xmrig | 1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a

Analysis

max time kernel
64s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
Size

1.8MB
MD5

1bf8469b7be930b6a15954204c2050fb
SHA1

2f748783fd7413dc0ec8bc3a56d5adfd44eef6ee
SHA256

1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a
SHA512

0ddb8dab1e6b164f2f1736ca3089de7fb9a920542059bc1d531aa8dc1e46bf803d251092b643a232a6e8cdbf7da10c9cc2831b54a0a1fc47d786a7fc6d012364
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82Sz37:NABW

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4756-12-0x00007FF6466E0000-0x00007FF646AD2000-memory.dmp	xmrig
behavioral2/memory/3620-48-0x00007FF7822F0000-0x00007FF7826E2000-memory.dmp	xmrig
behavioral2/memory/2560-433-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp	xmrig
behavioral2/memory/3076-436-0x00007FF7BFB70000-0x00007FF7BFF62000-memory.dmp	xmrig
behavioral2/memory/1004-445-0x00007FF797000000-0x00007FF7973F2000-memory.dmp	xmrig
behavioral2/memory/4720-451-0x00007FF7BC580000-0x00007FF7BC972000-memory.dmp	xmrig
behavioral2/memory/2880-455-0x00007FF7A4530000-0x00007FF7A4922000-memory.dmp	xmrig
behavioral2/memory/1624-474-0x00007FF7A1DA0000-0x00007FF7A2192000-memory.dmp	xmrig
behavioral2/memory/556-509-0x00007FF6D9A70000-0x00007FF6D9E62000-memory.dmp	xmrig
behavioral2/memory/1400-496-0x00007FF695010000-0x00007FF695402000-memory.dmp	xmrig
behavioral2/memory/1556-523-0x00007FF627800000-0x00007FF627BF2000-memory.dmp	xmrig
behavioral2/memory/4868-533-0x00007FF6EB580000-0x00007FF6EB972000-memory.dmp	xmrig
behavioral2/memory/4840-555-0x00007FF75CD20000-0x00007FF75D112000-memory.dmp	xmrig
behavioral2/memory/4708-528-0x00007FF6D31A0000-0x00007FF6D3592000-memory.dmp	xmrig
behavioral2/memory/828-524-0x00007FF7FD420000-0x00007FF7FD812000-memory.dmp	xmrig
behavioral2/memory/2432-485-0x00007FF71BB10000-0x00007FF71BF02000-memory.dmp	xmrig
behavioral2/memory/3340-482-0x00007FF6275A0000-0x00007FF627992000-memory.dmp	xmrig
behavioral2/memory/1656-466-0x00007FF66BE60000-0x00007FF66C252000-memory.dmp	xmrig
behavioral2/memory/5024-460-0x00007FF656A60000-0x00007FF656E52000-memory.dmp	xmrig
behavioral2/memory/3212-561-0x00007FF732E60000-0x00007FF733252000-memory.dmp	xmrig
behavioral2/memory/3168-566-0x00007FF627920000-0x00007FF627D12000-memory.dmp	xmrig
behavioral2/memory/1504-71-0x00007FF7D1EF0000-0x00007FF7D22E2000-memory.dmp	xmrig
behavioral2/memory/4596-52-0x00007FF715300000-0x00007FF7156F2000-memory.dmp	xmrig
behavioral2/memory/1836-42-0x00007FF6D5FE0000-0x00007FF6D63D2000-memory.dmp	xmrig
behavioral2/memory/4756-2101-0x00007FF6466E0000-0x00007FF646AD2000-memory.dmp	xmrig
behavioral2/memory/1836-2103-0x00007FF6D5FE0000-0x00007FF6D63D2000-memory.dmp	xmrig
behavioral2/memory/4596-2106-0x00007FF715300000-0x00007FF7156F2000-memory.dmp	xmrig
behavioral2/memory/3620-2107-0x00007FF7822F0000-0x00007FF7826E2000-memory.dmp	xmrig
behavioral2/memory/1504-2110-0x00007FF7D1EF0000-0x00007FF7D22E2000-memory.dmp	xmrig
behavioral2/memory/2560-2113-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp	xmrig
behavioral2/memory/4840-2117-0x00007FF75CD20000-0x00007FF75D112000-memory.dmp	xmrig
behavioral2/memory/1004-2116-0x00007FF797000000-0x00007FF7973F2000-memory.dmp	xmrig
behavioral2/memory/3076-2112-0x00007FF7BFB70000-0x00007FF7BFF62000-memory.dmp	xmrig
behavioral2/memory/3212-2119-0x00007FF732E60000-0x00007FF733252000-memory.dmp	xmrig
behavioral2/memory/3168-2125-0x00007FF627920000-0x00007FF627D12000-memory.dmp	xmrig
behavioral2/memory/5024-2149-0x00007FF656A60000-0x00007FF656E52000-memory.dmp	xmrig
behavioral2/memory/1624-2145-0x00007FF7A1DA0000-0x00007FF7A2192000-memory.dmp	xmrig
behavioral2/memory/3340-2144-0x00007FF6275A0000-0x00007FF627992000-memory.dmp	xmrig
behavioral2/memory/1400-2140-0x00007FF695010000-0x00007FF695402000-memory.dmp	xmrig
behavioral2/memory/1556-2136-0x00007FF627800000-0x00007FF627BF2000-memory.dmp	xmrig
behavioral2/memory/4868-2129-0x00007FF6EB580000-0x00007FF6EB972000-memory.dmp	xmrig
behavioral2/memory/1656-2148-0x00007FF66BE60000-0x00007FF66C252000-memory.dmp	xmrig
behavioral2/memory/2432-2142-0x00007FF71BB10000-0x00007FF71BF02000-memory.dmp	xmrig
behavioral2/memory/556-2138-0x00007FF6D9A70000-0x00007FF6D9E62000-memory.dmp	xmrig
behavioral2/memory/828-2133-0x00007FF7FD420000-0x00007FF7FD812000-memory.dmp	xmrig
behavioral2/memory/4708-2131-0x00007FF6D31A0000-0x00007FF6D3592000-memory.dmp	xmrig
behavioral2/memory/2880-2122-0x00007FF7A4530000-0x00007FF7A4922000-memory.dmp	xmrig
behavioral2/memory/4720-2124-0x00007FF7BC580000-0x00007FF7BC972000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4136	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4756	rDgVdfb.exe
1836	mHeeqBd.exe
3620	nqAgeLj.exe
4596	EWOCLha.exe
1504	QXqxfKB.exe
2560	JZXlncZ.exe
3076	OjitydW.exe
4840	KRShwoF.exe
1004	Ssmckbn.exe
3212	oyVnpaw.exe
3168	wVpRWhQ.exe
4720	znZjgyn.exe
2880	AcbyhPG.exe
5024	QrIjcru.exe
1656	CpamIxy.exe
1624	ylbRVxB.exe
3340	NqirAHf.exe
2432	DCBsFgl.exe
1400	qpTMYkj.exe
556	MDefFPH.exe
1556	JldMdQR.exe
828	FBxCubx.exe
4708	SOvXnFf.exe
4868	TCvdftt.exe
2028	PhfMrTb.exe
4760	VtUtLji.exe
1584	yFEjmUj.exe
2428	ugdzAqE.exe
1368	iYzwHxc.exe
1256	TorYvth.exe
996	DYlHzzb.exe
3988	RIbLKFI.exe
3864	CmQlWTE.exe
2244	AdYTliH.exe
2144	nbpWJgF.exe
1552	mcNDgoc.exe
4852	DWTjASv.exe
2956	CipOrZk.exe
1208	GwiZwiD.exe
3452	CNbmJXa.exe
2908	FkFoHcM.exe
4880	YWbCGLe.exe
5032	kljKIkq.exe
4280	ULVuBhu.exe
4908	TJAeOsN.exe
4404	sAaYDsk.exe
956	tRqQTBB.exe
216	OGtGOMb.exe
3196	pwRkhAS.exe
4488	llBSTCx.exe
3836	DbIsund.exe
4384	JMHyHnF.exe
4812	hceCFxD.exe
4308	fKMoGof.exe
4792	uPnsMfV.exe
1112	miynpSc.exe
1752	AKZwnrw.exe
3464	eQZTOsb.exe
3700	attjSQx.exe
3388	erUadIx.exe
3660	BifAuDK.exe
2212	HtFPNjH.exe
1632	sXDmSAJ.exe
4640	SoJhiJK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1036-0-0x00007FF65DBB0000-0x00007FF65DFA2000-memory.dmp	upx
behavioral2/files/0x00090000000233f6-5.dat	upx
behavioral2/files/0x0007000000023404-15.dat	upx
behavioral2/files/0x0007000000023403-16.dat	upx
behavioral2/files/0x0007000000023405-21.dat	upx
behavioral2/files/0x0007000000023406-27.dat	upx
behavioral2/files/0x0007000000023407-28.dat	upx
behavioral2/memory/4756-12-0x00007FF6466E0000-0x00007FF646AD2000-memory.dmp	upx
behavioral2/files/0x000700000002340b-50.dat	upx
behavioral2/memory/3620-48-0x00007FF7822F0000-0x00007FF7826E2000-memory.dmp	upx
behavioral2/files/0x000700000002340c-72.dat	upx
behavioral2/files/0x00090000000233fc-98.dat	upx
behavioral2/files/0x0007000000023414-115.dat	upx
behavioral2/files/0x0007000000023416-125.dat	upx
behavioral2/files/0x0007000000023418-135.dat	upx
behavioral2/files/0x000700000002341a-145.dat	upx
behavioral2/files/0x000700000002341e-173.dat	upx
behavioral2/memory/2560-433-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp	upx
behavioral2/memory/3076-436-0x00007FF7BFB70000-0x00007FF7BFF62000-memory.dmp	upx
behavioral2/memory/1004-445-0x00007FF797000000-0x00007FF7973F2000-memory.dmp	upx
behavioral2/memory/4720-451-0x00007FF7BC580000-0x00007FF7BC972000-memory.dmp	upx
behavioral2/memory/2880-455-0x00007FF7A4530000-0x00007FF7A4922000-memory.dmp	upx
behavioral2/memory/1624-474-0x00007FF7A1DA0000-0x00007FF7A2192000-memory.dmp	upx
behavioral2/memory/556-509-0x00007FF6D9A70000-0x00007FF6D9E62000-memory.dmp	upx
behavioral2/memory/1400-496-0x00007FF695010000-0x00007FF695402000-memory.dmp	upx
behavioral2/memory/1556-523-0x00007FF627800000-0x00007FF627BF2000-memory.dmp	upx
behavioral2/memory/4868-533-0x00007FF6EB580000-0x00007FF6EB972000-memory.dmp	upx
behavioral2/memory/4840-555-0x00007FF75CD20000-0x00007FF75D112000-memory.dmp	upx
behavioral2/memory/4708-528-0x00007FF6D31A0000-0x00007FF6D3592000-memory.dmp	upx
behavioral2/memory/828-524-0x00007FF7FD420000-0x00007FF7FD812000-memory.dmp	upx
behavioral2/memory/2432-485-0x00007FF71BB10000-0x00007FF71BF02000-memory.dmp	upx
behavioral2/memory/3340-482-0x00007FF6275A0000-0x00007FF627992000-memory.dmp	upx
behavioral2/memory/1656-466-0x00007FF66BE60000-0x00007FF66C252000-memory.dmp	upx
behavioral2/memory/5024-460-0x00007FF656A60000-0x00007FF656E52000-memory.dmp	upx
behavioral2/memory/3212-561-0x00007FF732E60000-0x00007FF733252000-memory.dmp	upx
behavioral2/memory/3168-566-0x00007FF627920000-0x00007FF627D12000-memory.dmp	upx
behavioral2/files/0x0007000000023421-180.dat	upx
behavioral2/files/0x000700000002341f-178.dat	upx
behavioral2/files/0x0007000000023420-175.dat	upx
behavioral2/files/0x000700000002341d-168.dat	upx
behavioral2/files/0x000700000002341c-163.dat	upx
behavioral2/files/0x000700000002341b-158.dat	upx
behavioral2/files/0x0007000000023419-148.dat	upx
behavioral2/files/0x0007000000023417-138.dat	upx
behavioral2/files/0x0007000000023415-128.dat	upx
behavioral2/files/0x0007000000023413-118.dat	upx
behavioral2/files/0x0007000000023412-113.dat	upx
behavioral2/files/0x000800000002340e-108.dat	upx
behavioral2/files/0x0007000000023411-103.dat	upx
behavioral2/files/0x0007000000023410-93.dat	upx
behavioral2/files/0x000800000002340f-85.dat	upx
behavioral2/files/0x000700000002340d-83.dat	upx
behavioral2/files/0x0007000000023409-53.dat	upx
behavioral2/memory/1504-71-0x00007FF7D1EF0000-0x00007FF7D22E2000-memory.dmp	upx
behavioral2/files/0x000700000002340a-54.dat	upx
behavioral2/memory/4596-52-0x00007FF715300000-0x00007FF7156F2000-memory.dmp	upx
behavioral2/files/0x0007000000023408-44.dat	upx
behavioral2/memory/1836-42-0x00007FF6D5FE0000-0x00007FF6D63D2000-memory.dmp	upx
behavioral2/memory/4756-2101-0x00007FF6466E0000-0x00007FF646AD2000-memory.dmp	upx
behavioral2/memory/1836-2103-0x00007FF6D5FE0000-0x00007FF6D63D2000-memory.dmp	upx
behavioral2/memory/4596-2106-0x00007FF715300000-0x00007FF7156F2000-memory.dmp	upx
behavioral2/memory/3620-2107-0x00007FF7822F0000-0x00007FF7826E2000-memory.dmp	upx
behavioral2/memory/1504-2110-0x00007FF7D1EF0000-0x00007FF7D22E2000-memory.dmp	upx
behavioral2/memory/2560-2113-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YQdwEaI.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\DhTZchX.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\tRqQTBB.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\aFmquWh.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\ezoBgWp.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\QVvYXTB.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\WwsPNIJ.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\IfmXSDs.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\RXYNpox.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\pPzYPbA.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\DEFMjBh.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\TQHOmGt.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\PvdITcO.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\nkaeCaF.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\sBQZgOH.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\bhkxXBF.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\emSuAkb.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\xizOzgc.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\FQOOLai.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\OgjWWIO.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\xsUZdLC.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\zFHpNkw.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\UUCfBcS.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\lYyDiqc.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\KRZvqdP.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\TzyAsPT.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\hjtTjYn.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\ammItLi.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\gRFDtBp.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\efwCDwu.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\kkWIMxU.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\uYxDPRG.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\KwQJvxr.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\dZwOHwY.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\vROLVwu.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\YJxmagO.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\mYPJKhb.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\rYtSQNz.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\BDNWgGr.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\LbvSCVK.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\rqMrBUS.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\jBfMfDE.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\FocFmRU.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\CErwPgE.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\kvDARBo.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\jCrwGTS.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\sgTwOHk.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\OMgxFrf.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\gCXVNOT.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\HmhmWej.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\HdlIVcU.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\rzDZDRP.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\gwdvuIM.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\fuVbRtg.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\YLqxqcd.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\MLCznrQ.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\BifAuDK.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\RjzySKe.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\CEOAOWr.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\JUtdTkE.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\jRpAHlC.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\mhWyfkn.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\tijoRMt.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
File created	C:\Windows\System\QUVowPW.exe	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeLockMemoryPrivilege	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4136	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	82
PID 1036 wrote to memory of 4136	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	82
PID 1036 wrote to memory of 4756	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	83
PID 1036 wrote to memory of 4756	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	83
PID 1036 wrote to memory of 1836	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	84
PID 1036 wrote to memory of 1836	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	84
PID 1036 wrote to memory of 3620	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	85
PID 1036 wrote to memory of 3620	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	85
PID 1036 wrote to memory of 4596	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	86
PID 1036 wrote to memory of 4596	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	86
PID 1036 wrote to memory of 1504	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	87
PID 1036 wrote to memory of 1504	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	87
PID 1036 wrote to memory of 2560	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	88
PID 1036 wrote to memory of 2560	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	88
PID 1036 wrote to memory of 3076	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	89
PID 1036 wrote to memory of 3076	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	89
PID 1036 wrote to memory of 4840	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	90
PID 1036 wrote to memory of 4840	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	90
PID 1036 wrote to memory of 1004	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	91
PID 1036 wrote to memory of 1004	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	91
PID 1036 wrote to memory of 3212	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	92
PID 1036 wrote to memory of 3212	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	92
PID 1036 wrote to memory of 3168	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	93
PID 1036 wrote to memory of 3168	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	93
PID 1036 wrote to memory of 4720	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	94
PID 1036 wrote to memory of 4720	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	94
PID 1036 wrote to memory of 2880	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	95
PID 1036 wrote to memory of 2880	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	95
PID 1036 wrote to memory of 5024	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	96
PID 1036 wrote to memory of 5024	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	96
PID 1036 wrote to memory of 1656	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	97
PID 1036 wrote to memory of 1656	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	97
PID 1036 wrote to memory of 1624	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	98
PID 1036 wrote to memory of 1624	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	98
PID 1036 wrote to memory of 3340	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	99
PID 1036 wrote to memory of 3340	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	99
PID 1036 wrote to memory of 2432	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	100
PID 1036 wrote to memory of 2432	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	100
PID 1036 wrote to memory of 1400	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	101
PID 1036 wrote to memory of 1400	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	101
PID 1036 wrote to memory of 556	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	102
PID 1036 wrote to memory of 556	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	102
PID 1036 wrote to memory of 1556	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	103
PID 1036 wrote to memory of 1556	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	103
PID 1036 wrote to memory of 828	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	104
PID 1036 wrote to memory of 828	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	104
PID 1036 wrote to memory of 4708	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	105
PID 1036 wrote to memory of 4708	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	105
PID 1036 wrote to memory of 4868	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	106
PID 1036 wrote to memory of 4868	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	106
PID 1036 wrote to memory of 2028	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	107
PID 1036 wrote to memory of 2028	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	107
PID 1036 wrote to memory of 4760	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	108
PID 1036 wrote to memory of 4760	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	108
PID 1036 wrote to memory of 1584	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	109
PID 1036 wrote to memory of 1584	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	109
PID 1036 wrote to memory of 2428	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	110
PID 1036 wrote to memory of 2428	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	110
PID 1036 wrote to memory of 1368	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	111
PID 1036 wrote to memory of 1368	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	111
PID 1036 wrote to memory of 1256	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	112
PID 1036 wrote to memory of 1256	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	112
PID 1036 wrote to memory of 996	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	113
PID 1036 wrote to memory of 996	1036	1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe	113

C:\Users\Admin\AppData\Local\Temp\1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe
"C:\Users\Admin\AppData\Local\Temp\1760fd93ad71bfcdf76a84a48e968a47b14e60897e39a4ef70a53d8c0ebe5a8a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4136
- C:\Windows\System\rDgVdfb.exe
  C:\Windows\System\rDgVdfb.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\mHeeqBd.exe
  C:\Windows\System\mHeeqBd.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\nqAgeLj.exe
  C:\Windows\System\nqAgeLj.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\EWOCLha.exe
  C:\Windows\System\EWOCLha.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\QXqxfKB.exe
  C:\Windows\System\QXqxfKB.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\JZXlncZ.exe
  C:\Windows\System\JZXlncZ.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\OjitydW.exe
  C:\Windows\System\OjitydW.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\KRShwoF.exe
  C:\Windows\System\KRShwoF.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\Ssmckbn.exe
  C:\Windows\System\Ssmckbn.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\oyVnpaw.exe
  C:\Windows\System\oyVnpaw.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\wVpRWhQ.exe
  C:\Windows\System\wVpRWhQ.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\znZjgyn.exe
  C:\Windows\System\znZjgyn.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\AcbyhPG.exe
  C:\Windows\System\AcbyhPG.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\QrIjcru.exe
  C:\Windows\System\QrIjcru.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\CpamIxy.exe
  C:\Windows\System\CpamIxy.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\ylbRVxB.exe
  C:\Windows\System\ylbRVxB.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\NqirAHf.exe
  C:\Windows\System\NqirAHf.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\DCBsFgl.exe
  C:\Windows\System\DCBsFgl.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\qpTMYkj.exe
  C:\Windows\System\qpTMYkj.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\MDefFPH.exe
  C:\Windows\System\MDefFPH.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\JldMdQR.exe
  C:\Windows\System\JldMdQR.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\FBxCubx.exe
  C:\Windows\System\FBxCubx.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\SOvXnFf.exe
  C:\Windows\System\SOvXnFf.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\TCvdftt.exe
  C:\Windows\System\TCvdftt.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\PhfMrTb.exe
  C:\Windows\System\PhfMrTb.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\VtUtLji.exe
  C:\Windows\System\VtUtLji.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\yFEjmUj.exe
  C:\Windows\System\yFEjmUj.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\ugdzAqE.exe
  C:\Windows\System\ugdzAqE.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\iYzwHxc.exe
  C:\Windows\System\iYzwHxc.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\TorYvth.exe
  C:\Windows\System\TorYvth.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\DYlHzzb.exe
  C:\Windows\System\DYlHzzb.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\RIbLKFI.exe
  C:\Windows\System\RIbLKFI.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\CmQlWTE.exe
  C:\Windows\System\CmQlWTE.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\AdYTliH.exe
  C:\Windows\System\AdYTliH.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\nbpWJgF.exe
  C:\Windows\System\nbpWJgF.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\mcNDgoc.exe
  C:\Windows\System\mcNDgoc.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\DWTjASv.exe
  C:\Windows\System\DWTjASv.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\CipOrZk.exe
  C:\Windows\System\CipOrZk.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\GwiZwiD.exe
  C:\Windows\System\GwiZwiD.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\CNbmJXa.exe
  C:\Windows\System\CNbmJXa.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\FkFoHcM.exe
  C:\Windows\System\FkFoHcM.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\YWbCGLe.exe
  C:\Windows\System\YWbCGLe.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\kljKIkq.exe
  C:\Windows\System\kljKIkq.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\ULVuBhu.exe
  C:\Windows\System\ULVuBhu.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\TJAeOsN.exe
  C:\Windows\System\TJAeOsN.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\sAaYDsk.exe
  C:\Windows\System\sAaYDsk.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\tRqQTBB.exe
  C:\Windows\System\tRqQTBB.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\OGtGOMb.exe
  C:\Windows\System\OGtGOMb.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\pwRkhAS.exe
  C:\Windows\System\pwRkhAS.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\llBSTCx.exe
  C:\Windows\System\llBSTCx.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\DbIsund.exe
  C:\Windows\System\DbIsund.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\JMHyHnF.exe
  C:\Windows\System\JMHyHnF.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\hceCFxD.exe
  C:\Windows\System\hceCFxD.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\fKMoGof.exe
  C:\Windows\System\fKMoGof.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\uPnsMfV.exe
  C:\Windows\System\uPnsMfV.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\miynpSc.exe
  C:\Windows\System\miynpSc.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\AKZwnrw.exe
  C:\Windows\System\AKZwnrw.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\eQZTOsb.exe
  C:\Windows\System\eQZTOsb.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\attjSQx.exe
  C:\Windows\System\attjSQx.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\erUadIx.exe
  C:\Windows\System\erUadIx.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\BifAuDK.exe
  C:\Windows\System\BifAuDK.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\HtFPNjH.exe
  C:\Windows\System\HtFPNjH.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\sXDmSAJ.exe
  C:\Windows\System\sXDmSAJ.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\SoJhiJK.exe
  C:\Windows\System\SoJhiJK.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\wECMzZS.exe
  C:\Windows\System\wECMzZS.exe
  2⤵
  PID:3960
- C:\Windows\System\OivGqUv.exe
  C:\Windows\System\OivGqUv.exe
  2⤵
  PID:1156
- C:\Windows\System\gRFDtBp.exe
  C:\Windows\System\gRFDtBp.exe
  2⤵
  PID:1540
- C:\Windows\System\pRcMGtI.exe
  C:\Windows\System\pRcMGtI.exe
  2⤵
  PID:4436
- C:\Windows\System\tCNTJJW.exe
  C:\Windows\System\tCNTJJW.exe
  2⤵
  PID:2120
- C:\Windows\System\XzkHPjJ.exe
  C:\Windows\System\XzkHPjJ.exe
  2⤵
  PID:3692
- C:\Windows\System\xASXOIY.exe
  C:\Windows\System\xASXOIY.exe
  2⤵
  PID:1924
- C:\Windows\System\sMEEMBi.exe
  C:\Windows\System\sMEEMBi.exe
  2⤵
  PID:1992
- C:\Windows\System\uIWBQQt.exe
  C:\Windows\System\uIWBQQt.exe
  2⤵
  PID:1120
- C:\Windows\System\FocFmRU.exe
  C:\Windows\System\FocFmRU.exe
  2⤵
  PID:4624
- C:\Windows\System\UfKpqXJ.exe
  C:\Windows\System\UfKpqXJ.exe
  2⤵
  PID:1868
- C:\Windows\System\dXCrWZl.exe
  C:\Windows\System\dXCrWZl.exe
  2⤵
  PID:4072
- C:\Windows\System\DZccTVP.exe
  C:\Windows\System\DZccTVP.exe
  2⤵
  PID:4608
- C:\Windows\System\EKGiMAM.exe
  C:\Windows\System\EKGiMAM.exe
  2⤵
  PID:1832
- C:\Windows\System\aWBIsJU.exe
  C:\Windows\System\aWBIsJU.exe
  2⤵
  PID:1264
- C:\Windows\System\cJuzdJQ.exe
  C:\Windows\System\cJuzdJQ.exe
  2⤵
  PID:1204
- C:\Windows\System\voauskC.exe
  C:\Windows\System\voauskC.exe
  2⤵
  PID:4312
- C:\Windows\System\NEFMcUi.exe
  C:\Windows\System\NEFMcUi.exe
  2⤵
  PID:4052
- C:\Windows\System\jRpAHlC.exe
  C:\Windows\System\jRpAHlC.exe
  2⤵
  PID:660
- C:\Windows\System\MgkEfAa.exe
  C:\Windows\System\MgkEfAa.exe
  2⤵
  PID:3652
- C:\Windows\System\bClUMkp.exe
  C:\Windows\System\bClUMkp.exe
  2⤵
  PID:4940
- C:\Windows\System\swkcQZg.exe
  C:\Windows\System\swkcQZg.exe
  2⤵
  PID:2124
- C:\Windows\System\jsWemYJ.exe
  C:\Windows\System\jsWemYJ.exe
  2⤵
  PID:4976
- C:\Windows\System\WwsPNIJ.exe
  C:\Windows\System\WwsPNIJ.exe
  2⤵
  PID:8
- C:\Windows\System\tubnSEl.exe
  C:\Windows\System\tubnSEl.exe
  2⤵
  PID:3616
- C:\Windows\System\OEjXKlW.exe
  C:\Windows\System\OEjXKlW.exe
  2⤵
  PID:2936
- C:\Windows\System\MvYfBgu.exe
  C:\Windows\System\MvYfBgu.exe
  2⤵
  PID:3268
- C:\Windows\System\ziltAVq.exe
  C:\Windows\System\ziltAVq.exe
  2⤵
  PID:3760
- C:\Windows\System\CErwPgE.exe
  C:\Windows\System\CErwPgE.exe
  2⤵
  PID:4132
- C:\Windows\System\iAIBOGy.exe
  C:\Windows\System\iAIBOGy.exe
  2⤵
  PID:5140
- C:\Windows\System\gSfyNyE.exe
  C:\Windows\System\gSfyNyE.exe
  2⤵
  PID:5164
- C:\Windows\System\kdcTDlN.exe
  C:\Windows\System\kdcTDlN.exe
  2⤵
  PID:5192
- C:\Windows\System\nHtflmL.exe
  C:\Windows\System\nHtflmL.exe
  2⤵
  PID:5220
- C:\Windows\System\FAsQYmN.exe
  C:\Windows\System\FAsQYmN.exe
  2⤵
  PID:5248
- C:\Windows\System\hOWCdCv.exe
  C:\Windows\System\hOWCdCv.exe
  2⤵
  PID:5276
- C:\Windows\System\UdtloAO.exe
  C:\Windows\System\UdtloAO.exe
  2⤵
  PID:5304
- C:\Windows\System\HvDzGAz.exe
  C:\Windows\System\HvDzGAz.exe
  2⤵
  PID:5332
- C:\Windows\System\xHQXgwg.exe
  C:\Windows\System\xHQXgwg.exe
  2⤵
  PID:5360
- C:\Windows\System\HOyIcTn.exe
  C:\Windows\System\HOyIcTn.exe
  2⤵
  PID:5392
- C:\Windows\System\BDNWgGr.exe
  C:\Windows\System\BDNWgGr.exe
  2⤵
  PID:5416
- C:\Windows\System\gwdvuIM.exe
  C:\Windows\System\gwdvuIM.exe
  2⤵
  PID:5448
- C:\Windows\System\JiYWjVh.exe
  C:\Windows\System\JiYWjVh.exe
  2⤵
  PID:5476
- C:\Windows\System\bVhRgBK.exe
  C:\Windows\System\bVhRgBK.exe
  2⤵
  PID:5504
- C:\Windows\System\ZMvfaKx.exe
  C:\Windows\System\ZMvfaKx.exe
  2⤵
  PID:5532
- C:\Windows\System\XSVAmLW.exe
  C:\Windows\System\XSVAmLW.exe
  2⤵
  PID:5556
- C:\Windows\System\mAUBXTH.exe
  C:\Windows\System\mAUBXTH.exe
  2⤵
  PID:5584
- C:\Windows\System\JBkRgdD.exe
  C:\Windows\System\JBkRgdD.exe
  2⤵
  PID:5612
- C:\Windows\System\IfmXSDs.exe
  C:\Windows\System\IfmXSDs.exe
  2⤵
  PID:5640
- C:\Windows\System\DxAPuNJ.exe
  C:\Windows\System\DxAPuNJ.exe
  2⤵
  PID:5668
- C:\Windows\System\AftCIjj.exe
  C:\Windows\System\AftCIjj.exe
  2⤵
  PID:5696
- C:\Windows\System\RIhATdV.exe
  C:\Windows\System\RIhATdV.exe
  2⤵
  PID:5728
- C:\Windows\System\ytUDiIz.exe
  C:\Windows\System\ytUDiIz.exe
  2⤵
  PID:5756
- C:\Windows\System\ifAQxkm.exe
  C:\Windows\System\ifAQxkm.exe
  2⤵
  PID:5784
- C:\Windows\System\XDKipiK.exe
  C:\Windows\System\XDKipiK.exe
  2⤵
  PID:5812
- C:\Windows\System\RSbpmQk.exe
  C:\Windows\System\RSbpmQk.exe
  2⤵
  PID:5852
- C:\Windows\System\TQHOmGt.exe
  C:\Windows\System\TQHOmGt.exe
  2⤵
  PID:5908
- C:\Windows\System\pcJZkHw.exe
  C:\Windows\System\pcJZkHw.exe
  2⤵
  PID:5924
- C:\Windows\System\lEWICZz.exe
  C:\Windows\System\lEWICZz.exe
  2⤵
  PID:5944
- C:\Windows\System\TNHOVfy.exe
  C:\Windows\System\TNHOVfy.exe
  2⤵
  PID:5968
- C:\Windows\System\paxtJBB.exe
  C:\Windows\System\paxtJBB.exe
  2⤵
  PID:5984
- C:\Windows\System\nuDdksS.exe
  C:\Windows\System\nuDdksS.exe
  2⤵
  PID:6008
- C:\Windows\System\vmLxwaS.exe
  C:\Windows\System\vmLxwaS.exe
  2⤵
  PID:6052
- C:\Windows\System\xsUZdLC.exe
  C:\Windows\System\xsUZdLC.exe
  2⤵
  PID:6104
- C:\Windows\System\twwnkMd.exe
  C:\Windows\System\twwnkMd.exe
  2⤵
  PID:6140
- C:\Windows\System\yoxKcMq.exe
  C:\Windows\System\yoxKcMq.exe
  2⤵
  PID:2788
- C:\Windows\System\txsYjdK.exe
  C:\Windows\System\txsYjdK.exe
  2⤵
  PID:2584
- C:\Windows\System\LBhzkVA.exe
  C:\Windows\System\LBhzkVA.exe
  2⤵
  PID:3948
- C:\Windows\System\bhkxXBF.exe
  C:\Windows\System\bhkxXBF.exe
  2⤵
  PID:5124
- C:\Windows\System\wFnJEap.exe
  C:\Windows\System\wFnJEap.exe
  2⤵
  PID:5180
- C:\Windows\System\ObOgGqV.exe
  C:\Windows\System\ObOgGqV.exe
  2⤵
  PID:3432
- C:\Windows\System\UHHgZTO.exe
  C:\Windows\System\UHHgZTO.exe
  2⤵
  PID:5268
- C:\Windows\System\MjRQONF.exe
  C:\Windows\System\MjRQONF.exe
  2⤵
  PID:5320
- C:\Windows\System\nmPJeaW.exe
  C:\Windows\System\nmPJeaW.exe
  2⤵
  PID:520
- C:\Windows\System\KbjnWSy.exe
  C:\Windows\System\KbjnWSy.exe
  2⤵
  PID:5440
- C:\Windows\System\aFmquWh.exe
  C:\Windows\System\aFmquWh.exe
  2⤵
  PID:5492
- C:\Windows\System\YJxmagO.exe
  C:\Windows\System\YJxmagO.exe
  2⤵
  PID:4176
- C:\Windows\System\UlYqWlZ.exe
  C:\Windows\System\UlYqWlZ.exe
  2⤵
  PID:5548
- C:\Windows\System\pONAIBp.exe
  C:\Windows\System\pONAIBp.exe
  2⤵
  PID:5580
- C:\Windows\System\LBSRHVO.exe
  C:\Windows\System\LBSRHVO.exe
  2⤵
  PID:5604
- C:\Windows\System\WoJqaXw.exe
  C:\Windows\System\WoJqaXw.exe
  2⤵
  PID:3372
- C:\Windows\System\SwQpeSc.exe
  C:\Windows\System\SwQpeSc.exe
  2⤵
  PID:5684
- C:\Windows\System\yOkpryx.exe
  C:\Windows\System\yOkpryx.exe
  2⤵
  PID:3208
- C:\Windows\System\FCyJuoX.exe
  C:\Windows\System\FCyJuoX.exe
  2⤵
  PID:3244
- C:\Windows\System\GrYMctE.exe
  C:\Windows\System\GrYMctE.exe
  2⤵
  PID:5716
- C:\Windows\System\eTRhrWK.exe
  C:\Windows\System\eTRhrWK.exe
  2⤵
  PID:1444
- C:\Windows\System\jYsmUjz.exe
  C:\Windows\System\jYsmUjz.exe
  2⤵
  PID:5956
- C:\Windows\System\EZOVYjK.exe
  C:\Windows\System\EZOVYjK.exe
  2⤵
  PID:5916
- C:\Windows\System\kOgutRb.exe
  C:\Windows\System\kOgutRb.exe
  2⤵
  PID:6048
- C:\Windows\System\AVjpDeL.exe
  C:\Windows\System\AVjpDeL.exe
  2⤵
  PID:2324
- C:\Windows\System\luNyiRN.exe
  C:\Windows\System\luNyiRN.exe
  2⤵
  PID:1848
- C:\Windows\System\chQgknB.exe
  C:\Windows\System\chQgknB.exe
  2⤵
  PID:5188
- C:\Windows\System\ASAuLsv.exe
  C:\Windows\System\ASAuLsv.exe
  2⤵
  PID:5544
- C:\Windows\System\BrGmMSN.exe
  C:\Windows\System\BrGmMSN.exe
  2⤵
  PID:5796
- C:\Windows\System\JfbRYfo.exe
  C:\Windows\System\JfbRYfo.exe
  2⤵
  PID:5692
- C:\Windows\System\OWKwqtZ.exe
  C:\Windows\System\OWKwqtZ.exe
  2⤵
  PID:3164
- C:\Windows\System\mjhZYPs.exe
  C:\Windows\System\mjhZYPs.exe
  2⤵
  PID:840
- C:\Windows\System\RFDwPMG.exe
  C:\Windows\System\RFDwPMG.exe
  2⤵
  PID:6000
- C:\Windows\System\RTJyjkh.exe
  C:\Windows\System\RTJyjkh.exe
  2⤵
  PID:5936
- C:\Windows\System\hqWyvXH.exe
  C:\Windows\System\hqWyvXH.exe
  2⤵
  PID:3264
- C:\Windows\System\zZXCqEv.exe
  C:\Windows\System\zZXCqEv.exe
  2⤵
  PID:5516
- C:\Windows\System\JcrpVAV.exe
  C:\Windows\System\JcrpVAV.exe
  2⤵
  PID:5292
- C:\Windows\System\ImpMIDM.exe
  C:\Windows\System\ImpMIDM.exe
  2⤵
  PID:3448
- C:\Windows\System\ICwTiEu.exe
  C:\Windows\System\ICwTiEu.exe
  2⤵
  PID:5720
- C:\Windows\System\KqOCbrS.exe
  C:\Windows\System\KqOCbrS.exe
  2⤵
  PID:3316
- C:\Windows\System\XbIEgHo.exe
  C:\Windows\System\XbIEgHo.exe
  2⤵
  PID:4768
- C:\Windows\System\ByUgshi.exe
  C:\Windows\System\ByUgshi.exe
  2⤵
  PID:6156
- C:\Windows\System\ktfgZbJ.exe
  C:\Windows\System\ktfgZbJ.exe
  2⤵
  PID:6172
- C:\Windows\System\WYLwWLY.exe
  C:\Windows\System\WYLwWLY.exe
  2⤵
  PID:6196
- C:\Windows\System\SHJPXkx.exe
  C:\Windows\System\SHJPXkx.exe
  2⤵
  PID:6236
- C:\Windows\System\WxQpqfa.exe
  C:\Windows\System\WxQpqfa.exe
  2⤵
  PID:6260
- C:\Windows\System\unEawpB.exe
  C:\Windows\System\unEawpB.exe
  2⤵
  PID:6280
- C:\Windows\System\Fprsjgr.exe
  C:\Windows\System\Fprsjgr.exe
  2⤵
  PID:6308
- C:\Windows\System\OMgxFrf.exe
  C:\Windows\System\OMgxFrf.exe
  2⤵
  PID:6340
- C:\Windows\System\WhocdfD.exe
  C:\Windows\System\WhocdfD.exe
  2⤵
  PID:6372
- C:\Windows\System\lcqCYqK.exe
  C:\Windows\System\lcqCYqK.exe
  2⤵
  PID:6396
- C:\Windows\System\QPXXkpq.exe
  C:\Windows\System\QPXXkpq.exe
  2⤵
  PID:6416
- C:\Windows\System\NqJwJte.exe
  C:\Windows\System\NqJwJte.exe
  2⤵
  PID:6456
- C:\Windows\System\nKOIyYh.exe
  C:\Windows\System\nKOIyYh.exe
  2⤵
  PID:6536
- C:\Windows\System\IgsyQtf.exe
  C:\Windows\System\IgsyQtf.exe
  2⤵
  PID:6560
- C:\Windows\System\emSuAkb.exe
  C:\Windows\System\emSuAkb.exe
  2⤵
  PID:6596
- C:\Windows\System\KReoFeL.exe
  C:\Windows\System\KReoFeL.exe
  2⤵
  PID:6616
- C:\Windows\System\sVSeWIY.exe
  C:\Windows\System\sVSeWIY.exe
  2⤵
  PID:6632
- C:\Windows\System\bpEhtUc.exe
  C:\Windows\System\bpEhtUc.exe
  2⤵
  PID:6676
- C:\Windows\System\kmgYDNb.exe
  C:\Windows\System\kmgYDNb.exe
  2⤵
  PID:6716
- C:\Windows\System\rxWArPh.exe
  C:\Windows\System\rxWArPh.exe
  2⤵
  PID:6748
- C:\Windows\System\BeuPtSJ.exe
  C:\Windows\System\BeuPtSJ.exe
  2⤵
  PID:6776
- C:\Windows\System\njaWDua.exe
  C:\Windows\System\njaWDua.exe
  2⤵
  PID:6804
- C:\Windows\System\mnDDSCv.exe
  C:\Windows\System\mnDDSCv.exe
  2⤵
  PID:6828
- C:\Windows\System\gaXPLqx.exe
  C:\Windows\System\gaXPLqx.exe
  2⤵
  PID:6848
- C:\Windows\System\uIMmkfb.exe
  C:\Windows\System\uIMmkfb.exe
  2⤵
  PID:6868
- C:\Windows\System\kolMXSl.exe
  C:\Windows\System\kolMXSl.exe
  2⤵
  PID:6904
- C:\Windows\System\yQgePBe.exe
  C:\Windows\System\yQgePBe.exe
  2⤵
  PID:6924
- C:\Windows\System\OowtLuW.exe
  C:\Windows\System\OowtLuW.exe
  2⤵
  PID:6948
- C:\Windows\System\lsiwTpd.exe
  C:\Windows\System\lsiwTpd.exe
  2⤵
  PID:6972
- C:\Windows\System\gwuIfaj.exe
  C:\Windows\System\gwuIfaj.exe
  2⤵
  PID:6988
- C:\Windows\System\fauFEvR.exe
  C:\Windows\System\fauFEvR.exe
  2⤵
  PID:7016
- C:\Windows\System\gNykjkY.exe
  C:\Windows\System\gNykjkY.exe
  2⤵
  PID:7036
- C:\Windows\System\xppYQZN.exe
  C:\Windows\System\xppYQZN.exe
  2⤵
  PID:7056
- C:\Windows\System\PvdITcO.exe
  C:\Windows\System\PvdITcO.exe
  2⤵
  PID:7080
- C:\Windows\System\cNpgZnT.exe
  C:\Windows\System\cNpgZnT.exe
  2⤵
  PID:7096
- C:\Windows\System\YexiNgs.exe
  C:\Windows\System\YexiNgs.exe
  2⤵
  PID:7120
- C:\Windows\System\XpyWqLK.exe
  C:\Windows\System\XpyWqLK.exe
  2⤵
  PID:7136
- C:\Windows\System\MWRZMxL.exe
  C:\Windows\System\MWRZMxL.exe
  2⤵
  PID:5980
- C:\Windows\System\mQMmXuO.exe
  C:\Windows\System\mQMmXuO.exe
  2⤵
  PID:5348
- C:\Windows\System\xCoXPje.exe
  C:\Windows\System\xCoXPje.exe
  2⤵
  PID:6180
- C:\Windows\System\tEEPbyR.exe
  C:\Windows\System\tEEPbyR.exe
  2⤵
  PID:6212
- C:\Windows\System\ruCvNhm.exe
  C:\Windows\System\ruCvNhm.exe
  2⤵
  PID:6320
- C:\Windows\System\IwBfjKa.exe
  C:\Windows\System\IwBfjKa.exe
  2⤵
  PID:596
- C:\Windows\System\lcAPEdV.exe
  C:\Windows\System\lcAPEdV.exe
  2⤵
  PID:6384
- C:\Windows\System\QCnTHdi.exe
  C:\Windows\System\QCnTHdi.exe
  2⤵
  PID:6352
- C:\Windows\System\acwHxqT.exe
  C:\Windows\System\acwHxqT.exe
  2⤵
  PID:6504
- C:\Windows\System\ZsrjxgC.exe
  C:\Windows\System\ZsrjxgC.exe
  2⤵
  PID:6624
- C:\Windows\System\IqeyOgo.exe
  C:\Windows\System\IqeyOgo.exe
  2⤵
  PID:6820
- C:\Windows\System\GcQiLuV.exe
  C:\Windows\System\GcQiLuV.exe
  2⤵
  PID:6916
- C:\Windows\System\MEvKYjf.exe
  C:\Windows\System\MEvKYjf.exe
  2⤵
  PID:6024
- C:\Windows\System\uoLOJqb.exe
  C:\Windows\System\uoLOJqb.exe
  2⤵
  PID:6940
- C:\Windows\System\PvKNuGQ.exe
  C:\Windows\System\PvKNuGQ.exe
  2⤵
  PID:1220
- C:\Windows\System\kvDARBo.exe
  C:\Windows\System\kvDARBo.exe
  2⤵
  PID:4716
- C:\Windows\System\EnbllxJ.exe
  C:\Windows\System\EnbllxJ.exe
  2⤵
  PID:7072
- C:\Windows\System\LFZzHUA.exe
  C:\Windows\System\LFZzHUA.exe
  2⤵
  PID:5468
- C:\Windows\System\HerhMLh.exe
  C:\Windows\System\HerhMLh.exe
  2⤵
  PID:7144
- C:\Windows\System\sKNprYf.exe
  C:\Windows\System\sKNprYf.exe
  2⤵
  PID:6276
- C:\Windows\System\AVZsNWt.exe
  C:\Windows\System\AVZsNWt.exe
  2⤵
  PID:6772
- C:\Windows\System\KDXSUwY.exe
  C:\Windows\System\KDXSUwY.exe
  2⤵
  PID:6816
- C:\Windows\System\aVazELY.exe
  C:\Windows\System\aVazELY.exe
  2⤵
  PID:5744
- C:\Windows\System\HfYXLKo.exe
  C:\Windows\System\HfYXLKo.exe
  2⤵
  PID:6932
- C:\Windows\System\ydMtbRN.exe
  C:\Windows\System\ydMtbRN.exe
  2⤵
  PID:7004
- C:\Windows\System\mJqwbyD.exe
  C:\Windows\System\mJqwbyD.exe
  2⤵
  PID:4412
- C:\Windows\System\TwcZgjL.exe
  C:\Windows\System\TwcZgjL.exe
  2⤵
  PID:6388
- C:\Windows\System\LHJyqvc.exe
  C:\Windows\System\LHJyqvc.exe
  2⤵
  PID:6588
- C:\Windows\System\oOgcasN.exe
  C:\Windows\System\oOgcasN.exe
  2⤵
  PID:7000
- C:\Windows\System\YhcYQIL.exe
  C:\Windows\System\YhcYQIL.exe
  2⤵
  PID:7024
- C:\Windows\System\PjGrxgC.exe
  C:\Windows\System\PjGrxgC.exe
  2⤵
  PID:7172
- C:\Windows\System\ZBSnjaZ.exe
  C:\Windows\System\ZBSnjaZ.exe
  2⤵
  PID:7192
- C:\Windows\System\HvBWraa.exe
  C:\Windows\System\HvBWraa.exe
  2⤵
  PID:7208
- C:\Windows\System\QiffFnA.exe
  C:\Windows\System\QiffFnA.exe
  2⤵
  PID:7232
- C:\Windows\System\qqXawYB.exe
  C:\Windows\System\qqXawYB.exe
  2⤵
  PID:7248
- C:\Windows\System\GLXKPMU.exe
  C:\Windows\System\GLXKPMU.exe
  2⤵
  PID:7268
- C:\Windows\System\jFPVKUS.exe
  C:\Windows\System\jFPVKUS.exe
  2⤵
  PID:7288
- C:\Windows\System\aXHedeX.exe
  C:\Windows\System\aXHedeX.exe
  2⤵
  PID:7348
- C:\Windows\System\zFHpNkw.exe
  C:\Windows\System\zFHpNkw.exe
  2⤵
  PID:7376
- C:\Windows\System\XQHcHGr.exe
  C:\Windows\System\XQHcHGr.exe
  2⤵
  PID:7412
- C:\Windows\System\wwvmPim.exe
  C:\Windows\System\wwvmPim.exe
  2⤵
  PID:7440
- C:\Windows\System\gIeHrNn.exe
  C:\Windows\System\gIeHrNn.exe
  2⤵
  PID:7460
- C:\Windows\System\gXGfMqe.exe
  C:\Windows\System\gXGfMqe.exe
  2⤵
  PID:7480
- C:\Windows\System\ZxGcPRv.exe
  C:\Windows\System\ZxGcPRv.exe
  2⤵
  PID:7500
- C:\Windows\System\GdFyaQh.exe
  C:\Windows\System\GdFyaQh.exe
  2⤵
  PID:7536
- C:\Windows\System\JNtpUaS.exe
  C:\Windows\System\JNtpUaS.exe
  2⤵
  PID:7572
- C:\Windows\System\GlRvngA.exe
  C:\Windows\System\GlRvngA.exe
  2⤵
  PID:7596
- C:\Windows\System\LTrvhtQ.exe
  C:\Windows\System\LTrvhtQ.exe
  2⤵
  PID:7636
- C:\Windows\System\lkqLDuu.exe
  C:\Windows\System\lkqLDuu.exe
  2⤵
  PID:7660
- C:\Windows\System\WPpYcxW.exe
  C:\Windows\System\WPpYcxW.exe
  2⤵
  PID:7684
- C:\Windows\System\fuVbRtg.exe
  C:\Windows\System\fuVbRtg.exe
  2⤵
  PID:7712
- C:\Windows\System\efwCDwu.exe
  C:\Windows\System\efwCDwu.exe
  2⤵
  PID:7732
- C:\Windows\System\VsgqTic.exe
  C:\Windows\System\VsgqTic.exe
  2⤵
  PID:7756
- C:\Windows\System\ORLytNr.exe
  C:\Windows\System\ORLytNr.exe
  2⤵
  PID:7780
- C:\Windows\System\ufdqeXM.exe
  C:\Windows\System\ufdqeXM.exe
  2⤵
  PID:7824
- C:\Windows\System\pkPzzNU.exe
  C:\Windows\System\pkPzzNU.exe
  2⤵
  PID:7848
- C:\Windows\System\kkWIMxU.exe
  C:\Windows\System\kkWIMxU.exe
  2⤵
  PID:7884
- C:\Windows\System\BFGgOPC.exe
  C:\Windows\System\BFGgOPC.exe
  2⤵
  PID:7912
- C:\Windows\System\vbPDPel.exe
  C:\Windows\System\vbPDPel.exe
  2⤵
  PID:7936
- C:\Windows\System\XbzVyXy.exe
  C:\Windows\System\XbzVyXy.exe
  2⤵
  PID:7952
- C:\Windows\System\WaAPFQp.exe
  C:\Windows\System\WaAPFQp.exe
  2⤵
  PID:7980
- C:\Windows\System\EMHWKmr.exe
  C:\Windows\System\EMHWKmr.exe
  2⤵
  PID:8036
- C:\Windows\System\PjIzNQt.exe
  C:\Windows\System\PjIzNQt.exe
  2⤵
  PID:8068
- C:\Windows\System\NiYSGUL.exe
  C:\Windows\System\NiYSGUL.exe
  2⤵
  PID:8084
- C:\Windows\System\pCNpAiI.exe
  C:\Windows\System\pCNpAiI.exe
  2⤵
  PID:8116
- C:\Windows\System\UUCfBcS.exe
  C:\Windows\System\UUCfBcS.exe
  2⤵
  PID:8132
- C:\Windows\System\FjxgbxI.exe
  C:\Windows\System\FjxgbxI.exe
  2⤵
  PID:8156
- C:\Windows\System\nGKeXRv.exe
  C:\Windows\System\nGKeXRv.exe
  2⤵
  PID:6076
- C:\Windows\System\uLzPyVS.exe
  C:\Windows\System\uLzPyVS.exe
  2⤵
  PID:7224
- C:\Windows\System\zMoudjI.exe
  C:\Windows\System\zMoudjI.exe
  2⤵
  PID:7264
- C:\Windows\System\WNcytbm.exe
  C:\Windows\System\WNcytbm.exe
  2⤵
  PID:7328
- C:\Windows\System\tLajJAM.exe
  C:\Windows\System\tLajJAM.exe
  2⤵
  PID:7324
- C:\Windows\System\ohMIUxU.exe
  C:\Windows\System\ohMIUxU.exe
  2⤵
  PID:7496
- C:\Windows\System\gCXVNOT.exe
  C:\Windows\System\gCXVNOT.exe
  2⤵
  PID:7492
- C:\Windows\System\EaCeoCB.exe
  C:\Windows\System\EaCeoCB.exe
  2⤵
  PID:7564
- C:\Windows\System\TfKAwqG.exe
  C:\Windows\System\TfKAwqG.exe
  2⤵
  PID:7588
- C:\Windows\System\eOullWq.exe
  C:\Windows\System\eOullWq.exe
  2⤵
  PID:7724
- C:\Windows\System\BUNlBKw.exe
  C:\Windows\System\BUNlBKw.exe
  2⤵
  PID:7776
- C:\Windows\System\XrYhEMp.exe
  C:\Windows\System\XrYhEMp.exe
  2⤵
  PID:7812
- C:\Windows\System\xmRywfZ.exe
  C:\Windows\System\xmRywfZ.exe
  2⤵
  PID:7868
- C:\Windows\System\nPmRioZ.exe
  C:\Windows\System\nPmRioZ.exe
  2⤵
  PID:7928
- C:\Windows\System\umNWeay.exe
  C:\Windows\System\umNWeay.exe
  2⤵
  PID:8044
- C:\Windows\System\bVhhbtM.exe
  C:\Windows\System\bVhhbtM.exe
  2⤵
  PID:8096
- C:\Windows\System\iBlpvuz.exe
  C:\Windows\System\iBlpvuz.exe
  2⤵
  PID:8128
- C:\Windows\System\yNNWbXh.exe
  C:\Windows\System\yNNWbXh.exe
  2⤵
  PID:7220
- C:\Windows\System\SbVNvAY.exe
  C:\Windows\System\SbVNvAY.exe
  2⤵
  PID:7392
- C:\Windows\System\GypOEHp.exe
  C:\Windows\System\GypOEHp.exe
  2⤵
  PID:7612
- C:\Windows\System\PGkWsuz.exe
  C:\Windows\System\PGkWsuz.exe
  2⤵
  PID:7456
- C:\Windows\System\FJdunTP.exe
  C:\Windows\System\FJdunTP.exe
  2⤵
  PID:7800
- C:\Windows\System\JkmXMPm.exe
  C:\Windows\System\JkmXMPm.exe
  2⤵
  PID:7772
- C:\Windows\System\ADBpvzR.exe
  C:\Windows\System\ADBpvzR.exe
  2⤵
  PID:7988
- C:\Windows\System\cbFWEIY.exe
  C:\Windows\System\cbFWEIY.exe
  2⤵
  PID:8080
- C:\Windows\System\valysXG.exe
  C:\Windows\System\valysXG.exe
  2⤵
  PID:7680
- C:\Windows\System\rpTPVdl.exe
  C:\Windows\System\rpTPVdl.exe
  2⤵
  PID:1728
- C:\Windows\System\vQNhvpc.exe
  C:\Windows\System\vQNhvpc.exe
  2⤵
  PID:7840
- C:\Windows\System\iEtlDaX.exe
  C:\Windows\System\iEtlDaX.exe
  2⤵
  PID:8212
- C:\Windows\System\tugZEGP.exe
  C:\Windows\System\tugZEGP.exe
  2⤵
  PID:8236
- C:\Windows\System\mYnzzoS.exe
  C:\Windows\System\mYnzzoS.exe
  2⤵
  PID:8252
- C:\Windows\System\SBLjpCm.exe
  C:\Windows\System\SBLjpCm.exe
  2⤵
  PID:8268
- C:\Windows\System\OJCqKsH.exe
  C:\Windows\System\OJCqKsH.exe
  2⤵
  PID:8304
- C:\Windows\System\MRHdxcb.exe
  C:\Windows\System\MRHdxcb.exe
  2⤵
  PID:8332
- C:\Windows\System\JmdwAUN.exe
  C:\Windows\System\JmdwAUN.exe
  2⤵
  PID:8352
- C:\Windows\System\TwzOuVD.exe
  C:\Windows\System\TwzOuVD.exe
  2⤵
  PID:8368
- C:\Windows\System\NXlzSNF.exe
  C:\Windows\System\NXlzSNF.exe
  2⤵
  PID:8404
- C:\Windows\System\haswazt.exe
  C:\Windows\System\haswazt.exe
  2⤵
  PID:8432
- C:\Windows\System\oathiDV.exe
  C:\Windows\System\oathiDV.exe
  2⤵
  PID:8468
- C:\Windows\System\TnLEJCB.exe
  C:\Windows\System\TnLEJCB.exe
  2⤵
  PID:8488
- C:\Windows\System\kVKwRYr.exe
  C:\Windows\System\kVKwRYr.exe
  2⤵
  PID:8512
- C:\Windows\System\fqiIexu.exe
  C:\Windows\System\fqiIexu.exe
  2⤵
  PID:8532
- C:\Windows\System\xizOzgc.exe
  C:\Windows\System\xizOzgc.exe
  2⤵
  PID:8564
- C:\Windows\System\PlkksDm.exe
  C:\Windows\System\PlkksDm.exe
  2⤵
  PID:8584
- C:\Windows\System\xbmvjlG.exe
  C:\Windows\System\xbmvjlG.exe
  2⤵
  PID:8616
- C:\Windows\System\wTwbuVS.exe
  C:\Windows\System\wTwbuVS.exe
  2⤵
  PID:8640
- C:\Windows\System\FvbqYjj.exe
  C:\Windows\System\FvbqYjj.exe
  2⤵
  PID:8660
- C:\Windows\System\KAmeyoS.exe
  C:\Windows\System\KAmeyoS.exe
  2⤵
  PID:8696
- C:\Windows\System\liQzBDa.exe
  C:\Windows\System\liQzBDa.exe
  2⤵
  PID:8756
- C:\Windows\System\gEPZMEM.exe
  C:\Windows\System\gEPZMEM.exe
  2⤵
  PID:8784
- C:\Windows\System\mYPJKhb.exe
  C:\Windows\System\mYPJKhb.exe
  2⤵
  PID:8804
- C:\Windows\System\ZOCAffs.exe
  C:\Windows\System\ZOCAffs.exe
  2⤵
  PID:8824
- C:\Windows\System\VfCBGoH.exe
  C:\Windows\System\VfCBGoH.exe
  2⤵
  PID:8840
- C:\Windows\System\htAyTZo.exe
  C:\Windows\System\htAyTZo.exe
  2⤵
  PID:8868
- C:\Windows\System\RAKPtNp.exe
  C:\Windows\System\RAKPtNp.exe
  2⤵
  PID:8920
- C:\Windows\System\CvpgJox.exe
  C:\Windows\System\CvpgJox.exe
  2⤵
  PID:8940
- C:\Windows\System\fOFvIud.exe
  C:\Windows\System\fOFvIud.exe
  2⤵
  PID:8996
- C:\Windows\System\wgfXzuZ.exe
  C:\Windows\System\wgfXzuZ.exe
  2⤵
  PID:9016
- C:\Windows\System\VcDeuZT.exe
  C:\Windows\System\VcDeuZT.exe
  2⤵
  PID:9036
- C:\Windows\System\wscRaXY.exe
  C:\Windows\System\wscRaXY.exe
  2⤵
  PID:9052
- C:\Windows\System\wJklaiX.exe
  C:\Windows\System\wJklaiX.exe
  2⤵
  PID:9080
- C:\Windows\System\UfrbbXl.exe
  C:\Windows\System\UfrbbXl.exe
  2⤵
  PID:9104
- C:\Windows\System\CoLCLdP.exe
  C:\Windows\System\CoLCLdP.exe
  2⤵
  PID:9148
- C:\Windows\System\idIwFXR.exe
  C:\Windows\System\idIwFXR.exe
  2⤵
  PID:9164
- C:\Windows\System\rYtSQNz.exe
  C:\Windows\System\rYtSQNz.exe
  2⤵
  PID:9184
- C:\Windows\System\NwHjbnc.exe
  C:\Windows\System\NwHjbnc.exe
  2⤵
  PID:9208
- C:\Windows\System\SapHSRN.exe
  C:\Windows\System\SapHSRN.exe
  2⤵
  PID:8264
- C:\Windows\System\KCWySbg.exe
  C:\Windows\System\KCWySbg.exe
  2⤵
  PID:8320
- C:\Windows\System\OWYKRCu.exe
  C:\Windows\System\OWYKRCu.exe
  2⤵
  PID:8392
- C:\Windows\System\bgZppEw.exe
  C:\Windows\System\bgZppEw.exe
  2⤵
  PID:8444
- C:\Windows\System\uYxDPRG.exe
  C:\Windows\System\uYxDPRG.exe
  2⤵
  PID:8556
- C:\Windows\System\RXYNpox.exe
  C:\Windows\System\RXYNpox.exe
  2⤵
  PID:8612
- C:\Windows\System\SJoiWNl.exe
  C:\Windows\System\SJoiWNl.exe
  2⤵
  PID:8652
- C:\Windows\System\uhFyyay.exe
  C:\Windows\System\uhFyyay.exe
  2⤵
  PID:8752
- C:\Windows\System\wqsHnJP.exe
  C:\Windows\System\wqsHnJP.exe
  2⤵
  PID:8736
- C:\Windows\System\aXTjLcj.exe
  C:\Windows\System\aXTjLcj.exe
  2⤵
  PID:8836
- C:\Windows\System\qKcvGoh.exe
  C:\Windows\System\qKcvGoh.exe
  2⤵
  PID:8856
- C:\Windows\System\utSEWUc.exe
  C:\Windows\System\utSEWUc.exe
  2⤵
  PID:8964
- C:\Windows\System\QoVHtvl.exe
  C:\Windows\System\QoVHtvl.exe
  2⤵
  PID:9004
- C:\Windows\System\uKIMtwC.exe
  C:\Windows\System\uKIMtwC.exe
  2⤵
  PID:9120
- C:\Windows\System\eJMTxaE.exe
  C:\Windows\System\eJMTxaE.exe
  2⤵
  PID:8276
- C:\Windows\System\WVEyyCK.exe
  C:\Windows\System\WVEyyCK.exe
  2⤵
  PID:9200
- C:\Windows\System\CJAwSNk.exe
  C:\Windows\System\CJAwSNk.exe
  2⤵
  PID:8412
- C:\Windows\System\EjgXdio.exe
  C:\Windows\System\EjgXdio.exe
  2⤵
  PID:8528
- C:\Windows\System\MbeQkZG.exe
  C:\Windows\System\MbeQkZG.exe
  2⤵
  PID:8576
- C:\Windows\System\AcIGOgp.exe
  C:\Windows\System\AcIGOgp.exe
  2⤵
  PID:8748
- C:\Windows\System\PfeXuKW.exe
  C:\Windows\System\PfeXuKW.exe
  2⤵
  PID:8900
- C:\Windows\System\twwsNnQ.exe
  C:\Windows\System\twwsNnQ.exe
  2⤵
  PID:9048
- C:\Windows\System\wkMjjPK.exe
  C:\Windows\System\wkMjjPK.exe
  2⤵
  PID:9160
- C:\Windows\System\YLqxqcd.exe
  C:\Windows\System\YLqxqcd.exe
  2⤵
  PID:8636
- C:\Windows\System\KiMtkmL.exe
  C:\Windows\System\KiMtkmL.exe
  2⤵
  PID:8744
- C:\Windows\System\KRZvqdP.exe
  C:\Windows\System\KRZvqdP.exe
  2⤵
  PID:9252
- C:\Windows\System\nkaeCaF.exe
  C:\Windows\System\nkaeCaF.exe
  2⤵
  PID:9276
- C:\Windows\System\EqZvojH.exe
  C:\Windows\System\EqZvojH.exe
  2⤵
  PID:9324
- C:\Windows\System\jCrwGTS.exe
  C:\Windows\System\jCrwGTS.exe
  2⤵
  PID:9340
- C:\Windows\System\ffEGEYn.exe
  C:\Windows\System\ffEGEYn.exe
  2⤵
  PID:9360
- C:\Windows\System\jsoiZpI.exe
  C:\Windows\System\jsoiZpI.exe
  2⤵
  PID:9376
- C:\Windows\System\cGjmUPZ.exe
  C:\Windows\System\cGjmUPZ.exe
  2⤵
  PID:9416
- C:\Windows\System\tfQpyFu.exe
  C:\Windows\System\tfQpyFu.exe
  2⤵
  PID:9432
- C:\Windows\System\WnMlsEo.exe
  C:\Windows\System\WnMlsEo.exe
  2⤵
  PID:9452
- C:\Windows\System\mhWyfkn.exe
  C:\Windows\System\mhWyfkn.exe
  2⤵
  PID:9476
- C:\Windows\System\byauHlP.exe
  C:\Windows\System\byauHlP.exe
  2⤵
  PID:9496
- C:\Windows\System\fcoYZsZ.exe
  C:\Windows\System\fcoYZsZ.exe
  2⤵
  PID:9540
- C:\Windows\System\mClVJOT.exe
  C:\Windows\System\mClVJOT.exe
  2⤵
  PID:9688
- C:\Windows\System\LqOWDpB.exe
  C:\Windows\System\LqOWDpB.exe
  2⤵
  PID:9728
- C:\Windows\System\rvrrYVq.exe
  C:\Windows\System\rvrrYVq.exe
  2⤵
  PID:9744
- C:\Windows\System\jarqZtm.exe
  C:\Windows\System\jarqZtm.exe
  2⤵
  PID:9772
- C:\Windows\System\rheqRcl.exe
  C:\Windows\System\rheqRcl.exe
  2⤵
  PID:9816
- C:\Windows\System\RwGOVRQ.exe
  C:\Windows\System\RwGOVRQ.exe
  2⤵
  PID:9836
- C:\Windows\System\kUveoFB.exe
  C:\Windows\System\kUveoFB.exe
  2⤵
  PID:9896
- C:\Windows\System\ezoBgWp.exe
  C:\Windows\System\ezoBgWp.exe
  2⤵
  PID:9920
- C:\Windows\System\DIwtByw.exe
  C:\Windows\System\DIwtByw.exe
  2⤵
  PID:9940
- C:\Windows\System\TWTdZJE.exe
  C:\Windows\System\TWTdZJE.exe
  2⤵
  PID:9960
- C:\Windows\System\BImeGJG.exe
  C:\Windows\System\BImeGJG.exe
  2⤵
  PID:10000
- C:\Windows\System\HmhmWej.exe
  C:\Windows\System\HmhmWej.exe
  2⤵
  PID:10040
- C:\Windows\System\jJDjAAq.exe
  C:\Windows\System\jJDjAAq.exe
  2⤵
  PID:10060
- C:\Windows\System\frTvLEO.exe
  C:\Windows\System\frTvLEO.exe
  2⤵
  PID:10092
- C:\Windows\System\TBQQYMc.exe
  C:\Windows\System\TBQQYMc.exe
  2⤵
  PID:10116
- C:\Windows\System\TXqkNxu.exe
  C:\Windows\System\TXqkNxu.exe
  2⤵
  PID:10144
- C:\Windows\System\RuNVGit.exe
  C:\Windows\System\RuNVGit.exe
  2⤵
  PID:10164
- C:\Windows\System\KdmqcIG.exe
  C:\Windows\System\KdmqcIG.exe
  2⤵
  PID:10192
- C:\Windows\System\QjykeGf.exe
  C:\Windows\System\QjykeGf.exe
  2⤵
  PID:9204
- C:\Windows\System\fHAKBcn.exe
  C:\Windows\System\fHAKBcn.exe
  2⤵
  PID:8384
- C:\Windows\System\QVvYXTB.exe
  C:\Windows\System\QVvYXTB.exe
  2⤵
  PID:9248
- C:\Windows\System\LDmgkgD.exe
  C:\Windows\System\LDmgkgD.exe
  2⤵
  PID:9312
- C:\Windows\System\THvZoDh.exe
  C:\Windows\System\THvZoDh.exe
  2⤵
  PID:9348
- C:\Windows\System\RYNVWXu.exe
  C:\Windows\System\RYNVWXu.exe
  2⤵
  PID:9428
- C:\Windows\System\nqUHiNu.exe
  C:\Windows\System\nqUHiNu.exe
  2⤵
  PID:9464
- C:\Windows\System\mTfbKYg.exe
  C:\Windows\System\mTfbKYg.exe
  2⤵
  PID:9584
- C:\Windows\System\GFWpIan.exe
  C:\Windows\System\GFWpIan.exe
  2⤵
  PID:9604
- C:\Windows\System\qlLwBiy.exe
  C:\Windows\System\qlLwBiy.exe
  2⤵
  PID:9632
- C:\Windows\System\YQdwEaI.exe
  C:\Windows\System\YQdwEaI.exe
  2⤵
  PID:9708
- C:\Windows\System\tinYoRM.exe
  C:\Windows\System\tinYoRM.exe
  2⤵
  PID:9704
- C:\Windows\System\PtNQywE.exe
  C:\Windows\System\PtNQywE.exe
  2⤵
  PID:9832
- C:\Windows\System\mCMXlfq.exe
  C:\Windows\System\mCMXlfq.exe
  2⤵
  PID:9884
- C:\Windows\System\PDPkdKZ.exe
  C:\Windows\System\PDPkdKZ.exe
  2⤵
  PID:9968
- C:\Windows\System\nYFuQRG.exe
  C:\Windows\System\nYFuQRG.exe
  2⤵
  PID:10028
- C:\Windows\System\CrzLIdl.exe
  C:\Windows\System\CrzLIdl.exe
  2⤵
  PID:10080
- C:\Windows\System\XSRpRob.exe
  C:\Windows\System\XSRpRob.exe
  2⤵
  PID:10136
- C:\Windows\System\zPxJuuX.exe
  C:\Windows\System\zPxJuuX.exe
  2⤵
  PID:10180
- C:\Windows\System\TtdLjOd.exe
  C:\Windows\System\TtdLjOd.exe
  2⤵
  PID:10236
- C:\Windows\System\KCULdAL.exe
  C:\Windows\System\KCULdAL.exe
  2⤵
  PID:9272
- C:\Windows\System\AqIhKGX.exe
  C:\Windows\System\AqIhKGX.exe
  2⤵
  PID:9400
- C:\Windows\System\nhhSuXg.exe
  C:\Windows\System\nhhSuXg.exe
  2⤵
  PID:9616
- C:\Windows\System\gEHGCoH.exe
  C:\Windows\System\gEHGCoH.exe
  2⤵
  PID:9492
- C:\Windows\System\ZxOzKPx.exe
  C:\Windows\System\ZxOzKPx.exe
  2⤵
  PID:9640
- C:\Windows\System\DNUpDhg.exe
  C:\Windows\System\DNUpDhg.exe
  2⤵
  PID:9792
- C:\Windows\System\uJWtuyo.exe
  C:\Windows\System\uJWtuyo.exe
  2⤵
  PID:10008
- C:\Windows\System\BGCZzBY.exe
  C:\Windows\System\BGCZzBY.exe
  2⤵
  PID:8484
- C:\Windows\System\gMcVDyv.exe
  C:\Windows\System\gMcVDyv.exe
  2⤵
  PID:9392
- C:\Windows\System\TzyAsPT.exe
  C:\Windows\System\TzyAsPT.exe
  2⤵
  PID:9680
- C:\Windows\System\ifpStvq.exe
  C:\Windows\System\ifpStvq.exe
  2⤵
  PID:3904
- C:\Windows\System\GZDlibd.exe
  C:\Windows\System\GZDlibd.exe
  2⤵
  PID:10088
- C:\Windows\System\IEmMtce.exe
  C:\Windows\System\IEmMtce.exe
  2⤵
  PID:9656
- C:\Windows\System\mqaGSoI.exe
  C:\Windows\System\mqaGSoI.exe
  2⤵
  PID:9568
- C:\Windows\System\TngrqfM.exe
  C:\Windows\System\TngrqfM.exe
  2⤵
  PID:10252
- C:\Windows\System\ZiQmfqr.exe
  C:\Windows\System\ZiQmfqr.exe
  2⤵
  PID:10296
- C:\Windows\System\LdUtTET.exe
  C:\Windows\System\LdUtTET.exe
  2⤵
  PID:10316
- C:\Windows\System\aQimZMo.exe
  C:\Windows\System\aQimZMo.exe
  2⤵
  PID:10352
- C:\Windows\System\RXgVCyg.exe
  C:\Windows\System\RXgVCyg.exe
  2⤵
  PID:10368
- C:\Windows\System\MqGQdxe.exe
  C:\Windows\System\MqGQdxe.exe
  2⤵
  PID:10416
- C:\Windows\System\PnqAYYN.exe
  C:\Windows\System\PnqAYYN.exe
  2⤵
  PID:10436
- C:\Windows\System\xldRrHW.exe
  C:\Windows\System\xldRrHW.exe
  2⤵
  PID:10452
- C:\Windows\System\YDoRehH.exe
  C:\Windows\System\YDoRehH.exe
  2⤵
  PID:10492
- C:\Windows\System\RdAssqw.exe
  C:\Windows\System\RdAssqw.exe
  2⤵
  PID:10512
- C:\Windows\System\dgevaCR.exe
  C:\Windows\System\dgevaCR.exe
  2⤵
  PID:10532
- C:\Windows\System\RCWEtfe.exe
  C:\Windows\System\RCWEtfe.exe
  2⤵
  PID:10564
- C:\Windows\System\arJtwnF.exe
  C:\Windows\System\arJtwnF.exe
  2⤵
  PID:10596
- C:\Windows\System\ovhgRAt.exe
  C:\Windows\System\ovhgRAt.exe
  2⤵
  PID:10616
- C:\Windows\System\GHfzObn.exe
  C:\Windows\System\GHfzObn.exe
  2⤵
  PID:10664
- C:\Windows\System\dDBZiqf.exe
  C:\Windows\System\dDBZiqf.exe
  2⤵
  PID:10680
- C:\Windows\System\KtkJbjh.exe
  C:\Windows\System\KtkJbjh.exe
  2⤵
  PID:10720
- C:\Windows\System\JwMbxxG.exe
  C:\Windows\System\JwMbxxG.exe
  2⤵
  PID:10740
- C:\Windows\System\pzMccFw.exe
  C:\Windows\System\pzMccFw.exe
  2⤵
  PID:10784
- C:\Windows\System\SnlyoYF.exe
  C:\Windows\System\SnlyoYF.exe
  2⤵
  PID:10816
- C:\Windows\System\DWvCLtZ.exe
  C:\Windows\System\DWvCLtZ.exe
  2⤵
  PID:10832
- C:\Windows\System\HdlIVcU.exe
  C:\Windows\System\HdlIVcU.exe
  2⤵
  PID:10852
- C:\Windows\System\hsUDoXy.exe
  C:\Windows\System\hsUDoXy.exe
  2⤵
  PID:10880
- C:\Windows\System\cNdoATv.exe
  C:\Windows\System\cNdoATv.exe
  2⤵
  PID:10908
- C:\Windows\System\wdXsNwp.exe
  C:\Windows\System\wdXsNwp.exe
  2⤵
  PID:10932
- C:\Windows\System\olFvHMs.exe
  C:\Windows\System\olFvHMs.exe
  2⤵
  PID:10948
- C:\Windows\System\VuNYFow.exe
  C:\Windows\System\VuNYFow.exe
  2⤵
  PID:10968
- C:\Windows\System\FbtNBEp.exe
  C:\Windows\System\FbtNBEp.exe
  2⤵
  PID:11012
- C:\Windows\System\tijoRMt.exe
  C:\Windows\System\tijoRMt.exe
  2⤵
  PID:11040
- C:\Windows\System\jkfTckM.exe
  C:\Windows\System\jkfTckM.exe
  2⤵
  PID:11088
- C:\Windows\System\AKAKpxO.exe
  C:\Windows\System\AKAKpxO.exe
  2⤵
  PID:11112
- C:\Windows\System\tIrUvkG.exe
  C:\Windows\System\tIrUvkG.exe
  2⤵
  PID:11144
- C:\Windows\System\GKOYheD.exe
  C:\Windows\System\GKOYheD.exe
  2⤵
  PID:11184
- C:\Windows\System\zKZlEOi.exe
  C:\Windows\System\zKZlEOi.exe
  2⤵
  PID:11212
- C:\Windows\System\CJIeUMx.exe
  C:\Windows\System\CJIeUMx.exe
  2⤵
  PID:11228
- C:\Windows\System\kEiSeDu.exe
  C:\Windows\System\kEiSeDu.exe
  2⤵
  PID:11248
- C:\Windows\System\tBmdZTy.exe
  C:\Windows\System\tBmdZTy.exe
  2⤵
  PID:10268
- C:\Windows\System\cyRyoxj.exe
  C:\Windows\System\cyRyoxj.exe
  2⤵
  PID:10336
- C:\Windows\System\GOGgPAw.exe
  C:\Windows\System\GOGgPAw.exe
  2⤵
  PID:10424
- C:\Windows\System\CrnAbcP.exe
  C:\Windows\System\CrnAbcP.exe
  2⤵
  PID:10528
- C:\Windows\System\pVnaXKe.exe
  C:\Windows\System\pVnaXKe.exe
  2⤵
  PID:10508
- C:\Windows\System\UZMpCAF.exe
  C:\Windows\System\UZMpCAF.exe
  2⤵
  PID:10556
- C:\Windows\System\cQZbdMU.exe
  C:\Windows\System\cQZbdMU.exe
  2⤵
  PID:10652
- C:\Windows\System\JVyMfzA.exe
  C:\Windows\System\JVyMfzA.exe
  2⤵
  PID:10676
- C:\Windows\System\FRcRvwV.exe
  C:\Windows\System\FRcRvwV.exe
  2⤵
  PID:4664
- C:\Windows\System\MLCznrQ.exe
  C:\Windows\System\MLCznrQ.exe
  2⤵
  PID:10808
- C:\Windows\System\ISxSjSJ.exe
  C:\Windows\System\ISxSjSJ.exe
  2⤵
  PID:10888
- C:\Windows\System\UgTdpnO.exe
  C:\Windows\System\UgTdpnO.exe
  2⤵
  PID:10940
- C:\Windows\System\sgTwOHk.exe
  C:\Windows\System\sgTwOHk.exe
  2⤵
  PID:11000
- C:\Windows\System\VqYLygM.exe
  C:\Windows\System\VqYLygM.exe
  2⤵
  PID:11032
- C:\Windows\System\rcUZTUa.exe
  C:\Windows\System\rcUZTUa.exe
  2⤵
  PID:11108
- C:\Windows\System\XBXoLCl.exe
  C:\Windows\System\XBXoLCl.exe
  2⤵
  PID:11132
- C:\Windows\System\YTbPJyt.exe
  C:\Windows\System\YTbPJyt.exe
  2⤵
  PID:11172
- C:\Windows\System\isqJpQP.exe
  C:\Windows\System\isqJpQP.exe
  2⤵
  PID:11240
- C:\Windows\System\udMZGTJ.exe
  C:\Windows\System\udMZGTJ.exe
  2⤵
  PID:1932
- C:\Windows\System\xguuuyf.exe
  C:\Windows\System\xguuuyf.exe
  2⤵
  PID:10392
- C:\Windows\System\ZegAAhy.exe
  C:\Windows\System\ZegAAhy.exe
  2⤵
  PID:10636
- C:\Windows\System\jQHBUhy.exe
  C:\Windows\System\jQHBUhy.exe
  2⤵
  PID:10752
- C:\Windows\System\djqTKnx.exe
  C:\Windows\System\djqTKnx.exe
  2⤵
  PID:10160
- C:\Windows\System\xKZHWbP.exe
  C:\Windows\System\xKZHWbP.exe
  2⤵
  PID:10992
- C:\Windows\System\dZDsrIf.exe
  C:\Windows\System\dZDsrIf.exe
  2⤵
  PID:11192
- C:\Windows\System\XSaAvuK.exe
  C:\Windows\System\XSaAvuK.exe
  2⤵
  PID:11160
- C:\Windows\System\TxGltFY.exe
  C:\Windows\System\TxGltFY.exe
  2⤵
  PID:10860
- C:\Windows\System\DkZKPZl.exe
  C:\Windows\System\DkZKPZl.exe
  2⤵
  PID:10592
- C:\Windows\System\CEOAOWr.exe
  C:\Windows\System\CEOAOWr.exe
  2⤵
  PID:11036
- C:\Windows\System\jbMtbqc.exe
  C:\Windows\System\jbMtbqc.exe
  2⤵
  PID:11272
- C:\Windows\System\PSEZwFP.exe
  C:\Windows\System\PSEZwFP.exe
  2⤵
  PID:11296
- C:\Windows\System\PrkthEr.exe
  C:\Windows\System\PrkthEr.exe
  2⤵
  PID:11316
- C:\Windows\System\zNlnjIw.exe
  C:\Windows\System\zNlnjIw.exe
  2⤵
  PID:11340
- C:\Windows\System\XJrTyXF.exe
  C:\Windows\System\XJrTyXF.exe
  2⤵
  PID:11376
- C:\Windows\System\YBVjcjH.exe
  C:\Windows\System\YBVjcjH.exe
  2⤵
  PID:11420
- C:\Windows\System\GyMlmNT.exe
  C:\Windows\System\GyMlmNT.exe
  2⤵
  PID:11460
- C:\Windows\System\cyAOpAr.exe
  C:\Windows\System\cyAOpAr.exe
  2⤵
  PID:11504
- C:\Windows\System\QXTlvxp.exe
  C:\Windows\System\QXTlvxp.exe
  2⤵
  PID:11540
- C:\Windows\System\clDLlgW.exe
  C:\Windows\System\clDLlgW.exe
  2⤵
  PID:11564
- C:\Windows\System\VZsWeAI.exe
  C:\Windows\System\VZsWeAI.exe
  2⤵
  PID:11584
- C:\Windows\System\DevYNPq.exe
  C:\Windows\System\DevYNPq.exe
  2⤵
  PID:11604
- C:\Windows\System\nYbzFqy.exe
  C:\Windows\System\nYbzFqy.exe
  2⤵
  PID:11632
- C:\Windows\System\PknstqC.exe
  C:\Windows\System\PknstqC.exe
  2⤵
  PID:11660
- C:\Windows\System\YeQbtYk.exe
  C:\Windows\System\YeQbtYk.exe
  2⤵
  PID:11684
- C:\Windows\System\wyBFNMU.exe
  C:\Windows\System\wyBFNMU.exe
  2⤵
  PID:11704
- C:\Windows\System\NuYIDpn.exe
  C:\Windows\System\NuYIDpn.exe
  2⤵
  PID:11756
- C:\Windows\System\KgalHhm.exe
  C:\Windows\System\KgalHhm.exe
  2⤵
  PID:11776
- C:\Windows\System\AXynVsT.exe
  C:\Windows\System\AXynVsT.exe
  2⤵
  PID:11820
- C:\Windows\System\hjtTjYn.exe
  C:\Windows\System\hjtTjYn.exe
  2⤵
  PID:11836
- C:\Windows\System\hNUcSxx.exe
  C:\Windows\System\hNUcSxx.exe
  2⤵
  PID:11860
- C:\Windows\System\IoOuiDf.exe
  C:\Windows\System\IoOuiDf.exe
  2⤵
  PID:11880
- C:\Windows\System\ammItLi.exe
  C:\Windows\System\ammItLi.exe
  2⤵
  PID:11896
- C:\Windows\System\egixfux.exe
  C:\Windows\System\egixfux.exe
  2⤵
  PID:11924
- C:\Windows\System\baxLSsK.exe
  C:\Windows\System\baxLSsK.exe
  2⤵
  PID:11944
- C:\Windows\System\cqUEbIr.exe
  C:\Windows\System\cqUEbIr.exe
  2⤵
  PID:11976
- C:\Windows\System\pOAMaQd.exe
  C:\Windows\System\pOAMaQd.exe
  2⤵
  PID:12000
- C:\Windows\System\ucuPbCU.exe
  C:\Windows\System\ucuPbCU.exe
  2⤵
  PID:12016
- C:\Windows\System\sHQtYmj.exe
  C:\Windows\System\sHQtYmj.exe
  2⤵
  PID:12040
- C:\Windows\System\KBtqtFf.exe
  C:\Windows\System\KBtqtFf.exe
  2⤵
  PID:12084
- C:\Windows\System\EboiXPR.exe
  C:\Windows\System\EboiXPR.exe
  2⤵
  PID:12128
- C:\Windows\System\DEUxQzm.exe
  C:\Windows\System\DEUxQzm.exe
  2⤵
  PID:12148
- C:\Windows\System\cMWmjkN.exe
  C:\Windows\System\cMWmjkN.exe
  2⤵
  PID:12168
- C:\Windows\System\SZzinRU.exe
  C:\Windows\System\SZzinRU.exe
  2⤵
  PID:12212
- C:\Windows\System\lYyDiqc.exe
  C:\Windows\System\lYyDiqc.exe
  2⤵
  PID:12232
- C:\Windows\System\Lyibklq.exe
  C:\Windows\System\Lyibklq.exe
  2⤵
  PID:12256
- C:\Windows\System\UEOhzAw.exe
  C:\Windows\System\UEOhzAw.exe
  2⤵
  PID:12284
- C:\Windows\System\AHhnpAK.exe
  C:\Windows\System\AHhnpAK.exe
  2⤵
  PID:11288
- C:\Windows\System\MTJnYuH.exe
  C:\Windows\System\MTJnYuH.exe
  2⤵
  PID:10552
- C:\Windows\System\xXoKecd.exe
  C:\Windows\System\xXoKecd.exe
  2⤵
  PID:11372
- C:\Windows\System\bSeyOHh.exe
  C:\Windows\System\bSeyOHh.exe
  2⤵
  PID:11412
- C:\Windows\System\ZynYKPv.exe
  C:\Windows\System\ZynYKPv.exe
  2⤵
  PID:11480
- C:\Windows\System\HrEuWFr.exe
  C:\Windows\System\HrEuWFr.exe
  2⤵
  PID:11536
- C:\Windows\System\EBfCPLc.exe
  C:\Windows\System\EBfCPLc.exe
  2⤵
  PID:11596
- C:\Windows\System\yiKFbkF.exe
  C:\Windows\System\yiKFbkF.exe
  2⤵
  PID:11640
- C:\Windows\System\wRfGOpy.exe
  C:\Windows\System\wRfGOpy.exe
  2⤵
  PID:11736
- C:\Windows\System\RJvdUjh.exe
  C:\Windows\System\RJvdUjh.exe
  2⤵
  PID:11768
- C:\Windows\System\KwQJvxr.exe
  C:\Windows\System\KwQJvxr.exe
  2⤵
  PID:11972
- C:\Windows\System\sBQZgOH.exe
  C:\Windows\System\sBQZgOH.exe
  2⤵
  PID:11916
- C:\Windows\System\JUtdTkE.exe
  C:\Windows\System\JUtdTkE.exe
  2⤵
  PID:12056
- C:\Windows\System\ZbxYkpa.exe
  C:\Windows\System\ZbxYkpa.exe
  2⤵
  PID:12136
- C:\Windows\System\eejLzFy.exe
  C:\Windows\System\eejLzFy.exe
  2⤵
  PID:10324
- C:\Windows\System\tUUqAvZ.exe
  C:\Windows\System\tUUqAvZ.exe
  2⤵
  PID:12196
- C:\Windows\System\OVqYDMH.exe
  C:\Windows\System\OVqYDMH.exe
  2⤵
  PID:12252
- C:\Windows\System\TAmKsnm.exe
  C:\Windows\System\TAmKsnm.exe
  2⤵
  PID:11308
- C:\Windows\System\PwuwLua.exe
  C:\Windows\System\PwuwLua.exe
  2⤵
  PID:11360
- C:\Windows\System\OXZoQNw.exe
  C:\Windows\System\OXZoQNw.exe
  2⤵
  PID:11496
- C:\Windows\System\OoKgchu.exe
  C:\Windows\System\OoKgchu.exe
  2⤵
  PID:11652
- C:\Windows\System\PKTWaYX.exe
  C:\Windows\System\PKTWaYX.exe
  2⤵
  PID:12036
- C:\Windows\System\sYTcRwA.exe
  C:\Windows\System\sYTcRwA.exe
  2⤵
  PID:12072
- C:\Windows\System\anVAQbg.exe
  C:\Windows\System\anVAQbg.exe
  2⤵
  PID:12092
- C:\Windows\System\Iihvxdo.exe
  C:\Windows\System\Iihvxdo.exe
  2⤵
  PID:11748
- C:\Windows\System\wsLVWHy.exe
  C:\Windows\System\wsLVWHy.exe
  2⤵
  PID:11312
- C:\Windows\System\dZwOHwY.exe
  C:\Windows\System\dZwOHwY.exe
  2⤵
  PID:10716
- C:\Windows\System\OReIReh.exe
  C:\Windows\System\OReIReh.exe
  2⤵
  PID:12296
- C:\Windows\System\gZlVgWS.exe
  C:\Windows\System\gZlVgWS.exe
  2⤵
  PID:12316
- C:\Windows\System\MhnRSVE.exe
  C:\Windows\System\MhnRSVE.exe
  2⤵
  PID:12336
- C:\Windows\System\ypTkPGk.exe
  C:\Windows\System\ypTkPGk.exe
  2⤵
  PID:12356
- C:\Windows\System\AAwXnDv.exe
  C:\Windows\System\AAwXnDv.exe
  2⤵
  PID:12416
- C:\Windows\System\gyUYeki.exe
  C:\Windows\System\gyUYeki.exe
  2⤵
  PID:12500
- C:\Windows\System\HlVncjj.exe
  C:\Windows\System\HlVncjj.exe
  2⤵
  PID:12604
- C:\Windows\System\PifRdqd.exe
  C:\Windows\System\PifRdqd.exe
  2⤵
  PID:12636
- C:\Windows\System\EnYdUUK.exe
  C:\Windows\System\EnYdUUK.exe
  2⤵
  PID:12660
- C:\Windows\System\PzKClWP.exe
  C:\Windows\System\PzKClWP.exe
  2⤵
  PID:12680
- C:\Windows\System\kQyZonp.exe
  C:\Windows\System\kQyZonp.exe
  2⤵
  PID:12708
- C:\Windows\System\obDuxjD.exe
  C:\Windows\System\obDuxjD.exe
  2⤵
  PID:12728
- C:\Windows\System\ptOotZN.exe
  C:\Windows\System\ptOotZN.exe
  2⤵
  PID:12748
- C:\Windows\System\vROLVwu.exe
  C:\Windows\System\vROLVwu.exe
  2⤵
  PID:12804
- C:\Windows\System\DEFMjBh.exe
  C:\Windows\System\DEFMjBh.exe
  2⤵
  PID:12824
- C:\Windows\System\oqmigsU.exe
  C:\Windows\System\oqmigsU.exe
  2⤵
  PID:12844
- C:\Windows\System\WulxoBI.exe
  C:\Windows\System\WulxoBI.exe
  2⤵
  PID:12864
- C:\Windows\System\TIKCMhI.exe
  C:\Windows\System\TIKCMhI.exe
  2⤵
  PID:12904
- C:\Windows\System\FQOOLai.exe
  C:\Windows\System\FQOOLai.exe
  2⤵
  PID:12940
- C:\Windows\System\XhYLWsP.exe
  C:\Windows\System\XhYLWsP.exe
  2⤵
  PID:12960
- C:\Windows\System\ixyCzxM.exe
  C:\Windows\System\ixyCzxM.exe
  2⤵
  PID:12988
- C:\Windows\System\NIcZeSq.exe
  C:\Windows\System\NIcZeSq.exe
  2⤵
  PID:13016
- C:\Windows\System\BaEzVQh.exe
  C:\Windows\System\BaEzVQh.exe
  2⤵
  PID:13040
- C:\Windows\System\ogaIOyg.exe
  C:\Windows\System\ogaIOyg.exe
  2⤵
  PID:13056
- C:\Windows\System\OwnuDYn.exe
  C:\Windows\System\OwnuDYn.exe
  2⤵
  PID:13112
- C:\Windows\System\rYYvBki.exe
  C:\Windows\System\rYYvBki.exe
  2⤵
  PID:13136
- C:\Windows\System\HqfwELf.exe
  C:\Windows\System\HqfwELf.exe
  2⤵
  PID:13156
- C:\Windows\System\DhTZchX.exe
  C:\Windows\System\DhTZchX.exe
  2⤵
  PID:13172
- C:\Windows\System\qiwXZSZ.exe
  C:\Windows\System\qiwXZSZ.exe
  2⤵
  PID:13196
- C:\Windows\System\OgjWWIO.exe
  C:\Windows\System\OgjWWIO.exe
  2⤵
  PID:13228
- C:\Windows\System\LMWPljH.exe
  C:\Windows\System\LMWPljH.exe
  2⤵
  PID:13244
- C:\Windows\System\ndSAvmc.exe
  C:\Windows\System\ndSAvmc.exe
  2⤵
  PID:13268
- C:\Windows\System\VrJOljs.exe
  C:\Windows\System\VrJOljs.exe
  2⤵
  PID:13300
- C:\Windows\System\HLnFgjr.exe
  C:\Windows\System\HLnFgjr.exe
  2⤵
  PID:12304
- C:\Windows\System\NxueTKA.exe
  C:\Windows\System\NxueTKA.exe
  2⤵
  PID:12368
- C:\Windows\System\vxPPwrK.exe
  C:\Windows\System\vxPPwrK.exe
  2⤵
  PID:12440
- C:\Windows\System\LbvSCVK.exe
  C:\Windows\System\LbvSCVK.exe
  2⤵
  PID:12468
- C:\Windows\System\VILsxOT.exe
  C:\Windows\System\VILsxOT.exe
  2⤵
  PID:12484
- C:\Windows\System\pxEpjkW.exe
  C:\Windows\System\pxEpjkW.exe
  2⤵
  PID:12564
- C:\Windows\System\TYNTSJV.exe
  C:\Windows\System\TYNTSJV.exe
  2⤵
  PID:12544
- C:\Windows\System\vrUIGil.exe
  C:\Windows\System\vrUIGil.exe
  2⤵
  PID:12796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zdvi1yl5.gxu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AcbyhPG.exe

Filesize
1.8MB

MD5
666ed962dcf3d68663d3f4a5fa3d4741

SHA1
7b45cc71aa1d2673de1ae964e58b90c2629d17b1

SHA256
55b26b3f34b819a01e863cdaa6cc14e61b6275f3d4445c3c6de96cac4e48f660

SHA512
69bb614731a2dfa2f344f2c800b88507cb0c07223e3f1803627e512c537fb0847e8c7ff85d38f95b7b1dc44e4840a4f32851b8ae3d0db02a2396e9f702058791

Download Submit
C:\Windows\System\CmQlWTE.exe

Filesize
1.8MB

MD5
3474b21cdb10fff7e368c429cccfe111

SHA1
b411d3927fc48febd814c8855662e6331acf4fbf

SHA256
e75271a75d600c836f3c3394aabc575f2f2e055ffd3de7804a987821eb611afb

SHA512
a8ebf9d525f37a2fca5196ce711d2b9017f36e1f9170779b3b1015bc9c4af0e798fd51f63efcce5e134ffa52ec1b1c9bbb01c49d43b96023f6f454f4ee6774e3

Download Submit
C:\Windows\System\CpamIxy.exe

Filesize
1.8MB

MD5
ea498e9c297284e863082d330038aed1

SHA1
3a2703a4cbfd63b5ed0988b11d7b7d7908668a19

SHA256
72554a6a9a6a464e3eb324f93bbbc346be66e9e9e9ef4d15ad49c198a1fd6f82

SHA512
8935b27a480e67559a3389dbcd0d5fd0d94177b33a77da2fcd5062f7136738e9cdbca0e083b1fbf3d57e33cccdd846abf174c8918a046cdefea345dcde6e0d08

Download Submit
C:\Windows\System\DCBsFgl.exe

Filesize
1.8MB

MD5
d41c97ae06b547cdf79473825d158337

SHA1
b1e90c8cfde722da7ea6b624d7cbd6564f7bb3c6

SHA256
f6b8f2a46b8aef448601fba6c69f49573eff7c0d6ea25e6c9fc1f65fc869a0a7

SHA512
37f1e236be4ec3b9454748cf3593e58888cd28b7f27c14ef19265feeb096a15e5c35fa41361e975c11042281f209cfe3db5cce2cffbbee76e2b80cac654470d9

Download Submit
C:\Windows\System\DYlHzzb.exe

Filesize
1.8MB

MD5
0c80b792416f2d25f9a4f075583f2b2f

SHA1
38cf276a734f1ac23fd452cda1b00701c36653c0

SHA256
bb6b172f8eb389d597eaf24d55899f0854f6fb64c51ffe6cd07e3bd967c78cff

SHA512
349dd08c967f65523a06c85f5552c275ce0174f17ffbbf05a1532165c3af0c927739429d9b5b6c11c0dabb4f02d670c00d0ae10213147397ffc0e614cd07f320

Download Submit
C:\Windows\System\EWOCLha.exe

Filesize
1.8MB

MD5
45cbebf3aa4e66aff3791f124f7d7943

SHA1
4d5ea32cf016210c8ece09ee76e3291b33268b5c

SHA256
f21272884a80b01733cb77aacbde13447d7d51a586ffc31aa081a1cc7cec7d11

SHA512
bbbe0b3990e852bb8e3a531f82844a61b3494ded7831fb0b6d83e73fc7b8d23625ad50e05634082635688971ae70cb2ad07256d845085d6ca0b4bc417990e310

Download Submit
C:\Windows\System\FBxCubx.exe

Filesize
1.8MB

MD5
06a8662477aff79fa141abd7cfcbc931

SHA1
1044c1983e9ea0fe3a5d3c1d50e4317dfaff8957

SHA256
c7ae8b5bac5790dc501ec8fa917905543f055ebd1f433815556d1704788cfaf3

SHA512
421af9ced92b3b4771de4bbf1472ad67bf10e25c0abfef4f3326f47fe1ca67cf354c6ad6711479a1ec47355c8cffddcba0f397558af768cef3e1f5bf4ab91511

Download Submit
C:\Windows\System\JZXlncZ.exe

Filesize
1.8MB

MD5
7b49c92b64636d14e887bae776e155be

SHA1
46a62905456e4b9ef7cfa29d3ddb7e161142aba0

SHA256
0af23bb125234a24bc0f668ff6a64a296ccef85939621a2956ea500ceabd929f

SHA512
edcdaa43d3baddc93a792980bd701d7d86232e9351d39334f5e129b131ac9183d1f4efe049cbac104efca6f097d1a42539986292f32b082a80cdadf1e6844519

Download Submit
C:\Windows\System\JldMdQR.exe

Filesize
1.8MB

MD5
408c6c00643ee1a906cf03e8034c71c9

SHA1
547da30ec1d3bd375721d8b154905e788fbc48e6

SHA256
8027a2db02483b72c4267bc0bc34819b759ac42c5a7ea6fcca459d46b026196b

SHA512
84caf8178b68f86b60b4d4c5a20d0335823ef42826228a9efbc7c60a78a2e0574eba80a83bcedc72afb2f86344b59571012a01dd0ae7607ba9ed601902c3e19d

Download Submit
C:\Windows\System\KRShwoF.exe

Filesize
1.8MB

MD5
fd001371bdc2f425183eb1756e4a6c8d

SHA1
774a8e9a118935a291901cdc2c69600367f14ad1

SHA256
bf8d8989db01e6bca0c01af28eeb562be7090c9d1baf19e1d239b2f41daa3eb3

SHA512
4e35f5ef8d7f3023e27062ac11722606bd490d6af3137823bde217c57e08b771168f3e7b9d6c3db21d0055ef8a654c6b6b5d2999fdea9797a70f3e40a37e410b

Download Submit
C:\Windows\System\MDefFPH.exe

Filesize
1.8MB

MD5
35b07cedee101b20d8580297bb79e778

SHA1
6e07be270d7bea9bf054f228c2121a0b9aa21f69

SHA256
cc8387edbaef91f9d056c69b32fb36625bbadf9e605535c00ff0684e5f398758

SHA512
017b4277be0da2d32ef12e7e7e2d4d1e964abc38fe1425999535750525ebe025a3145ec65f4daf84a836b30b34cf26eb3d8a45e5c08014fa425166c8b063cef0

Download Submit
C:\Windows\System\NqirAHf.exe

Filesize
1.8MB

MD5
0a5661a96f795387c7ca2526e51803ab

SHA1
baf4b2c174a4783456e86cfb307679300e51ec48

SHA256
8529faeb3f66f752c95e2182b1173be0d005e5ed30b91dcd5b0b9979c5d32abc

SHA512
6883d6d7cf6d8fe9cf76180957e4c9528f247c457c8137249ca1d616ed10ee108f0047c9a4cd0fe6861155d41c82e372a12269935332d2f95220342fb90c445a

Download Submit
C:\Windows\System\OjitydW.exe

Filesize
1.8MB

MD5
d34463ef882730d676d1835e71593b06

SHA1
092aa4ebbe040b86b057b76a7e97164ed525ae48

SHA256
a722452fd644ffcbf1011150618a5cfc0d2ac02a8bd8691015ae55dabb4a6a71

SHA512
28559a5cd051dd543e171f69b0ec60adb81097d96e05f97da0da039d9be3980030a3633b2cce056e897619ee1442fd083047ec3b80b3048dc0f555a81a04c4de

Download Submit
C:\Windows\System\PhfMrTb.exe

Filesize
1.8MB

MD5
8307e3b3cdd5f47179b0b41e69015239

SHA1
4d29ecd7467b00f4ad3363d7cb91a1e98b86f8eb

SHA256
428bc0c79e632262575ee475ad986a020d3a36eace561925ed90507e2be94be4

SHA512
d3f308272d8480e66c2212d749d88971b52daefaa8181c7526cef84e9b184778e38a774235ad11a45635eb977f4737af47852a8cea8cbbd56a86486d01c29f4e

Download Submit
C:\Windows\System\QXqxfKB.exe

Filesize
1.8MB

MD5
de865e03975dc43781f9671a4f037ffc

SHA1
bc5ffc61779035671a936865451292f48dac0472

SHA256
473d0b4f543f360871fe22f62b9f9beb786dac6a7c849f857f1abfda2f0d031e

SHA512
2ae31fd1d568c01ff6f04a6435a6a9331c30f9776e7a03f7cbd2cf92ff21af2dd6ee8d0c158bc523e1b4309a562d150305cc40b0b88e41f9b6d2a9bfba953637

Download Submit
C:\Windows\System\QrIjcru.exe

Filesize
1.8MB

MD5
f92d1e4a0513a264de133a176597a24a

SHA1
4c55768d9d9e5cd9405b34c31f75ac1b273cccfe

SHA256
cf6f35d306d31643931cb1d589617f28c49357d4bb64e2f5a1ac0665333934ac

SHA512
3ae7f07b3427482eaff379e02990adba1e4cb2dcc865a43c70967ea1aa253de2f28c5d5d657cd57dcf125d58c2aa3876e0b1d2ff2f2da2d3d738a68690d1976f

Download Submit
C:\Windows\System\RIbLKFI.exe

Filesize
1.8MB

MD5
12ba301fb1feb108e80f904ad081aee6

SHA1
707fef49392ba7d5c3ad06a58b316b56606e3de1

SHA256
0ab06af14acce33123d04024e57ad7a5033e48679914e13bcf348a0ebd1df416

SHA512
ea4f5d49166d17bbda9bfaa8eec33a3b495441b05eecb6d948530d45004ee2fca880e6fbeb57dee3c7700dde773dabd85d052ff11a6f7c40ce6c72779910a867

Download Submit
C:\Windows\System\SOvXnFf.exe

Filesize
1.8MB

MD5
9a86669b37f8a849b28f9659fc69e443

SHA1
f50c07f6849b11eb7ba035d4266edf7d736019b5

SHA256
40db9e315f51812d187af3f5b3ffec56a622167728580d91e433d205bde0c29e

SHA512
efb8d3acaca47acbeea2452be63e413051a21dd98d6fa6257b55f1f54d09b1118211a53858b251ac1102407459497d2880b29a88b3f70e582b721919fbc7a471

Download Submit
C:\Windows\System\Ssmckbn.exe

Filesize
1.8MB

MD5
48e2f71448c90441d08104aa558049ad

SHA1
b765be9699f7b2bc6c8648cf1ca0a686c0039048

SHA256
65f7070c066256e8d4a67071be7a6d05c483cfa394969dcfd29e03c3e1158a3c

SHA512
7a801324c0ffae71269c9ff75cb83fdd87aeda5da8fb709bde7571ee9fe05be898c40b8a5bb796c8d5e24538798fefbc2eb7689c22180a2620d578fab03b0d02

Download Submit
C:\Windows\System\TCvdftt.exe

Filesize
1.8MB

MD5
570d425e8bbce6b0e1b2e12ff85c3bf1

SHA1
8a7b14469353d36812d404215df7c55ba35fa084

SHA256
09165f9758231284528ed9d6fa05bf378c3665ad8c9970e1444fbfe5107a9313

SHA512
7292334222e98f2207894b500f572515f7e62565d1644368ff75203c6fade0eeb35d5051c7ccf2759b72d7f8f67aea4ccbdba9de1541630ea58889ecab39b5b8

Download Submit
C:\Windows\System\TorYvth.exe

Filesize
1.8MB

MD5
5292e395cbdbbdf71553941afc116d73

SHA1
b1243bc61675a55f0e3ba614e5abcb8486a662c3

SHA256
14e0cba6e88e9b4f38d52a2f11281c358b3f35eac1e73d842001bd1a6462a87b

SHA512
b6050eaab744d3325b19fbaf0cff4c6f646fbd778adb157e7cbe9f72796803688aa5d56623d685c0d27c8bee2dbf349923137201155d9aa44532549d980fec64

Download Submit
C:\Windows\System\VtUtLji.exe

Filesize
1.8MB

MD5
b556afcab1871ade50bcdb7d1fac1463

SHA1
3f8ff8e1ffd3b15cea3e1e5775209b0e62a59727

SHA256
f5f86c1b5e7b5ac3137356040a32533d768a3a53e2c2b697f1bfc18f4a89ab59

SHA512
5ac92739a5303906aad157e3f437758f3ce8524dd5ca0907d46f0b137080dc92c1e09e7c4d39a0e0cce326c276c50263b07aa2d6c155afaa168bdeaf68fb66cf

Download Submit
C:\Windows\System\iYzwHxc.exe

Filesize
1.8MB

MD5
e2833e0a016ccb4ce61c00995e9b3d4d

SHA1
033aa6e8b6f40fc772e60caa9f82a2225fc8f493

SHA256
66c438f2e41656fa09a8023e4980ad7d88c214737f5196d209d67d95be338d56

SHA512
dbf950ccc5b3c0da8289962a2859d6d9601064877d49e119ca13fe631ee398d6de723a1e757ce1438841820d373a1706462d018e88306e5c1260a76a6c66d5a0

Download Submit
C:\Windows\System\mHeeqBd.exe

Filesize
1.8MB

MD5
8da8f019424336e774f0582507b967ef

SHA1
f6d82237b6efb5a80f38ef31c7db996767cd36af

SHA256
9608de845644acb8d8cf4361901fd2a6dea53c7a108a88b6a0e100b7dd70bff1

SHA512
56bcb44c8aa42c96bdf2bfad87b7396a95c407b0971d19bc20af65f62355b18c52e88dfaeb154aa98d0b12c62e420bc1084ab2395e28d00ba6b92b59615b5c57

Download Submit
C:\Windows\System\nqAgeLj.exe

Filesize
1.8MB

MD5
a16ac1d0c404754c9bafaf29d1a90508

SHA1
be008c2de90d9c8621334debf96b0e2d94dd4d13

SHA256
41d28354185de556f60d4979948dff1d575c52b90eda39d3642b454ad4c78ae5

SHA512
e92f563b894833ef26d40dc6798e3d5d4943c30d3190240ee56e4461c9a92282de049014183f9122b8a7c3de2926154932cc0e50c15e30ade6963753a04a176a

Download Submit
C:\Windows\System\oyVnpaw.exe

Filesize
1.8MB

MD5
6646c94fc7221068b44745fa50524caf

SHA1
4a310976d28a7ac97e8df8fe383f279d46cac214

SHA256
b56a70c168c862d9c01afab6a35435ea506eb2412bed6fc956fe9bbeaea4e1cb

SHA512
7ae5f0596a8e72cc186aaef6d25c3852e460ca47abadf2c0c8c63b0b14fffa43151f58460e6a66207c5719f87f63d7ab7ebe2cb0b717bccf636b98402c23eef8

Download Submit
C:\Windows\System\qpTMYkj.exe

Filesize
1.8MB

MD5
bd516417249ef23f95c1dfdb0fae1c29

SHA1
1f561c0d1340b9c15b91bb091605b4121b05411a

SHA256
cc5410a9cccf1ff8c77b1a9fa39e5f11fc24c0d827d7807ea13bad71e98bfb42

SHA512
0c313daa629db833ef9a363692c6bd13bc6abefe40ffd3e64cad2ed2fed1002e50e7cdf7d04c84c7783a10e54b760cbd2f49dc0540b4823e837d60500e05fa05

Download Submit
C:\Windows\System\rDgVdfb.exe

Filesize
1.8MB

MD5
238fcef8908083b59d4f086830a52c5c

SHA1
c49b602176304b9c20ea768b2cf659c4d0226625

SHA256
f5990a0fd8ac4621af1edb105b97053d4c9b1e16ec33f1fc760a15c6bc34aa4a

SHA512
f8943ba79d82bc670dc471c0f291d051dd57639e94abc90f3c10bcb26f57f5ced184eacddd508d20937030d1fa9e2916efef710e78bfcec15f101bd35743548d

Download Submit
C:\Windows\System\ugdzAqE.exe

Filesize
1.8MB

MD5
f0bf38a6dfc5383f9e3be3865d71965c

SHA1
aba89d4b217c5451ac2aa90edd7963a5a3cd89f4

SHA256
5336ab2b8d3847b110177028b59dd9dc22c37ef687b25b37361087925ef7ca4b

SHA512
1540b22fb9be93e91ef5e12d02fc5f3a3de4b86541f93d4006d67864935a3bf4f305980dc242815797b2fe93671f4f33041d69563fef23a4197a293d253edec6

Download Submit
C:\Windows\System\wVpRWhQ.exe

Filesize
1.8MB

MD5
696e7b242b921452faf1133cc5027a35

SHA1
33a0fec530a4b46436373b62637ea449f3a5ebc0

SHA256
bdf542b4fe044675679b5781894a22747de51656345699068cd0b0923d13f575

SHA512
86dc070eef77fbe125e770ac04331590328f3a0e9911d9aeb597c8d83ce03b3518b616dce4517a7b03e875014185461af519a9fc9353f7c7c2549260bfaf1b57

Download Submit
C:\Windows\System\yFEjmUj.exe

Filesize
1.8MB

MD5
0b1b5fdec1644f2664753fbc24f1c00a

SHA1
f974e050e53604f2017ae30470bb9349437ffeb6

SHA256
b6493195c1c8fef89a77ede390c347511dc7e04e9f9b8c4f8e6c9bc4436a0a8b

SHA512
75f8344177a7a48e6eb9a78a8bf6d027f5ec7e091390fc410c13ec6765cb15a917f3d002ac3879e7da73a4256b46548c0deec37a073235a9d89db1f432bc26ee

Download Submit
C:\Windows\System\ylbRVxB.exe

Filesize
1.8MB

MD5
6f049cfa22e9f97751b59d72f49afa3b

SHA1
949f3db1de284313a203885c681fc40aa7eefb11

SHA256
3c848ce88a4b9506d4c68c51edad5cd36baaac4735b619dcb0774d05b0229073

SHA512
babd1091e6aed797bf815aa014534c03610fc37ee60826c4f759009ca2ae9a282daf1815ab2df41cd0747b136bfbc168e7035bfe867f2eb042460b94ec8887e5

Download Submit
C:\Windows\System\znZjgyn.exe

Filesize
1.8MB

MD5
8782de1c829ef24bb7d3b22b73e002ac

SHA1
983f62197eeb1c0ecbb85dbda9af1454634276b1

SHA256
9053d0852fe95562a85dabe18b9c6c8a8da2078f73bd6853ee4e45d77e71bf77

SHA512
5339c883de99bd433e0569aadbacf47cd23c633b84e47f7a6abf5788abd4b55173155d679b31bf9b412e521974b4b7385711703cddb0af380094fcab4a6b96ca

Download Submit
memory/556-509-0x00007FF6D9A70000-0x00007FF6D9E62000-memory.dmp

Filesize
3.9MB

Download
memory/556-2138-0x00007FF6D9A70000-0x00007FF6D9E62000-memory.dmp

Filesize
3.9MB

Download
memory/828-524-0x00007FF7FD420000-0x00007FF7FD812000-memory.dmp

Filesize
3.9MB

Download
memory/828-2133-0x00007FF7FD420000-0x00007FF7FD812000-memory.dmp

Filesize
3.9MB

Download
memory/1004-445-0x00007FF797000000-0x00007FF7973F2000-memory.dmp

Filesize
3.9MB

Download
memory/1004-2116-0x00007FF797000000-0x00007FF7973F2000-memory.dmp

Filesize
3.9MB

Download
memory/1036-0-0x00007FF65DBB0000-0x00007FF65DFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1036-1-0x00000175815D0000-0x00000175815E0000-memory.dmp

Filesize
64KB

Download
memory/1400-496-0x00007FF695010000-0x00007FF695402000-memory.dmp

Filesize
3.9MB

Download
memory/1400-2140-0x00007FF695010000-0x00007FF695402000-memory.dmp

Filesize
3.9MB

Download
memory/1504-2110-0x00007FF7D1EF0000-0x00007FF7D22E2000-memory.dmp

Filesize
3.9MB

Download
memory/1504-71-0x00007FF7D1EF0000-0x00007FF7D22E2000-memory.dmp

Filesize
3.9MB

Download
memory/1556-523-0x00007FF627800000-0x00007FF627BF2000-memory.dmp

Filesize
3.9MB

Download
memory/1556-2136-0x00007FF627800000-0x00007FF627BF2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-474-0x00007FF7A1DA0000-0x00007FF7A2192000-memory.dmp

Filesize
3.9MB

Download
memory/1624-2145-0x00007FF7A1DA0000-0x00007FF7A2192000-memory.dmp

Filesize
3.9MB

Download
memory/1656-466-0x00007FF66BE60000-0x00007FF66C252000-memory.dmp

Filesize
3.9MB

Download
memory/1656-2148-0x00007FF66BE60000-0x00007FF66C252000-memory.dmp

Filesize
3.9MB

Download
memory/1836-42-0x00007FF6D5FE0000-0x00007FF6D63D2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-2103-0x00007FF6D5FE0000-0x00007FF6D63D2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-485-0x00007FF71BB10000-0x00007FF71BF02000-memory.dmp

Filesize
3.9MB

Download
memory/2432-2142-0x00007FF71BB10000-0x00007FF71BF02000-memory.dmp

Filesize
3.9MB

Download
memory/2560-2113-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-433-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp

Filesize
3.9MB

Download
memory/2880-455-0x00007FF7A4530000-0x00007FF7A4922000-memory.dmp

Filesize
3.9MB

Download
memory/2880-2122-0x00007FF7A4530000-0x00007FF7A4922000-memory.dmp

Filesize
3.9MB

Download
memory/3076-2112-0x00007FF7BFB70000-0x00007FF7BFF62000-memory.dmp

Filesize
3.9MB

Download
memory/3076-436-0x00007FF7BFB70000-0x00007FF7BFF62000-memory.dmp

Filesize
3.9MB

Download
memory/3168-566-0x00007FF627920000-0x00007FF627D12000-memory.dmp

Filesize
3.9MB

Download
memory/3168-2125-0x00007FF627920000-0x00007FF627D12000-memory.dmp

Filesize
3.9MB

Download
memory/3212-561-0x00007FF732E60000-0x00007FF733252000-memory.dmp

Filesize
3.9MB

Download
memory/3212-2119-0x00007FF732E60000-0x00007FF733252000-memory.dmp

Filesize
3.9MB

Download
memory/3340-482-0x00007FF6275A0000-0x00007FF627992000-memory.dmp

Filesize
3.9MB

Download
memory/3340-2144-0x00007FF6275A0000-0x00007FF627992000-memory.dmp

Filesize
3.9MB

Download
memory/3620-2107-0x00007FF7822F0000-0x00007FF7826E2000-memory.dmp

Filesize
3.9MB

Download
memory/3620-48-0x00007FF7822F0000-0x00007FF7826E2000-memory.dmp

Filesize
3.9MB

Download
memory/4136-69-0x000001CE23FF0000-0x000001CE24012000-memory.dmp

Filesize
136KB

Download
memory/4136-13-0x00007FFF98773000-0x00007FFF98775000-memory.dmp

Filesize
8KB

Download
memory/4136-549-0x00007FFF98770000-0x00007FFF99231000-memory.dmp

Filesize
10.8MB

Download
memory/4136-1850-0x00007FFF98770000-0x00007FFF99231000-memory.dmp

Filesize
10.8MB

Download
memory/4136-33-0x00007FFF98770000-0x00007FFF99231000-memory.dmp

Filesize
10.8MB

Download
memory/4596-2106-0x00007FF715300000-0x00007FF7156F2000-memory.dmp

Filesize
3.9MB

Download
memory/4596-52-0x00007FF715300000-0x00007FF7156F2000-memory.dmp

Filesize
3.9MB

Download
memory/4708-528-0x00007FF6D31A0000-0x00007FF6D3592000-memory.dmp

Filesize
3.9MB

Download
memory/4708-2131-0x00007FF6D31A0000-0x00007FF6D3592000-memory.dmp

Filesize
3.9MB

Download
memory/4720-451-0x00007FF7BC580000-0x00007FF7BC972000-memory.dmp

Filesize
3.9MB

Download
memory/4720-2124-0x00007FF7BC580000-0x00007FF7BC972000-memory.dmp

Filesize
3.9MB

Download
memory/4756-12-0x00007FF6466E0000-0x00007FF646AD2000-memory.dmp

Filesize
3.9MB

Download
memory/4756-2101-0x00007FF6466E0000-0x00007FF646AD2000-memory.dmp

Filesize
3.9MB

Download
memory/4840-555-0x00007FF75CD20000-0x00007FF75D112000-memory.dmp

Filesize
3.9MB

Download
memory/4840-2117-0x00007FF75CD20000-0x00007FF75D112000-memory.dmp

Filesize
3.9MB

Download
memory/4868-533-0x00007FF6EB580000-0x00007FF6EB972000-memory.dmp

Filesize
3.9MB

Download
memory/4868-2129-0x00007FF6EB580000-0x00007FF6EB972000-memory.dmp

Filesize
3.9MB

Download
memory/5024-2149-0x00007FF656A60000-0x00007FF656E52000-memory.dmp

Filesize
3.9MB

Download
memory/5024-460-0x00007FF656A60000-0x00007FF656E52000-memory.dmp

Filesize
3.9MB

Download