0000-0x00007FF620FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-2279-0x00007FF620BC0000-0x00007FF620FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4928-2266-0x00007FF79F0E0000-0x00007FF79F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/4928-146-0x00007FF79F0E0000-0x00007FF79F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-2240-0x00007FF766DF0000-0x00007FF7671E2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-68-0x00007FF766DF0000-0x00007FF7671E2000-memory.dmp

Filesize
3.9MB

Download