xmrig | 438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e

Analysis

max time kernel
64s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
Size

2.1MB
MD5

75d33926a4c73d30a37e09e33a15debf
SHA1

60bc9061c39f4f15b8581f443c8e0f7180d47262
SHA256

438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e
SHA512

fb005b033f808b5fecdaa3d9cbbacd77967ee7b3064e2aa9fc8aad968c1b44a829592e3bbb42313095a18f23a4b6faaa2013933b52aff64957f71574056fd9d3
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PGG:NABt

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 53 IoCs

miner

resource	yara_rule
behavioral2/memory/1312-65-0x00007FF621540000-0x00007FF621932000-memory.dmp	xmrig
behavioral2/memory/2924-79-0x00007FF64C300000-0x00007FF64C6F2000-memory.dmp	xmrig
behavioral2/memory/1680-80-0x00007FF7D1FF0000-0x00007FF7D23E2000-memory.dmp	xmrig
behavioral2/memory/1764-95-0x00007FF633DF0000-0x00007FF6341E2000-memory.dmp	xmrig
behavioral2/memory/4048-108-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp	xmrig
behavioral2/memory/892-120-0x00007FF711560000-0x00007FF711952000-memory.dmp	xmrig
behavioral2/memory/4864-122-0x00007FF6EC080000-0x00007FF6EC472000-memory.dmp	xmrig
behavioral2/memory/4140-124-0x00007FF7F3930000-0x00007FF7F3D22000-memory.dmp	xmrig
behavioral2/memory/2036-121-0x00007FF685650000-0x00007FF685A42000-memory.dmp	xmrig
behavioral2/memory/4164-119-0x00007FF642E70000-0x00007FF643262000-memory.dmp	xmrig
behavioral2/memory/984-118-0x00007FF7760E0000-0x00007FF7764D2000-memory.dmp	xmrig
behavioral2/memory/2276-90-0x00007FF65E5C0000-0x00007FF65E9B2000-memory.dmp	xmrig
behavioral2/memory/2852-81-0x00007FF76B330000-0x00007FF76B722000-memory.dmp	xmrig
behavioral2/memory/448-1815-0x00007FF6090D0000-0x00007FF6094C2000-memory.dmp	xmrig
behavioral2/memory/1764-1807-0x00007FF633DF0000-0x00007FF6341E2000-memory.dmp	xmrig
behavioral2/memory/2024-1794-0x00007FF648730000-0x00007FF648B22000-memory.dmp	xmrig
behavioral2/memory/2972-1793-0x00007FF70B480000-0x00007FF70B872000-memory.dmp	xmrig
behavioral2/memory/8-2009-0x00007FF783D30000-0x00007FF784122000-memory.dmp	xmrig
behavioral2/memory/5052-2010-0x00007FF61B200000-0x00007FF61B5F2000-memory.dmp	xmrig
behavioral2/memory/4584-2011-0x00007FF60EBB0000-0x00007FF60EFA2000-memory.dmp	xmrig
behavioral2/memory/4624-177-0x00007FF668D90000-0x00007FF669182000-memory.dmp	xmrig
behavioral2/memory/1084-163-0x00007FF7A45F0000-0x00007FF7A49E2000-memory.dmp	xmrig
behavioral2/memory/3668-160-0x00007FF7E93C0000-0x00007FF7E97B2000-memory.dmp	xmrig
behavioral2/memory/3944-143-0x00007FF676D60000-0x00007FF677152000-memory.dmp	xmrig
behavioral2/memory/4584-138-0x00007FF60EBB0000-0x00007FF60EFA2000-memory.dmp	xmrig
behavioral2/memory/1684-48-0x00007FF62B7D0000-0x00007FF62BBC2000-memory.dmp	xmrig
behavioral2/memory/1992-46-0x00007FF725820000-0x00007FF725C12000-memory.dmp	xmrig
behavioral2/memory/3944-2037-0x00007FF676D60000-0x00007FF677152000-memory.dmp	xmrig
behavioral2/memory/4624-2046-0x00007FF668D90000-0x00007FF669182000-memory.dmp	xmrig
behavioral2/memory/2024-2048-0x00007FF648730000-0x00007FF648B22000-memory.dmp	xmrig
behavioral2/memory/1992-2050-0x00007FF725820000-0x00007FF725C12000-memory.dmp	xmrig
behavioral2/memory/4048-2052-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp	xmrig
behavioral2/memory/1684-2055-0x00007FF62B7D0000-0x00007FF62BBC2000-memory.dmp	xmrig
behavioral2/memory/2924-2058-0x00007FF64C300000-0x00007FF64C6F2000-memory.dmp	xmrig
behavioral2/memory/1312-2057-0x00007FF621540000-0x00007FF621932000-memory.dmp	xmrig
behavioral2/memory/984-2060-0x00007FF7760E0000-0x00007FF7764D2000-memory.dmp	xmrig
behavioral2/memory/1680-2062-0x00007FF7D1FF0000-0x00007FF7D23E2000-memory.dmp	xmrig
behavioral2/memory/2852-2064-0x00007FF76B330000-0x00007FF76B722000-memory.dmp	xmrig
behavioral2/memory/2276-2066-0x00007FF65E5C0000-0x00007FF65E9B2000-memory.dmp	xmrig
behavioral2/memory/892-2070-0x00007FF711560000-0x00007FF711952000-memory.dmp	xmrig
behavioral2/memory/4164-2069-0x00007FF642E70000-0x00007FF643262000-memory.dmp	xmrig
behavioral2/memory/1764-2072-0x00007FF633DF0000-0x00007FF6341E2000-memory.dmp	xmrig
behavioral2/memory/448-2076-0x00007FF6090D0000-0x00007FF6094C2000-memory.dmp	xmrig
behavioral2/memory/2036-2074-0x00007FF685650000-0x00007FF685A42000-memory.dmp	xmrig
behavioral2/memory/4140-2080-0x00007FF7F3930000-0x00007FF7F3D22000-memory.dmp	xmrig
behavioral2/memory/4864-2079-0x00007FF6EC080000-0x00007FF6EC472000-memory.dmp	xmrig
behavioral2/memory/8-2082-0x00007FF783D30000-0x00007FF784122000-memory.dmp	xmrig
behavioral2/memory/5052-2084-0x00007FF61B200000-0x00007FF61B5F2000-memory.dmp	xmrig
behavioral2/memory/3668-2141-0x00007FF7E93C0000-0x00007FF7E97B2000-memory.dmp	xmrig
behavioral2/memory/3944-2139-0x00007FF676D60000-0x00007FF677152000-memory.dmp	xmrig
behavioral2/memory/4584-2137-0x00007FF60EBB0000-0x00007FF60EFA2000-memory.dmp	xmrig
behavioral2/memory/1084-2143-0x00007FF7A45F0000-0x00007FF7A49E2000-memory.dmp	xmrig
behavioral2/memory/4624-2145-0x00007FF668D90000-0x00007FF669182000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3640	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2024	QdXUGzt.exe
1992	eFteprv.exe
4048	tHitlWN.exe
1684	QKkmZFZ.exe
1312	SgsRMCE.exe
2924	RLpJKtu.exe
984	fTpbMXa.exe
1680	DmSsFqc.exe
2852	IrJvagS.exe
4164	KThFzSg.exe
2276	bPABivm.exe
1764	gzvyAgk.exe
892	CLTWIXI.exe
2036	VIcmlJW.exe
448	qvmdVCT.exe
4864	WoNlhbP.exe
4140	gGoejjq.exe
5052	RVEzDnY.exe
8	qrWgOYy.exe
4584	XEaHopW.exe
3944	JZKdQzV.exe
3668	XfkwRTm.exe
1084	YkrFIQd.exe
4624	GHPnVJt.exe
2252	jSAVcNe.exe
1292	rMSYgYa.exe
4272	UXaLNAv.exe
816	cpDWUpu.exe
3868	gaBFwcu.exe
3248	WeKagkf.exe
3796	IwhUsIK.exe
1516	eKWqqmp.exe
2280	RgMIXnn.exe
3916	zCfqUuS.exe
1572	EOFVLVH.exe
3016	WVfgYUc.exe
5000	IqiIruw.exe
2768	wIoqNOt.exe
4696	LqjkvfU.exe
2720	DWjmxyC.exe
2848	ivKWLcz.exe
3940	PUlDivw.exe
812	HZYUIFf.exe
1360	tuVQJzO.exe
4504	ejsyuOu.exe
4660	GKrepCS.exe
5036	hWkIPJW.exe
636	oDCGBke.exe
2620	KCdXfZs.exe
1912	dxCMAmg.exe
4704	NpCWWMu.exe
4448	cSSIKfb.exe
1624	bhCfUMS.exe
4608	iyeXefZ.exe
4676	sZjlZbp.exe
540	xFbaTSC.exe
4956	HOlzRKf.exe
4200	TbMVqzQ.exe
396	smQtgdS.exe
1344	KPRTwNJ.exe
3444	gBieczU.exe
1340	ambISMN.exe
3320	kJzdxpU.exe
2292	dHcUxLW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2972-0-0x00007FF70B480000-0x00007FF70B872000-memory.dmp	upx
behavioral2/files/0x00070000000233ec-9.dat	upx
behavioral2/files/0x00070000000233ed-8.dat	upx
behavioral2/files/0x00070000000233ee-19.dat	upx
behavioral2/files/0x00070000000233ef-27.dat	upx
behavioral2/memory/1312-65-0x00007FF621540000-0x00007FF621932000-memory.dmp	upx
behavioral2/memory/2924-79-0x00007FF64C300000-0x00007FF64C6F2000-memory.dmp	upx
behavioral2/memory/1680-80-0x00007FF7D1FF0000-0x00007FF7D23E2000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-86.dat	upx
behavioral2/memory/1764-95-0x00007FF633DF0000-0x00007FF6341E2000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-98.dat	upx
behavioral2/memory/4048-108-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp	upx
behavioral2/files/0x00080000000233e9-116.dat	upx
behavioral2/memory/892-120-0x00007FF711560000-0x00007FF711952000-memory.dmp	upx
behavioral2/memory/4864-122-0x00007FF6EC080000-0x00007FF6EC472000-memory.dmp	upx
behavioral2/memory/4140-124-0x00007FF7F3930000-0x00007FF7F3D22000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-128.dat	upx
behavioral2/memory/5052-125-0x00007FF61B200000-0x00007FF61B5F2000-memory.dmp	upx
behavioral2/memory/8-123-0x00007FF783D30000-0x00007FF784122000-memory.dmp	upx
behavioral2/memory/2036-121-0x00007FF685650000-0x00007FF685A42000-memory.dmp	upx
behavioral2/memory/4164-119-0x00007FF642E70000-0x00007FF643262000-memory.dmp	upx
behavioral2/memory/984-118-0x00007FF7760E0000-0x00007FF7764D2000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-112.dat	upx
behavioral2/files/0x00070000000233fa-107.dat	upx
behavioral2/files/0x00080000000233f6-100.dat	upx
behavioral2/memory/448-97-0x00007FF6090D0000-0x00007FF6094C2000-memory.dmp	upx
behavioral2/memory/2276-90-0x00007FF65E5C0000-0x00007FF65E9B2000-memory.dmp	upx
behavioral2/files/0x00080000000233f7-83.dat	upx
behavioral2/memory/2852-81-0x00007FF76B330000-0x00007FF76B722000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-75.dat	upx
behavioral2/files/0x00070000000233f5-72.dat	upx
behavioral2/files/0x00070000000233fd-133.dat	upx
behavioral2/files/0x0007000000023400-147.dat	upx
behavioral2/files/0x00070000000233ff-145.dat	upx
behavioral2/files/0x0007000000023405-167.dat	upx
behavioral2/files/0x0007000000023403-171.dat	upx
behavioral2/files/0x000700000002340a-200.dat	upx
behavioral2/memory/448-1815-0x00007FF6090D0000-0x00007FF6094C2000-memory.dmp	upx
behavioral2/memory/1764-1807-0x00007FF633DF0000-0x00007FF6341E2000-memory.dmp	upx
behavioral2/memory/2024-1794-0x00007FF648730000-0x00007FF648B22000-memory.dmp	upx
behavioral2/memory/2972-1793-0x00007FF70B480000-0x00007FF70B872000-memory.dmp	upx
behavioral2/memory/8-2009-0x00007FF783D30000-0x00007FF784122000-memory.dmp	upx
behavioral2/memory/5052-2010-0x00007FF61B200000-0x00007FF61B5F2000-memory.dmp	upx
behavioral2/memory/4584-2011-0x00007FF60EBB0000-0x00007FF60EFA2000-memory.dmp	upx
behavioral2/files/0x0007000000023409-198.dat	upx
behavioral2/files/0x0007000000023407-196.dat	upx
behavioral2/files/0x0007000000023408-194.dat	upx
behavioral2/files/0x0007000000023406-190.dat	upx
behavioral2/files/0x0007000000023404-178.dat	upx
behavioral2/memory/4624-177-0x00007FF668D90000-0x00007FF669182000-memory.dmp	upx
behavioral2/files/0x0007000000023402-172.dat	upx
behavioral2/files/0x0007000000023401-169.dat	upx
behavioral2/memory/1084-163-0x00007FF7A45F0000-0x00007FF7A49E2000-memory.dmp	upx
behavioral2/memory/3668-160-0x00007FF7E93C0000-0x00007FF7E97B2000-memory.dmp	upx
behavioral2/memory/3944-143-0x00007FF676D60000-0x00007FF677152000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-139.dat	upx
behavioral2/memory/4584-138-0x00007FF60EBB0000-0x00007FF60EFA2000-memory.dmp	upx
behavioral2/files/0x00070000000233f3-52.dat	upx
behavioral2/files/0x00070000000233f2-50.dat	upx
behavioral2/memory/1684-48-0x00007FF62B7D0000-0x00007FF62BBC2000-memory.dmp	upx
behavioral2/memory/1992-46-0x00007FF725820000-0x00007FF725C12000-memory.dmp	upx
behavioral2/files/0x00070000000233f1-44.dat	upx
behavioral2/files/0x00070000000233f0-31.dat	upx
behavioral2/files/0x00080000000233eb-13.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iRfYZkS.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\IHsOpMI.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\dBZRiCz.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\bpAzpKM.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\SGBvOlG.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\ZzCGmyH.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\gzvyAgk.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\TbMVqzQ.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\BEEeYMc.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\maiwEZf.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\lDsFQfG.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\UCLCXhi.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\xFbaTSC.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\ROfcxfT.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\gchsmjA.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\qKlBcGG.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\MJzVTOg.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\hEvAVqh.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\RZzEoge.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\jVYTfZs.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\IzSYTuM.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\FAxSHMZ.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\jjaXXTk.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\RiRsifP.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\oKZzSMI.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\jyAZFNU.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\KPRTwNJ.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\syqvFxy.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\bOTpHXo.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\FgfFGOZ.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\IgysmnA.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\rEdqdWd.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\QKkmZFZ.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\oDCGBke.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\AqsyhQv.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\SSeAAFu.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\cRtpeSY.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\KIyxbYe.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\HFHEFBF.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\mMHOjpV.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\rSzCjKq.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\JapiiQl.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\KDPPjdG.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\AvoyaIs.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\BQmckop.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\bPABivm.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\AUgiOTr.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\FrHtPZs.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\baqgcyv.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\TsuoDoh.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\LPpOfCt.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\WDkizer.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\AEsCksh.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\VNsYLVY.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\lZWlPDA.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\vdeJwEd.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\AsEmbBD.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\EdTNgSE.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\afiZTIP.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\QPDnlmC.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\zwHIhKd.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\SifhMyU.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\XyPfiTD.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
File created	C:\Windows\System\XKxYriA.exe	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3640	powershell.exe
3640	powershell.exe
3640	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3640	powershell.exe
Token: SeLockMemoryPrivilege	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
Token: SeLockMemoryPrivilege	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3640	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	82
PID 2972 wrote to memory of 3640	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	82
PID 2972 wrote to memory of 2024	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	83
PID 2972 wrote to memory of 2024	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	83
PID 2972 wrote to memory of 1992	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	84
PID 2972 wrote to memory of 1992	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	84
PID 2972 wrote to memory of 4048	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	85
PID 2972 wrote to memory of 4048	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	85
PID 2972 wrote to memory of 1684	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	86
PID 2972 wrote to memory of 1684	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	86
PID 2972 wrote to memory of 1312	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	87
PID 2972 wrote to memory of 1312	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	87
PID 2972 wrote to memory of 2924	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	88
PID 2972 wrote to memory of 2924	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	88
PID 2972 wrote to memory of 984	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	89
PID 2972 wrote to memory of 984	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	89
PID 2972 wrote to memory of 1680	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	90
PID 2972 wrote to memory of 1680	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	90
PID 2972 wrote to memory of 2852	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	91
PID 2972 wrote to memory of 2852	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	91
PID 2972 wrote to memory of 2276	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	92
PID 2972 wrote to memory of 2276	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	92
PID 2972 wrote to memory of 4164	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	93
PID 2972 wrote to memory of 4164	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	93
PID 2972 wrote to memory of 1764	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	94
PID 2972 wrote to memory of 1764	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	94
PID 2972 wrote to memory of 892	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	95
PID 2972 wrote to memory of 892	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	95
PID 2972 wrote to memory of 2036	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	96
PID 2972 wrote to memory of 2036	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	96
PID 2972 wrote to memory of 448	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	97
PID 2972 wrote to memory of 448	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	97
PID 2972 wrote to memory of 4864	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	98
PID 2972 wrote to memory of 4864	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	98
PID 2972 wrote to memory of 4140	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	99
PID 2972 wrote to memory of 4140	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	99
PID 2972 wrote to memory of 5052	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	100
PID 2972 wrote to memory of 5052	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	100
PID 2972 wrote to memory of 8	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	101
PID 2972 wrote to memory of 8	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	101
PID 2972 wrote to memory of 4584	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	102
PID 2972 wrote to memory of 4584	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	102
PID 2972 wrote to memory of 3944	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	103
PID 2972 wrote to memory of 3944	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	103
PID 2972 wrote to memory of 3668	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	104
PID 2972 wrote to memory of 3668	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	104
PID 2972 wrote to memory of 1084	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	105
PID 2972 wrote to memory of 1084	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	105
PID 2972 wrote to memory of 4624	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	106
PID 2972 wrote to memory of 4624	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	106
PID 2972 wrote to memory of 2252	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	107
PID 2972 wrote to memory of 2252	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	107
PID 2972 wrote to memory of 1292	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	108
PID 2972 wrote to memory of 1292	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	108
PID 2972 wrote to memory of 4272	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	109
PID 2972 wrote to memory of 4272	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	109
PID 2972 wrote to memory of 816	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	110
PID 2972 wrote to memory of 816	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	110
PID 2972 wrote to memory of 3868	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	111
PID 2972 wrote to memory of 3868	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	111
PID 2972 wrote to memory of 3248	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	112
PID 2972 wrote to memory of 3248	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	112
PID 2972 wrote to memory of 3796	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	113
PID 2972 wrote to memory of 3796	2972	438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe	113

C:\Users\Admin\AppData\Local\Temp\438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe
"C:\Users\Admin\AppData\Local\Temp\438787f23039ea5fb698e28703449558a12033bf9616139d9632d8b5dec6b69e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- C:\Windows\System\QdXUGzt.exe
  C:\Windows\System\QdXUGzt.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\eFteprv.exe
  C:\Windows\System\eFteprv.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\tHitlWN.exe
  C:\Windows\System\tHitlWN.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\QKkmZFZ.exe
  C:\Windows\System\QKkmZFZ.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\SgsRMCE.exe
  C:\Windows\System\SgsRMCE.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\RLpJKtu.exe
  C:\Windows\System\RLpJKtu.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\fTpbMXa.exe
  C:\Windows\System\fTpbMXa.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\DmSsFqc.exe
  C:\Windows\System\DmSsFqc.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\IrJvagS.exe
  C:\Windows\System\IrJvagS.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\bPABivm.exe
  C:\Windows\System\bPABivm.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\KThFzSg.exe
  C:\Windows\System\KThFzSg.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\gzvyAgk.exe
  C:\Windows\System\gzvyAgk.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\CLTWIXI.exe
  C:\Windows\System\CLTWIXI.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\VIcmlJW.exe
  C:\Windows\System\VIcmlJW.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\qvmdVCT.exe
  C:\Windows\System\qvmdVCT.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\WoNlhbP.exe
  C:\Windows\System\WoNlhbP.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\gGoejjq.exe
  C:\Windows\System\gGoejjq.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\RVEzDnY.exe
  C:\Windows\System\RVEzDnY.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\qrWgOYy.exe
  C:\Windows\System\qrWgOYy.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\XEaHopW.exe
  C:\Windows\System\XEaHopW.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\JZKdQzV.exe
  C:\Windows\System\JZKdQzV.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\XfkwRTm.exe
  C:\Windows\System\XfkwRTm.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\YkrFIQd.exe
  C:\Windows\System\YkrFIQd.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\GHPnVJt.exe
  C:\Windows\System\GHPnVJt.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\jSAVcNe.exe
  C:\Windows\System\jSAVcNe.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\rMSYgYa.exe
  C:\Windows\System\rMSYgYa.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\UXaLNAv.exe
  C:\Windows\System\UXaLNAv.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\cpDWUpu.exe
  C:\Windows\System\cpDWUpu.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\gaBFwcu.exe
  C:\Windows\System\gaBFwcu.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\WeKagkf.exe
  C:\Windows\System\WeKagkf.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\IwhUsIK.exe
  C:\Windows\System\IwhUsIK.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\eKWqqmp.exe
  C:\Windows\System\eKWqqmp.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\RgMIXnn.exe
  C:\Windows\System\RgMIXnn.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\zCfqUuS.exe
  C:\Windows\System\zCfqUuS.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\EOFVLVH.exe
  C:\Windows\System\EOFVLVH.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\WVfgYUc.exe
  C:\Windows\System\WVfgYUc.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\IqiIruw.exe
  C:\Windows\System\IqiIruw.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\wIoqNOt.exe
  C:\Windows\System\wIoqNOt.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\LqjkvfU.exe
  C:\Windows\System\LqjkvfU.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\DWjmxyC.exe
  C:\Windows\System\DWjmxyC.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ivKWLcz.exe
  C:\Windows\System\ivKWLcz.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\PUlDivw.exe
  C:\Windows\System\PUlDivw.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\HZYUIFf.exe
  C:\Windows\System\HZYUIFf.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\tuVQJzO.exe
  C:\Windows\System\tuVQJzO.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ejsyuOu.exe
  C:\Windows\System\ejsyuOu.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\GKrepCS.exe
  C:\Windows\System\GKrepCS.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\hWkIPJW.exe
  C:\Windows\System\hWkIPJW.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\oDCGBke.exe
  C:\Windows\System\oDCGBke.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\KCdXfZs.exe
  C:\Windows\System\KCdXfZs.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\dxCMAmg.exe
  C:\Windows\System\dxCMAmg.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\NpCWWMu.exe
  C:\Windows\System\NpCWWMu.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\bhCfUMS.exe
  C:\Windows\System\bhCfUMS.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\cSSIKfb.exe
  C:\Windows\System\cSSIKfb.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\iyeXefZ.exe
  C:\Windows\System\iyeXefZ.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\sZjlZbp.exe
  C:\Windows\System\sZjlZbp.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\xFbaTSC.exe
  C:\Windows\System\xFbaTSC.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\HOlzRKf.exe
  C:\Windows\System\HOlzRKf.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\TbMVqzQ.exe
  C:\Windows\System\TbMVqzQ.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\smQtgdS.exe
  C:\Windows\System\smQtgdS.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\KPRTwNJ.exe
  C:\Windows\System\KPRTwNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\gBieczU.exe
  C:\Windows\System\gBieczU.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\ambISMN.exe
  C:\Windows\System\ambISMN.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\kJzdxpU.exe
  C:\Windows\System\kJzdxpU.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\dHcUxLW.exe
  C:\Windows\System\dHcUxLW.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\lmebHxK.exe
  C:\Windows\System\lmebHxK.exe
  2⤵
  PID:872
- C:\Windows\System\btGJSmD.exe
  C:\Windows\System\btGJSmD.exe
  2⤵
  PID:2628
- C:\Windows\System\nXRLEFG.exe
  C:\Windows\System\nXRLEFG.exe
  2⤵
  PID:2264
- C:\Windows\System\rzuKvLM.exe
  C:\Windows\System\rzuKvLM.exe
  2⤵
  PID:1180
- C:\Windows\System\ROfcxfT.exe
  C:\Windows\System\ROfcxfT.exe
  2⤵
  PID:1612
- C:\Windows\System\hMXEmJF.exe
  C:\Windows\System\hMXEmJF.exe
  2⤵
  PID:2516
- C:\Windows\System\ZNTJplB.exe
  C:\Windows\System\ZNTJplB.exe
  2⤵
  PID:3476
- C:\Windows\System\sOGcAmK.exe
  C:\Windows\System\sOGcAmK.exe
  2⤵
  PID:1156
- C:\Windows\System\IgHJoce.exe
  C:\Windows\System\IgHJoce.exe
  2⤵
  PID:3408
- C:\Windows\System\cdoNmpH.exe
  C:\Windows\System\cdoNmpH.exe
  2⤵
  PID:1920
- C:\Windows\System\KIyxbYe.exe
  C:\Windows\System\KIyxbYe.exe
  2⤵
  PID:2344
- C:\Windows\System\roLYQnk.exe
  C:\Windows\System\roLYQnk.exe
  2⤵
  PID:2204
- C:\Windows\System\OlCNoVU.exe
  C:\Windows\System\OlCNoVU.exe
  2⤵
  PID:1456
- C:\Windows\System\iMzjsZX.exe
  C:\Windows\System\iMzjsZX.exe
  2⤵
  PID:1972
- C:\Windows\System\cuFIKls.exe
  C:\Windows\System\cuFIKls.exe
  2⤵
  PID:1028
- C:\Windows\System\iKEwifA.exe
  C:\Windows\System\iKEwifA.exe
  2⤵
  PID:1692
- C:\Windows\System\BEEeYMc.exe
  C:\Windows\System\BEEeYMc.exe
  2⤵
  PID:4436
- C:\Windows\System\WVOmKsW.exe
  C:\Windows\System\WVOmKsW.exe
  2⤵
  PID:2376
- C:\Windows\System\ycxAjjI.exe
  C:\Windows\System\ycxAjjI.exe
  2⤵
  PID:2132
- C:\Windows\System\AEsCksh.exe
  C:\Windows\System\AEsCksh.exe
  2⤵
  PID:4640
- C:\Windows\System\syqvFxy.exe
  C:\Windows\System\syqvFxy.exe
  2⤵
  PID:4512
- C:\Windows\System\SOioZqO.exe
  C:\Windows\System\SOioZqO.exe
  2⤵
  PID:3172
- C:\Windows\System\LvzqnvT.exe
  C:\Windows\System\LvzqnvT.exe
  2⤵
  PID:3372
- C:\Windows\System\fhMTkjo.exe
  C:\Windows\System\fhMTkjo.exe
  2⤵
  PID:2560
- C:\Windows\System\wmMQPVI.exe
  C:\Windows\System\wmMQPVI.exe
  2⤵
  PID:1124
- C:\Windows\System\GPBRmxR.exe
  C:\Windows\System\GPBRmxR.exe
  2⤵
  PID:1428
- C:\Windows\System\pRZnPUU.exe
  C:\Windows\System\pRZnPUU.exe
  2⤵
  PID:1736
- C:\Windows\System\UDsGxts.exe
  C:\Windows\System\UDsGxts.exe
  2⤵
  PID:2956
- C:\Windows\System\hwpMZoE.exe
  C:\Windows\System\hwpMZoE.exe
  2⤵
  PID:5044
- C:\Windows\System\IsghBFP.exe
  C:\Windows\System\IsghBFP.exe
  2⤵
  PID:4468
- C:\Windows\System\ChFhJpf.exe
  C:\Windows\System\ChFhJpf.exe
  2⤵
  PID:5132
- C:\Windows\System\xuhcrrT.exe
  C:\Windows\System\xuhcrrT.exe
  2⤵
  PID:5152
- C:\Windows\System\ghPPyyI.exe
  C:\Windows\System\ghPPyyI.exe
  2⤵
  PID:5180
- C:\Windows\System\abcKQTh.exe
  C:\Windows\System\abcKQTh.exe
  2⤵
  PID:5208
- C:\Windows\System\kTaJJqy.exe
  C:\Windows\System\kTaJJqy.exe
  2⤵
  PID:5224
- C:\Windows\System\TWNclEk.exe
  C:\Windows\System\TWNclEk.exe
  2⤵
  PID:5248
- C:\Windows\System\AUgiOTr.exe
  C:\Windows\System\AUgiOTr.exe
  2⤵
  PID:5280
- C:\Windows\System\QxKaPWx.exe
  C:\Windows\System\QxKaPWx.exe
  2⤵
  PID:5300
- C:\Windows\System\tyHqehe.exe
  C:\Windows\System\tyHqehe.exe
  2⤵
  PID:5348
- C:\Windows\System\VygbTYZ.exe
  C:\Windows\System\VygbTYZ.exe
  2⤵
  PID:5388
- C:\Windows\System\hjCKhvq.exe
  C:\Windows\System\hjCKhvq.exe
  2⤵
  PID:5408
- C:\Windows\System\eBIrgBb.exe
  C:\Windows\System\eBIrgBb.exe
  2⤵
  PID:5432
- C:\Windows\System\zwHIhKd.exe
  C:\Windows\System\zwHIhKd.exe
  2⤵
  PID:5456
- C:\Windows\System\HFHEFBF.exe
  C:\Windows\System\HFHEFBF.exe
  2⤵
  PID:5472
- C:\Windows\System\VXATGWU.exe
  C:\Windows\System\VXATGWU.exe
  2⤵
  PID:5492
- C:\Windows\System\ioRttpx.exe
  C:\Windows\System\ioRttpx.exe
  2⤵
  PID:5520
- C:\Windows\System\xlnrOMr.exe
  C:\Windows\System\xlnrOMr.exe
  2⤵
  PID:5596
- C:\Windows\System\NlrNLcT.exe
  C:\Windows\System\NlrNLcT.exe
  2⤵
  PID:5612
- C:\Windows\System\EltEGQu.exe
  C:\Windows\System\EltEGQu.exe
  2⤵
  PID:5632
- C:\Windows\System\lWMYtxQ.exe
  C:\Windows\System\lWMYtxQ.exe
  2⤵
  PID:5660
- C:\Windows\System\zTeEvyg.exe
  C:\Windows\System\zTeEvyg.exe
  2⤵
  PID:5684
- C:\Windows\System\exbDGZa.exe
  C:\Windows\System\exbDGZa.exe
  2⤵
  PID:5708
- C:\Windows\System\zeQFxJX.exe
  C:\Windows\System\zeQFxJX.exe
  2⤵
  PID:5724
- C:\Windows\System\GQpYVLq.exe
  C:\Windows\System\GQpYVLq.exe
  2⤵
  PID:5752
- C:\Windows\System\KDtJNuF.exe
  C:\Windows\System\KDtJNuF.exe
  2⤵
  PID:5776
- C:\Windows\System\HVhvtmk.exe
  C:\Windows\System\HVhvtmk.exe
  2⤵
  PID:5812
- C:\Windows\System\KwHRwOB.exe
  C:\Windows\System\KwHRwOB.exe
  2⤵
  PID:5872
- C:\Windows\System\mwJydkP.exe
  C:\Windows\System\mwJydkP.exe
  2⤵
  PID:5896
- C:\Windows\System\yCWlTWz.exe
  C:\Windows\System\yCWlTWz.exe
  2⤵
  PID:5928
- C:\Windows\System\asUqSIO.exe
  C:\Windows\System\asUqSIO.exe
  2⤵
  PID:5972
- C:\Windows\System\PcvKgFX.exe
  C:\Windows\System\PcvKgFX.exe
  2⤵
  PID:5992
- C:\Windows\System\bOTpHXo.exe
  C:\Windows\System\bOTpHXo.exe
  2⤵
  PID:6012
- C:\Windows\System\wpnqEon.exe
  C:\Windows\System\wpnqEon.exe
  2⤵
  PID:6044
- C:\Windows\System\wXuZHIz.exe
  C:\Windows\System\wXuZHIz.exe
  2⤵
  PID:6068
- C:\Windows\System\RohQslQ.exe
  C:\Windows\System\RohQslQ.exe
  2⤵
  PID:6088
- C:\Windows\System\cIEbWRH.exe
  C:\Windows\System\cIEbWRH.exe
  2⤵
  PID:6128
- C:\Windows\System\lFCZShL.exe
  C:\Windows\System\lFCZShL.exe
  2⤵
  PID:1012
- C:\Windows\System\JoUbxLM.exe
  C:\Windows\System\JoUbxLM.exe
  2⤵
  PID:5064
- C:\Windows\System\xvcWBUH.exe
  C:\Windows\System\xvcWBUH.exe
  2⤵
  PID:5148
- C:\Windows\System\jmMMvyF.exe
  C:\Windows\System\jmMMvyF.exe
  2⤵
  PID:5260
- C:\Windows\System\WyJRIyS.exe
  C:\Windows\System\WyJRIyS.exe
  2⤵
  PID:5272
- C:\Windows\System\ADkrVSf.exe
  C:\Windows\System\ADkrVSf.exe
  2⤵
  PID:5424
- C:\Windows\System\SCFQaWb.exe
  C:\Windows\System\SCFQaWb.exe
  2⤵
  PID:5444
- C:\Windows\System\HJltifO.exe
  C:\Windows\System\HJltifO.exe
  2⤵
  PID:5532
- C:\Windows\System\OjPAFJg.exe
  C:\Windows\System\OjPAFJg.exe
  2⤵
  PID:5580
- C:\Windows\System\ptBThVV.exe
  C:\Windows\System\ptBThVV.exe
  2⤵
  PID:5704
- C:\Windows\System\IuvoUEY.exe
  C:\Windows\System\IuvoUEY.exe
  2⤵
  PID:5764
- C:\Windows\System\iRfYZkS.exe
  C:\Windows\System\iRfYZkS.exe
  2⤵
  PID:5796
- C:\Windows\System\aefZfFW.exe
  C:\Windows\System\aefZfFW.exe
  2⤵
  PID:5892
- C:\Windows\System\IHsOpMI.exe
  C:\Windows\System\IHsOpMI.exe
  2⤵
  PID:5920
- C:\Windows\System\MvsAqET.exe
  C:\Windows\System\MvsAqET.exe
  2⤵
  PID:3540
- C:\Windows\System\sLRDOJE.exe
  C:\Windows\System\sLRDOJE.exe
  2⤵
  PID:6064
- C:\Windows\System\uPBYQjQ.exe
  C:\Windows\System\uPBYQjQ.exe
  2⤵
  PID:6080
- C:\Windows\System\EoluZeF.exe
  C:\Windows\System\EoluZeF.exe
  2⤵
  PID:6124
- C:\Windows\System\TVzgdLW.exe
  C:\Windows\System\TVzgdLW.exe
  2⤵
  PID:3220
- C:\Windows\System\zgIWGUs.exe
  C:\Windows\System\zgIWGUs.exe
  2⤵
  PID:5320
- C:\Windows\System\RvvtLAG.exe
  C:\Windows\System\RvvtLAG.exe
  2⤵
  PID:5468
- C:\Windows\System\LWDpGJk.exe
  C:\Windows\System\LWDpGJk.exe
  2⤵
  PID:2764
- C:\Windows\System\LlQFDXM.exe
  C:\Windows\System\LlQFDXM.exe
  2⤵
  PID:5652
- C:\Windows\System\NHcJvic.exe
  C:\Windows\System\NHcJvic.exe
  2⤵
  PID:5740
- C:\Windows\System\zgBfztV.exe
  C:\Windows\System\zgBfztV.exe
  2⤵
  PID:5856
- C:\Windows\System\bSdvfvo.exe
  C:\Windows\System\bSdvfvo.exe
  2⤵
  PID:5960
- C:\Windows\System\XcTWxRy.exe
  C:\Windows\System\XcTWxRy.exe
  2⤵
  PID:6008
- C:\Windows\System\kfZpDsE.exe
  C:\Windows\System\kfZpDsE.exe
  2⤵
  PID:6112
- C:\Windows\System\PCxLPlL.exe
  C:\Windows\System\PCxLPlL.exe
  2⤵
  PID:5404
- C:\Windows\System\iZiYmxY.exe
  C:\Windows\System\iZiYmxY.exe
  2⤵
  PID:5608
- C:\Windows\System\RumQlfo.exe
  C:\Windows\System\RumQlfo.exe
  2⤵
  PID:5488
- C:\Windows\System\unnKAMW.exe
  C:\Windows\System\unnKAMW.exe
  2⤵
  PID:5860
- C:\Windows\System\pKrQSUV.exe
  C:\Windows\System\pKrQSUV.exe
  2⤵
  PID:6152
- C:\Windows\System\qrbqZpt.exe
  C:\Windows\System\qrbqZpt.exe
  2⤵
  PID:6176
- C:\Windows\System\owHEfQC.exe
  C:\Windows\System\owHEfQC.exe
  2⤵
  PID:6192
- C:\Windows\System\cmCneJS.exe
  C:\Windows\System\cmCneJS.exe
  2⤵
  PID:6212
- C:\Windows\System\FWmUxxF.exe
  C:\Windows\System\FWmUxxF.exe
  2⤵
  PID:6240
- C:\Windows\System\kMuLIuw.exe
  C:\Windows\System\kMuLIuw.exe
  2⤵
  PID:6264
- C:\Windows\System\XyqHbYm.exe
  C:\Windows\System\XyqHbYm.exe
  2⤵
  PID:6288
- C:\Windows\System\gUkCcrj.exe
  C:\Windows\System\gUkCcrj.exe
  2⤵
  PID:6316
- C:\Windows\System\AqsyhQv.exe
  C:\Windows\System\AqsyhQv.exe
  2⤵
  PID:6340
- C:\Windows\System\FgfFGOZ.exe
  C:\Windows\System\FgfFGOZ.exe
  2⤵
  PID:6356
- C:\Windows\System\xQKjlyV.exe
  C:\Windows\System\xQKjlyV.exe
  2⤵
  PID:6380
- C:\Windows\System\BfKpVub.exe
  C:\Windows\System\BfKpVub.exe
  2⤵
  PID:6504
- C:\Windows\System\MRSIeSq.exe
  C:\Windows\System\MRSIeSq.exe
  2⤵
  PID:6528
- C:\Windows\System\mYjSghr.exe
  C:\Windows\System\mYjSghr.exe
  2⤵
  PID:6556
- C:\Windows\System\BfdyWQX.exe
  C:\Windows\System\BfdyWQX.exe
  2⤵
  PID:6612
- C:\Windows\System\txcvFwQ.exe
  C:\Windows\System\txcvFwQ.exe
  2⤵
  PID:6636
- C:\Windows\System\WIPJLjD.exe
  C:\Windows\System\WIPJLjD.exe
  2⤵
  PID:6688
- C:\Windows\System\LtsUtkb.exe
  C:\Windows\System\LtsUtkb.exe
  2⤵
  PID:6712
- C:\Windows\System\ewYiNvT.exe
  C:\Windows\System\ewYiNvT.exe
  2⤵
  PID:6740
- C:\Windows\System\BzCmUxk.exe
  C:\Windows\System\BzCmUxk.exe
  2⤵
  PID:6756
- C:\Windows\System\TQWiBCD.exe
  C:\Windows\System\TQWiBCD.exe
  2⤵
  PID:6776
- C:\Windows\System\vTFTmSA.exe
  C:\Windows\System\vTFTmSA.exe
  2⤵
  PID:6816
- C:\Windows\System\xdYVLzQ.exe
  C:\Windows\System\xdYVLzQ.exe
  2⤵
  PID:6836
- C:\Windows\System\mMHOjpV.exe
  C:\Windows\System\mMHOjpV.exe
  2⤵
  PID:6864
- C:\Windows\System\QtpAUyg.exe
  C:\Windows\System\QtpAUyg.exe
  2⤵
  PID:6912
- C:\Windows\System\AJmKQFJ.exe
  C:\Windows\System\AJmKQFJ.exe
  2⤵
  PID:6932
- C:\Windows\System\LpuCcLb.exe
  C:\Windows\System\LpuCcLb.exe
  2⤵
  PID:6968
- C:\Windows\System\CjWMxhw.exe
  C:\Windows\System\CjWMxhw.exe
  2⤵
  PID:6988
- C:\Windows\System\maiwEZf.exe
  C:\Windows\System\maiwEZf.exe
  2⤵
  PID:7020
- C:\Windows\System\FVSNACV.exe
  C:\Windows\System\FVSNACV.exe
  2⤵
  PID:7048
- C:\Windows\System\HprFWPU.exe
  C:\Windows\System\HprFWPU.exe
  2⤵
  PID:7076
- C:\Windows\System\zRfYxIb.exe
  C:\Windows\System\zRfYxIb.exe
  2⤵
  PID:7112
- C:\Windows\System\QxVOWEo.exe
  C:\Windows\System\QxVOWEo.exe
  2⤵
  PID:7132
- C:\Windows\System\mCqtkuK.exe
  C:\Windows\System\mCqtkuK.exe
  2⤵
  PID:7152
- C:\Windows\System\SSeAAFu.exe
  C:\Windows\System\SSeAAFu.exe
  2⤵
  PID:4284
- C:\Windows\System\zvtKAWP.exe
  C:\Windows\System\zvtKAWP.exe
  2⤵
  PID:6252
- C:\Windows\System\yoqmHZU.exe
  C:\Windows\System\yoqmHZU.exe
  2⤵
  PID:6188
- C:\Windows\System\SifhMyU.exe
  C:\Windows\System\SifhMyU.exe
  2⤵
  PID:6364
- C:\Windows\System\TTfURBb.exe
  C:\Windows\System\TTfURBb.exe
  2⤵
  PID:6280
- C:\Windows\System\yXgznpq.exe
  C:\Windows\System\yXgznpq.exe
  2⤵
  PID:6520
- C:\Windows\System\ToHiaXu.exe
  C:\Windows\System\ToHiaXu.exe
  2⤵
  PID:6544
- C:\Windows\System\iqQvyYk.exe
  C:\Windows\System\iqQvyYk.exe
  2⤵
  PID:6588
- C:\Windows\System\dBZRiCz.exe
  C:\Windows\System\dBZRiCz.exe
  2⤵
  PID:6596
- C:\Windows\System\kqKjiIC.exe
  C:\Windows\System\kqKjiIC.exe
  2⤵
  PID:6704
- C:\Windows\System\SmKqVnx.exe
  C:\Windows\System\SmKqVnx.exe
  2⤵
  PID:6724
- C:\Windows\System\ddrbEcA.exe
  C:\Windows\System\ddrbEcA.exe
  2⤵
  PID:6796
- C:\Windows\System\KRPbABR.exe
  C:\Windows\System\KRPbABR.exe
  2⤵
  PID:6828
- C:\Windows\System\Hnykaau.exe
  C:\Windows\System\Hnykaau.exe
  2⤵
  PID:6876
- C:\Windows\System\fdXqDWN.exe
  C:\Windows\System\fdXqDWN.exe
  2⤵
  PID:6944
- C:\Windows\System\uYaMuOr.exe
  C:\Windows\System\uYaMuOr.exe
  2⤵
  PID:7004
- C:\Windows\System\aLCETFm.exe
  C:\Windows\System\aLCETFm.exe
  2⤵
  PID:7044
- C:\Windows\System\fHOoPrL.exe
  C:\Windows\System\fHOoPrL.exe
  2⤵
  PID:7120
- C:\Windows\System\pPKsDbG.exe
  C:\Windows\System\pPKsDbG.exe
  2⤵
  PID:5880
- C:\Windows\System\VhTDewC.exe
  C:\Windows\System\VhTDewC.exe
  2⤵
  PID:6548
- C:\Windows\System\wpPcPAm.exe
  C:\Windows\System\wpPcPAm.exe
  2⤵
  PID:6600
- C:\Windows\System\yeOMuvy.exe
  C:\Windows\System\yeOMuvy.exe
  2⤵
  PID:6720
- C:\Windows\System\lJfJpRZ.exe
  C:\Windows\System\lJfJpRZ.exe
  2⤵
  PID:5240
- C:\Windows\System\lZpZtTm.exe
  C:\Windows\System\lZpZtTm.exe
  2⤵
  PID:5100
- C:\Windows\System\pejHsNP.exe
  C:\Windows\System\pejHsNP.exe
  2⤵
  PID:1008
- C:\Windows\System\bWqqxUv.exe
  C:\Windows\System\bWqqxUv.exe
  2⤵
  PID:7128
- C:\Windows\System\XTYFZHw.exe
  C:\Windows\System\XTYFZHw.exe
  2⤵
  PID:3956
- C:\Windows\System\yixwkOV.exe
  C:\Windows\System\yixwkOV.exe
  2⤵
  PID:6204
- C:\Windows\System\dIkeuCM.exe
  C:\Windows\System\dIkeuCM.exe
  2⤵
  PID:6296
- C:\Windows\System\HFgYGqg.exe
  C:\Windows\System\HFgYGqg.exe
  2⤵
  PID:6348
- C:\Windows\System\evPqGlP.exe
  C:\Windows\System\evPqGlP.exe
  2⤵
  PID:7172
- C:\Windows\System\VsZALtY.exe
  C:\Windows\System\VsZALtY.exe
  2⤵
  PID:7192
- C:\Windows\System\NFApvlp.exe
  C:\Windows\System\NFApvlp.exe
  2⤵
  PID:7220
- C:\Windows\System\ecDFpal.exe
  C:\Windows\System\ecDFpal.exe
  2⤵
  PID:7248
- C:\Windows\System\sOBYAnm.exe
  C:\Windows\System\sOBYAnm.exe
  2⤵
  PID:7268
- C:\Windows\System\UlObHlj.exe
  C:\Windows\System\UlObHlj.exe
  2⤵
  PID:7300
- C:\Windows\System\HSdNnGs.exe
  C:\Windows\System\HSdNnGs.exe
  2⤵
  PID:7336
- C:\Windows\System\EBGIrFq.exe
  C:\Windows\System\EBGIrFq.exe
  2⤵
  PID:7356
- C:\Windows\System\tCyXvyA.exe
  C:\Windows\System\tCyXvyA.exe
  2⤵
  PID:7392
- C:\Windows\System\RjIsgEn.exe
  C:\Windows\System\RjIsgEn.exe
  2⤵
  PID:7420
- C:\Windows\System\RMRWebu.exe
  C:\Windows\System\RMRWebu.exe
  2⤵
  PID:7444
- C:\Windows\System\LeSOHpy.exe
  C:\Windows\System\LeSOHpy.exe
  2⤵
  PID:7476
- C:\Windows\System\ZiwCCdi.exe
  C:\Windows\System\ZiwCCdi.exe
  2⤵
  PID:7504
- C:\Windows\System\kaonoRn.exe
  C:\Windows\System\kaonoRn.exe
  2⤵
  PID:7528
- C:\Windows\System\IxopHTJ.exe
  C:\Windows\System\IxopHTJ.exe
  2⤵
  PID:7544
- C:\Windows\System\uCWFQTL.exe
  C:\Windows\System\uCWFQTL.exe
  2⤵
  PID:7576
- C:\Windows\System\duKFJIl.exe
  C:\Windows\System\duKFJIl.exe
  2⤵
  PID:7628
- C:\Windows\System\KJlGsFN.exe
  C:\Windows\System\KJlGsFN.exe
  2⤵
  PID:7660
- C:\Windows\System\vpFulJn.exe
  C:\Windows\System\vpFulJn.exe
  2⤵
  PID:7680
- C:\Windows\System\ntYJzhA.exe
  C:\Windows\System\ntYJzhA.exe
  2⤵
  PID:7720
- C:\Windows\System\HWfAqsy.exe
  C:\Windows\System\HWfAqsy.exe
  2⤵
  PID:7744
- C:\Windows\System\qLuCiGx.exe
  C:\Windows\System\qLuCiGx.exe
  2⤵
  PID:7764
- C:\Windows\System\evSCgqA.exe
  C:\Windows\System\evSCgqA.exe
  2⤵
  PID:7784
- C:\Windows\System\rFoRoWT.exe
  C:\Windows\System\rFoRoWT.exe
  2⤵
  PID:7812
- C:\Windows\System\eWSqIns.exe
  C:\Windows\System\eWSqIns.exe
  2⤵
  PID:7856
- C:\Windows\System\hKNanIN.exe
  C:\Windows\System\hKNanIN.exe
  2⤵
  PID:7876
- C:\Windows\System\zgnVuyq.exe
  C:\Windows\System\zgnVuyq.exe
  2⤵
  PID:7896
- C:\Windows\System\NEoLftJ.exe
  C:\Windows\System\NEoLftJ.exe
  2⤵
  PID:7936
- C:\Windows\System\zYdvBnZ.exe
  C:\Windows\System\zYdvBnZ.exe
  2⤵
  PID:7976
- C:\Windows\System\WBjpbjR.exe
  C:\Windows\System\WBjpbjR.exe
  2⤵
  PID:8004
- C:\Windows\System\gvNQBQV.exe
  C:\Windows\System\gvNQBQV.exe
  2⤵
  PID:8040
- C:\Windows\System\qDgESMa.exe
  C:\Windows\System\qDgESMa.exe
  2⤵
  PID:8072
- C:\Windows\System\nHpFpvw.exe
  C:\Windows\System\nHpFpvw.exe
  2⤵
  PID:8088
- C:\Windows\System\mzHUcCC.exe
  C:\Windows\System\mzHUcCC.exe
  2⤵
  PID:8132
- C:\Windows\System\vXaQxqF.exe
  C:\Windows\System\vXaQxqF.exe
  2⤵
  PID:8156
- C:\Windows\System\vBdgiwj.exe
  C:\Windows\System\vBdgiwj.exe
  2⤵
  PID:8184
- C:\Windows\System\cyPZbyv.exe
  C:\Windows\System\cyPZbyv.exe
  2⤵
  PID:6812
- C:\Windows\System\IQAyPSk.exe
  C:\Windows\System\IQAyPSk.exe
  2⤵
  PID:7016
- C:\Windows\System\HVsRtnE.exe
  C:\Windows\System\HVsRtnE.exe
  2⤵
  PID:7244
- C:\Windows\System\uHtJQPV.exe
  C:\Windows\System\uHtJQPV.exe
  2⤵
  PID:7316
- C:\Windows\System\pnQHiFX.exe
  C:\Windows\System\pnQHiFX.exe
  2⤵
  PID:7384
- C:\Windows\System\CbagYSp.exe
  C:\Windows\System\CbagYSp.exe
  2⤵
  PID:7500
- C:\Windows\System\MqhWqZu.exe
  C:\Windows\System\MqhWqZu.exe
  2⤵
  PID:7524
- C:\Windows\System\tPEzAGg.exe
  C:\Windows\System\tPEzAGg.exe
  2⤵
  PID:7588
- C:\Windows\System\lDsFQfG.exe
  C:\Windows\System\lDsFQfG.exe
  2⤵
  PID:7620
- C:\Windows\System\PqKLldU.exe
  C:\Windows\System\PqKLldU.exe
  2⤵
  PID:7676
- C:\Windows\System\XMSqXJQ.exe
  C:\Windows\System\XMSqXJQ.exe
  2⤵
  PID:7752
- C:\Windows\System\qNRQMgX.exe
  C:\Windows\System\qNRQMgX.exe
  2⤵
  PID:7792
- C:\Windows\System\hEvAVqh.exe
  C:\Windows\System\hEvAVqh.exe
  2⤵
  PID:7872
- C:\Windows\System\zFyCsca.exe
  C:\Windows\System\zFyCsca.exe
  2⤵
  PID:7968
- C:\Windows\System\vmWXvnW.exe
  C:\Windows\System\vmWXvnW.exe
  2⤵
  PID:7992
- C:\Windows\System\SSnEJdA.exe
  C:\Windows\System\SSnEJdA.exe
  2⤵
  PID:8060
- C:\Windows\System\MnsRoNs.exe
  C:\Windows\System\MnsRoNs.exe
  2⤵
  PID:8112
- C:\Windows\System\fmeQdiN.exe
  C:\Windows\System\fmeQdiN.exe
  2⤵
  PID:8148
- C:\Windows\System\RtTzLyO.exe
  C:\Windows\System\RtTzLyO.exe
  2⤵
  PID:5824
- C:\Windows\System\uLVrBkM.exe
  C:\Windows\System\uLVrBkM.exe
  2⤵
  PID:7308
- C:\Windows\System\QJejnuq.exe
  C:\Windows\System\QJejnuq.exe
  2⤵
  PID:7584
- C:\Windows\System\JUpFNZV.exe
  C:\Windows\System\JUpFNZV.exe
  2⤵
  PID:7736
- C:\Windows\System\PzRzNSo.exe
  C:\Windows\System\PzRzNSo.exe
  2⤵
  PID:7844
- C:\Windows\System\AJekknD.exe
  C:\Windows\System\AJekknD.exe
  2⤵
  PID:7916
- C:\Windows\System\qUbhsfC.exe
  C:\Windows\System\qUbhsfC.exe
  2⤵
  PID:8084
- C:\Windows\System\UNtTdgF.exe
  C:\Windows\System\UNtTdgF.exe
  2⤵
  PID:8172
- C:\Windows\System\zpCKvIP.exe
  C:\Windows\System\zpCKvIP.exe
  2⤵
  PID:7540
- C:\Windows\System\MUeiTfF.exe
  C:\Windows\System\MUeiTfF.exe
  2⤵
  PID:3720
- C:\Windows\System\IigLYLN.exe
  C:\Windows\System\IigLYLN.exe
  2⤵
  PID:7280
- C:\Windows\System\dKusdCV.exe
  C:\Windows\System\dKusdCV.exe
  2⤵
  PID:8196
- C:\Windows\System\vhfVpDQ.exe
  C:\Windows\System\vhfVpDQ.exe
  2⤵
  PID:8216
- C:\Windows\System\SCHUFJh.exe
  C:\Windows\System\SCHUFJh.exe
  2⤵
  PID:8240
- C:\Windows\System\yiDRQTM.exe
  C:\Windows\System\yiDRQTM.exe
  2⤵
  PID:8288
- C:\Windows\System\YbAVMTh.exe
  C:\Windows\System\YbAVMTh.exe
  2⤵
  PID:8312
- C:\Windows\System\iyUlzLQ.exe
  C:\Windows\System\iyUlzLQ.exe
  2⤵
  PID:8332
- C:\Windows\System\cxVqVfl.exe
  C:\Windows\System\cxVqVfl.exe
  2⤵
  PID:8388
- C:\Windows\System\PAaQUzi.exe
  C:\Windows\System\PAaQUzi.exe
  2⤵
  PID:8428
- C:\Windows\System\IGvYaZv.exe
  C:\Windows\System\IGvYaZv.exe
  2⤵
  PID:8452
- C:\Windows\System\WOacWLn.exe
  C:\Windows\System\WOacWLn.exe
  2⤵
  PID:8492
- C:\Windows\System\jJDVFDL.exe
  C:\Windows\System\jJDVFDL.exe
  2⤵
  PID:8516
- C:\Windows\System\FyGGLaR.exe
  C:\Windows\System\FyGGLaR.exe
  2⤵
  PID:8544
- C:\Windows\System\Hpibueu.exe
  C:\Windows\System\Hpibueu.exe
  2⤵
  PID:8564
- C:\Windows\System\GoCOoYt.exe
  C:\Windows\System\GoCOoYt.exe
  2⤵
  PID:8588
- C:\Windows\System\zpeHNnO.exe
  C:\Windows\System\zpeHNnO.exe
  2⤵
  PID:8616
- C:\Windows\System\hLioSiX.exe
  C:\Windows\System\hLioSiX.exe
  2⤵
  PID:8660
- C:\Windows\System\RehxsQh.exe
  C:\Windows\System\RehxsQh.exe
  2⤵
  PID:8680
- C:\Windows\System\rLJILLv.exe
  C:\Windows\System\rLJILLv.exe
  2⤵
  PID:8704
- C:\Windows\System\vYhREAG.exe
  C:\Windows\System\vYhREAG.exe
  2⤵
  PID:8744
- C:\Windows\System\xwXjbdH.exe
  C:\Windows\System\xwXjbdH.exe
  2⤵
  PID:8772
- C:\Windows\System\bRRAkrB.exe
  C:\Windows\System\bRRAkrB.exe
  2⤵
  PID:8796
- C:\Windows\System\FdmLdfa.exe
  C:\Windows\System\FdmLdfa.exe
  2⤵
  PID:8828
- C:\Windows\System\oldLYDJ.exe
  C:\Windows\System\oldLYDJ.exe
  2⤵
  PID:8864
- C:\Windows\System\awoEiAk.exe
  C:\Windows\System\awoEiAk.exe
  2⤵
  PID:8884
- C:\Windows\System\gcWMSlH.exe
  C:\Windows\System\gcWMSlH.exe
  2⤵
  PID:8924
- C:\Windows\System\oKZzSMI.exe
  C:\Windows\System\oKZzSMI.exe
  2⤵
  PID:8948
- C:\Windows\System\lRLsPnB.exe
  C:\Windows\System\lRLsPnB.exe
  2⤵
  PID:8972
- C:\Windows\System\flQUqEE.exe
  C:\Windows\System\flQUqEE.exe
  2⤵
  PID:8996
- C:\Windows\System\sjGTpVq.exe
  C:\Windows\System\sjGTpVq.exe
  2⤵
  PID:9032
- C:\Windows\System\EwKskOg.exe
  C:\Windows\System\EwKskOg.exe
  2⤵
  PID:9052
- C:\Windows\System\BUHjebR.exe
  C:\Windows\System\BUHjebR.exe
  2⤵
  PID:9104
- C:\Windows\System\HPbUDHf.exe
  C:\Windows\System\HPbUDHf.exe
  2⤵
  PID:9124
- C:\Windows\System\QEoVYJU.exe
  C:\Windows\System\QEoVYJU.exe
  2⤵
  PID:9148
- C:\Windows\System\dekMAXL.exe
  C:\Windows\System\dekMAXL.exe
  2⤵
  PID:9176
- C:\Windows\System\hvlkkMg.exe
  C:\Windows\System\hvlkkMg.exe
  2⤵
  PID:9204
- C:\Windows\System\dkDoAZt.exe
  C:\Windows\System\dkDoAZt.exe
  2⤵
  PID:8144
- C:\Windows\System\yMSWEjo.exe
  C:\Windows\System\yMSWEjo.exe
  2⤵
  PID:8080
- C:\Windows\System\JPtLhDG.exe
  C:\Windows\System\JPtLhDG.exe
  2⤵
  PID:8232
- C:\Windows\System\WqnavRT.exe
  C:\Windows\System\WqnavRT.exe
  2⤵
  PID:8268
- C:\Windows\System\QoPnQGI.exe
  C:\Windows\System\QoPnQGI.exe
  2⤵
  PID:8400
- C:\Windows\System\cMsWfhs.exe
  C:\Windows\System\cMsWfhs.exe
  2⤵
  PID:8472
- C:\Windows\System\jVzqSjN.exe
  C:\Windows\System\jVzqSjN.exe
  2⤵
  PID:8556
- C:\Windows\System\IgysmnA.exe
  C:\Windows\System\IgysmnA.exe
  2⤵
  PID:8612
- C:\Windows\System\WnBFvSh.exe
  C:\Windows\System\WnBFvSh.exe
  2⤵
  PID:8652
- C:\Windows\System\qAAigOX.exe
  C:\Windows\System\qAAigOX.exe
  2⤵
  PID:8752
- C:\Windows\System\aKJfKbw.exe
  C:\Windows\System\aKJfKbw.exe
  2⤵
  PID:3264
- C:\Windows\System\VWRrQtE.exe
  C:\Windows\System\VWRrQtE.exe
  2⤵
  PID:8856
- C:\Windows\System\jyAZFNU.exe
  C:\Windows\System\jyAZFNU.exe
  2⤵
  PID:8936
- C:\Windows\System\bpWemEf.exe
  C:\Windows\System\bpWemEf.exe
  2⤵
  PID:8988
- C:\Windows\System\wfEFraB.exe
  C:\Windows\System\wfEFraB.exe
  2⤵
  PID:9016
- C:\Windows\System\IZktkwj.exe
  C:\Windows\System\IZktkwj.exe
  2⤵
  PID:3468
- C:\Windows\System\RrDimsQ.exe
  C:\Windows\System\RrDimsQ.exe
  2⤵
  PID:9136
- C:\Windows\System\quuMfRy.exe
  C:\Windows\System\quuMfRy.exe
  2⤵
  PID:9192
- C:\Windows\System\jNJLFbb.exe
  C:\Windows\System\jNJLFbb.exe
  2⤵
  PID:8128
- C:\Windows\System\ompwtOC.exe
  C:\Windows\System\ompwtOC.exe
  2⤵
  PID:8360
- C:\Windows\System\bTYQPTV.exe
  C:\Windows\System\bTYQPTV.exe
  2⤵
  PID:8424
- C:\Windows\System\QophIVS.exe
  C:\Windows\System\QophIVS.exe
  2⤵
  PID:8632
- C:\Windows\System\bpAzpKM.exe
  C:\Windows\System\bpAzpKM.exe
  2⤵
  PID:8820
- C:\Windows\System\QcinDBt.exe
  C:\Windows\System\QcinDBt.exe
  2⤵
  PID:8880
- C:\Windows\System\nGhevNb.exe
  C:\Windows\System\nGhevNb.exe
  2⤵
  PID:9048
- C:\Windows\System\GijpMSi.exe
  C:\Windows\System\GijpMSi.exe
  2⤵
  PID:8236
- C:\Windows\System\QHTKBXr.exe
  C:\Windows\System\QHTKBXr.exe
  2⤵
  PID:8208
- C:\Windows\System\SGBvOlG.exe
  C:\Windows\System\SGBvOlG.exe
  2⤵
  PID:8852
- C:\Windows\System\uLSIhMT.exe
  C:\Windows\System\uLSIhMT.exe
  2⤵
  PID:8780
- C:\Windows\System\lffhbir.exe
  C:\Windows\System\lffhbir.exe
  2⤵
  PID:9212
- C:\Windows\System\xnIIGQW.exe
  C:\Windows\System\xnIIGQW.exe
  2⤵
  PID:9228
- C:\Windows\System\VIzweyn.exe
  C:\Windows\System\VIzweyn.exe
  2⤵
  PID:9256
- C:\Windows\System\KOGXthV.exe
  C:\Windows\System\KOGXthV.exe
  2⤵
  PID:9300
- C:\Windows\System\BAnHVCv.exe
  C:\Windows\System\BAnHVCv.exe
  2⤵
  PID:9324
- C:\Windows\System\rSzCjKq.exe
  C:\Windows\System\rSzCjKq.exe
  2⤵
  PID:9344
- C:\Windows\System\omSiBlT.exe
  C:\Windows\System\omSiBlT.exe
  2⤵
  PID:9368
- C:\Windows\System\iNcfbVu.exe
  C:\Windows\System\iNcfbVu.exe
  2⤵
  PID:9396
- C:\Windows\System\xBzFhMs.exe
  C:\Windows\System\xBzFhMs.exe
  2⤵
  PID:9424
- C:\Windows\System\ICMehUT.exe
  C:\Windows\System\ICMehUT.exe
  2⤵
  PID:9448
- C:\Windows\System\iwvVrnC.exe
  C:\Windows\System\iwvVrnC.exe
  2⤵
  PID:9484
- C:\Windows\System\EWnmFuM.exe
  C:\Windows\System\EWnmFuM.exe
  2⤵
  PID:9508
- C:\Windows\System\ObrRHHh.exe
  C:\Windows\System\ObrRHHh.exe
  2⤵
  PID:9540
- C:\Windows\System\rXBnePi.exe
  C:\Windows\System\rXBnePi.exe
  2⤵
  PID:9560
- C:\Windows\System\lLffVTF.exe
  C:\Windows\System\lLffVTF.exe
  2⤵
  PID:9608
- C:\Windows\System\iqMSNAo.exe
  C:\Windows\System\iqMSNAo.exe
  2⤵
  PID:9652
- C:\Windows\System\aCdVtNP.exe
  C:\Windows\System\aCdVtNP.exe
  2⤵
  PID:9680
- C:\Windows\System\tImGLqm.exe
  C:\Windows\System\tImGLqm.exe
  2⤵
  PID:9708
- C:\Windows\System\CXhLhpe.exe
  C:\Windows\System\CXhLhpe.exe
  2⤵
  PID:9728
- C:\Windows\System\muTPBvm.exe
  C:\Windows\System\muTPBvm.exe
  2⤵
  PID:9756
- C:\Windows\System\MhSORTx.exe
  C:\Windows\System\MhSORTx.exe
  2⤵
  PID:9776
- C:\Windows\System\bLDyTry.exe
  C:\Windows\System\bLDyTry.exe
  2⤵
  PID:9808
- C:\Windows\System\CjBcuwD.exe
  C:\Windows\System\CjBcuwD.exe
  2⤵
  PID:9840
- C:\Windows\System\VNsYLVY.exe
  C:\Windows\System\VNsYLVY.exe
  2⤵
  PID:9856
- C:\Windows\System\aNgMikz.exe
  C:\Windows\System\aNgMikz.exe
  2⤵
  PID:9912
- C:\Windows\System\yBlwBjf.exe
  C:\Windows\System\yBlwBjf.exe
  2⤵
  PID:9948
- C:\Windows\System\JapiiQl.exe
  C:\Windows\System\JapiiQl.exe
  2⤵
  PID:9972
- C:\Windows\System\VSeNMwp.exe
  C:\Windows\System\VSeNMwp.exe
  2⤵
  PID:9992
- C:\Windows\System\avTNevF.exe
  C:\Windows\System\avTNevF.exe
  2⤵
  PID:10008
- C:\Windows\System\uicoUrJ.exe
  C:\Windows\System\uicoUrJ.exe
  2⤵
  PID:10028
- C:\Windows\System\hnoFpHA.exe
  C:\Windows\System\hnoFpHA.exe
  2⤵
  PID:10044
- C:\Windows\System\kSqWrrb.exe
  C:\Windows\System\kSqWrrb.exe
  2⤵
  PID:10060
- C:\Windows\System\gWRehiD.exe
  C:\Windows\System\gWRehiD.exe
  2⤵
  PID:10080
- C:\Windows\System\XHHivVJ.exe
  C:\Windows\System\XHHivVJ.exe
  2⤵
  PID:10128
- C:\Windows\System\RVllfib.exe
  C:\Windows\System\RVllfib.exe
  2⤵
  PID:10152
- C:\Windows\System\QKzoBak.exe
  C:\Windows\System\QKzoBak.exe
  2⤵
  PID:10168
- C:\Windows\System\lZWlPDA.exe
  C:\Windows\System\lZWlPDA.exe
  2⤵
  PID:10184
- C:\Windows\System\KZhqCtG.exe
  C:\Windows\System\KZhqCtG.exe
  2⤵
  PID:10204
- C:\Windows\System\HiTWZXG.exe
  C:\Windows\System\HiTWZXG.exe
  2⤵
  PID:9292
- C:\Windows\System\DDXipAo.exe
  C:\Windows\System\DDXipAo.exe
  2⤵
  PID:9436
- C:\Windows\System\cWdeynI.exe
  C:\Windows\System\cWdeynI.exe
  2⤵
  PID:9416
- C:\Windows\System\baqgcyv.exe
  C:\Windows\System\baqgcyv.exe
  2⤵
  PID:9480
- C:\Windows\System\TZkmtmp.exe
  C:\Windows\System\TZkmtmp.exe
  2⤵
  PID:9552
- C:\Windows\System\ifvhvzu.exe
  C:\Windows\System\ifvhvzu.exe
  2⤵
  PID:9580
- C:\Windows\System\WtjVbii.exe
  C:\Windows\System\WtjVbii.exe
  2⤵
  PID:9716
- C:\Windows\System\AhHyObC.exe
  C:\Windows\System\AhHyObC.exe
  2⤵
  PID:9740
- C:\Windows\System\SUzFsPN.exe
  C:\Windows\System\SUzFsPN.exe
  2⤵
  PID:9820
- C:\Windows\System\OurMQdv.exe
  C:\Windows\System\OurMQdv.exe
  2⤵
  PID:9832
- C:\Windows\System\pSNTdjd.exe
  C:\Windows\System\pSNTdjd.exe
  2⤵
  PID:4172
- C:\Windows\System\hDUfFIk.exe
  C:\Windows\System\hDUfFIk.exe
  2⤵
  PID:9928
- C:\Windows\System\ssdXbWb.exe
  C:\Windows\System\ssdXbWb.exe
  2⤵
  PID:9936
- C:\Windows\System\dzxlEuh.exe
  C:\Windows\System\dzxlEuh.exe
  2⤵
  PID:10016
- C:\Windows\System\NvXzvbw.exe
  C:\Windows\System\NvXzvbw.exe
  2⤵
  PID:10092
- C:\Windows\System\JtsBXdd.exe
  C:\Windows\System\JtsBXdd.exe
  2⤵
  PID:10192
- C:\Windows\System\qbcphbH.exe
  C:\Windows\System\qbcphbH.exe
  2⤵
  PID:8676
- C:\Windows\System\kbykFgZ.exe
  C:\Windows\System\kbykFgZ.exe
  2⤵
  PID:9388
- C:\Windows\System\xDELdbJ.exe
  C:\Windows\System\xDELdbJ.exe
  2⤵
  PID:9548
- C:\Windows\System\baMuAfs.exe
  C:\Windows\System\baMuAfs.exe
  2⤵
  PID:9980
- C:\Windows\System\TsuoDoh.exe
  C:\Windows\System\TsuoDoh.exe
  2⤵
  PID:9968
- C:\Windows\System\evjsfFg.exe
  C:\Windows\System\evjsfFg.exe
  2⤵
  PID:10104
- C:\Windows\System\NOKSCol.exe
  C:\Windows\System\NOKSCol.exe
  2⤵
  PID:10200
- C:\Windows\System\jVYTfZs.exe
  C:\Windows\System\jVYTfZs.exe
  2⤵
  PID:9492
- C:\Windows\System\IfyuMyW.exe
  C:\Windows\System\IfyuMyW.exe
  2⤵
  PID:9720
- C:\Windows\System\drPEJqE.exe
  C:\Windows\System\drPEJqE.exe
  2⤵
  PID:10176
- C:\Windows\System\KZHDOIP.exe
  C:\Windows\System\KZHDOIP.exe
  2⤵
  PID:9880
- C:\Windows\System\QPyaWaI.exe
  C:\Windows\System\QPyaWaI.exe
  2⤵
  PID:4408
- C:\Windows\System\TCaZclD.exe
  C:\Windows\System\TCaZclD.exe
  2⤵
  PID:9688
- C:\Windows\System\UCLCXhi.exe
  C:\Windows\System\UCLCXhi.exe
  2⤵
  PID:10256
- C:\Windows\System\zHkkYAI.exe
  C:\Windows\System\zHkkYAI.exe
  2⤵
  PID:10276
- C:\Windows\System\UitLwoV.exe
  C:\Windows\System\UitLwoV.exe
  2⤵
  PID:10296
- C:\Windows\System\yChpgYW.exe
  C:\Windows\System\yChpgYW.exe
  2⤵
  PID:10316
- C:\Windows\System\JvfypzL.exe
  C:\Windows\System\JvfypzL.exe
  2⤵
  PID:10348
- C:\Windows\System\pFOnBYb.exe
  C:\Windows\System\pFOnBYb.exe
  2⤵
  PID:10408
- C:\Windows\System\ygUqqBn.exe
  C:\Windows\System\ygUqqBn.exe
  2⤵
  PID:10436
- C:\Windows\System\nMqNrQS.exe
  C:\Windows\System\nMqNrQS.exe
  2⤵
  PID:10476
- C:\Windows\System\RPInXEt.exe
  C:\Windows\System\RPInXEt.exe
  2⤵
  PID:10500
- C:\Windows\System\uLMHTwk.exe
  C:\Windows\System\uLMHTwk.exe
  2⤵
  PID:10544
- C:\Windows\System\iizqckF.exe
  C:\Windows\System\iizqckF.exe
  2⤵
  PID:10576
- C:\Windows\System\QWtTEGv.exe
  C:\Windows\System\QWtTEGv.exe
  2⤵
  PID:10596
- C:\Windows\System\rLIUQBV.exe
  C:\Windows\System\rLIUQBV.exe
  2⤵
  PID:10616
- C:\Windows\System\lHonmFK.exe
  C:\Windows\System\lHonmFK.exe
  2⤵
  PID:10640
- C:\Windows\System\iaIPXIY.exe
  C:\Windows\System\iaIPXIY.exe
  2⤵
  PID:10668
- C:\Windows\System\PCiyKQf.exe
  C:\Windows\System\PCiyKQf.exe
  2⤵
  PID:10688
- C:\Windows\System\RZzEoge.exe
  C:\Windows\System\RZzEoge.exe
  2⤵
  PID:10712
- C:\Windows\System\SLkHFMs.exe
  C:\Windows\System\SLkHFMs.exe
  2⤵
  PID:10768
- C:\Windows\System\gBDqFBc.exe
  C:\Windows\System\gBDqFBc.exe
  2⤵
  PID:10792
- C:\Windows\System\EoiQSOr.exe
  C:\Windows\System\EoiQSOr.exe
  2⤵
  PID:10816
- C:\Windows\System\eUGUjOr.exe
  C:\Windows\System\eUGUjOr.exe
  2⤵
  PID:10856
- C:\Windows\System\XKxYriA.exe
  C:\Windows\System\XKxYriA.exe
  2⤵
  PID:10872
- C:\Windows\System\IzSYTuM.exe
  C:\Windows\System\IzSYTuM.exe
  2⤵
  PID:10896
- C:\Windows\System\LwypneQ.exe
  C:\Windows\System\LwypneQ.exe
  2⤵
  PID:10936
- C:\Windows\System\mUwomZA.exe
  C:\Windows\System\mUwomZA.exe
  2⤵
  PID:10952
- C:\Windows\System\xGdOJtJ.exe
  C:\Windows\System\xGdOJtJ.exe
  2⤵
  PID:10976
- C:\Windows\System\XgAmpST.exe
  C:\Windows\System\XgAmpST.exe
  2⤵
  PID:11004
- C:\Windows\System\SwKvWje.exe
  C:\Windows\System\SwKvWje.exe
  2⤵
  PID:11048
- C:\Windows\System\BikMGnW.exe
  C:\Windows\System\BikMGnW.exe
  2⤵
  PID:11068
- C:\Windows\System\XkpxjgI.exe
  C:\Windows\System\XkpxjgI.exe
  2⤵
  PID:11112
- C:\Windows\System\GScQcXK.exe
  C:\Windows\System\GScQcXK.exe
  2⤵
  PID:11136
- C:\Windows\System\EfQevnn.exe
  C:\Windows\System\EfQevnn.exe
  2⤵
  PID:11156
- C:\Windows\System\mFDaztk.exe
  C:\Windows\System\mFDaztk.exe
  2⤵
  PID:11176
- C:\Windows\System\BBQAOkv.exe
  C:\Windows\System\BBQAOkv.exe
  2⤵
  PID:11204
- C:\Windows\System\JrNuvhg.exe
  C:\Windows\System\JrNuvhg.exe
  2⤵
  PID:11232
- C:\Windows\System\FBBhpaf.exe
  C:\Windows\System\FBBhpaf.exe
  2⤵
  PID:4708
- C:\Windows\System\adxokSJ.exe
  C:\Windows\System\adxokSJ.exe
  2⤵
  PID:10272
- C:\Windows\System\gPGyOrp.exe
  C:\Windows\System\gPGyOrp.exe
  2⤵
  PID:4156
- C:\Windows\System\vpTyYJk.exe
  C:\Windows\System\vpTyYJk.exe
  2⤵
  PID:10372
- C:\Windows\System\PbxuQXw.exe
  C:\Windows\System\PbxuQXw.exe
  2⤵
  PID:10416
- C:\Windows\System\xQfXYGE.exe
  C:\Windows\System\xQfXYGE.exe
  2⤵
  PID:1376
- C:\Windows\System\aMTWDPo.exe
  C:\Windows\System\aMTWDPo.exe
  2⤵
  PID:1608
- C:\Windows\System\FAQdjuu.exe
  C:\Windows\System\FAQdjuu.exe
  2⤵
  PID:2136
- C:\Windows\System\jRKqalp.exe
  C:\Windows\System\jRKqalp.exe
  2⤵
  PID:10564
- C:\Windows\System\hcjbZFi.exe
  C:\Windows\System\hcjbZFi.exe
  2⤵
  PID:10676
- C:\Windows\System\ePVpRjp.exe
  C:\Windows\System\ePVpRjp.exe
  2⤵
  PID:10704
- C:\Windows\System\cdJQFfm.exe
  C:\Windows\System\cdJQFfm.exe
  2⤵
  PID:10776
- C:\Windows\System\LPpOfCt.exe
  C:\Windows\System\LPpOfCt.exe
  2⤵
  PID:10832
- C:\Windows\System\ILapvGk.exe
  C:\Windows\System\ILapvGk.exe
  2⤵
  PID:10884
- C:\Windows\System\lyOxqCV.exe
  C:\Windows\System\lyOxqCV.exe
  2⤵
  PID:10960
- C:\Windows\System\ddyHNyJ.exe
  C:\Windows\System\ddyHNyJ.exe
  2⤵
  PID:10988
- C:\Windows\System\VmQBfJg.exe
  C:\Windows\System\VmQBfJg.exe
  2⤵
  PID:11104
- C:\Windows\System\wJPjKFo.exe
  C:\Windows\System\wJPjKFo.exe
  2⤵
  PID:11184
- C:\Windows\System\FjLmyct.exe
  C:\Windows\System\FjLmyct.exe
  2⤵
  PID:11216
- C:\Windows\System\ntSTFAM.exe
  C:\Windows\System\ntSTFAM.exe
  2⤵
  PID:10308
- C:\Windows\System\QbxpQBS.exe
  C:\Windows\System\QbxpQBS.exe
  2⤵
  PID:1104
- C:\Windows\System\NlBQYbc.exe
  C:\Windows\System\NlBQYbc.exe
  2⤵
  PID:10384
- C:\Windows\System\wXnfqyR.exe
  C:\Windows\System\wXnfqyR.exe
  2⤵
  PID:5068
- C:\Windows\System\CntaCJD.exe
  C:\Windows\System\CntaCJD.exe
  2⤵
  PID:10528
- C:\Windows\System\TBhNQsW.exe
  C:\Windows\System\TBhNQsW.exe
  2⤵
  PID:4372
- C:\Windows\System\FAxSHMZ.exe
  C:\Windows\System\FAxSHMZ.exe
  2⤵
  PID:10808
- C:\Windows\System\vPHyucd.exe
  C:\Windows\System\vPHyucd.exe
  2⤵
  PID:10948
- C:\Windows\System\PCBMQPN.exe
  C:\Windows\System\PCBMQPN.exe
  2⤵
  PID:11092
- C:\Windows\System\gchsmjA.exe
  C:\Windows\System\gchsmjA.exe
  2⤵
  PID:11212
- C:\Windows\System\uWBSBzS.exe
  C:\Windows\System\uWBSBzS.exe
  2⤵
  PID:3024
- C:\Windows\System\RgqAhPF.exe
  C:\Windows\System\RgqAhPF.exe
  2⤵
  PID:10592
- C:\Windows\System\myzyabV.exe
  C:\Windows\System\myzyabV.exe
  2⤵
  PID:10632
- C:\Windows\System\cDdkiiT.exe
  C:\Windows\System\cDdkiiT.exe
  2⤵
  PID:10252
- C:\Windows\System\NYoMaqj.exe
  C:\Windows\System\NYoMaqj.exe
  2⤵
  PID:3932
- C:\Windows\System\swhONbf.exe
  C:\Windows\System\swhONbf.exe
  2⤵
  PID:10324
- C:\Windows\System\kQyqqyv.exe
  C:\Windows\System\kQyqqyv.exe
  2⤵
  PID:11272
- C:\Windows\System\vLOHWYY.exe
  C:\Windows\System\vLOHWYY.exe
  2⤵
  PID:11296
- C:\Windows\System\dHJKOcM.exe
  C:\Windows\System\dHJKOcM.exe
  2⤵
  PID:11324
- C:\Windows\System\GBsZpVK.exe
  C:\Windows\System\GBsZpVK.exe
  2⤵
  PID:11356
- C:\Windows\System\YJgSPnG.exe
  C:\Windows\System\YJgSPnG.exe
  2⤵
  PID:11376
- C:\Windows\System\rEdqdWd.exe
  C:\Windows\System\rEdqdWd.exe
  2⤵
  PID:11400
- C:\Windows\System\dehwVLO.exe
  C:\Windows\System\dehwVLO.exe
  2⤵
  PID:11420
- C:\Windows\System\cArBomX.exe
  C:\Windows\System\cArBomX.exe
  2⤵
  PID:11448
- C:\Windows\System\ZnYApvq.exe
  C:\Windows\System\ZnYApvq.exe
  2⤵
  PID:11472
- C:\Windows\System\vdeJwEd.exe
  C:\Windows\System\vdeJwEd.exe
  2⤵
  PID:11540
- C:\Windows\System\jjaXXTk.exe
  C:\Windows\System\jjaXXTk.exe
  2⤵
  PID:11564
- C:\Windows\System\AsEmbBD.exe
  C:\Windows\System\AsEmbBD.exe
  2⤵
  PID:11592
- C:\Windows\System\AbvQkJP.exe
  C:\Windows\System\AbvQkJP.exe
  2⤵
  PID:11612
- C:\Windows\System\wChnuoQ.exe
  C:\Windows\System\wChnuoQ.exe
  2⤵
  PID:11652
- C:\Windows\System\DFtmmLq.exe
  C:\Windows\System\DFtmmLq.exe
  2⤵
  PID:11676
- C:\Windows\System\uYypYlH.exe
  C:\Windows\System\uYypYlH.exe
  2⤵
  PID:11704
- C:\Windows\System\jfpfMRS.exe
  C:\Windows\System\jfpfMRS.exe
  2⤵
  PID:11732
- C:\Windows\System\EdTNgSE.exe
  C:\Windows\System\EdTNgSE.exe
  2⤵
  PID:11752
- C:\Windows\System\WRuoVAw.exe
  C:\Windows\System\WRuoVAw.exe
  2⤵
  PID:11792
- C:\Windows\System\xKtKqHM.exe
  C:\Windows\System\xKtKqHM.exe
  2⤵
  PID:11816
- C:\Windows\System\feNZmyI.exe
  C:\Windows\System\feNZmyI.exe
  2⤵
  PID:11840
- C:\Windows\System\kIlTijo.exe
  C:\Windows\System\kIlTijo.exe
  2⤵
  PID:11884
- C:\Windows\System\DxuIMWA.exe
  C:\Windows\System\DxuIMWA.exe
  2⤵
  PID:11904
- C:\Windows\System\lylARKW.exe
  C:\Windows\System\lylARKW.exe
  2⤵
  PID:11920
- C:\Windows\System\afiZTIP.exe
  C:\Windows\System\afiZTIP.exe
  2⤵
  PID:11948
- C:\Windows\System\mZXWDVN.exe
  C:\Windows\System\mZXWDVN.exe
  2⤵
  PID:11976
- C:\Windows\System\zjylBrb.exe
  C:\Windows\System\zjylBrb.exe
  2⤵
  PID:12012
- C:\Windows\System\Wfjxzli.exe
  C:\Windows\System\Wfjxzli.exe
  2⤵
  PID:12040
- C:\Windows\System\nyBotIk.exe
  C:\Windows\System\nyBotIk.exe
  2⤵
  PID:12060
- C:\Windows\System\zugLQpF.exe
  C:\Windows\System\zugLQpF.exe
  2⤵
  PID:12100
- C:\Windows\System\rEJeCVo.exe
  C:\Windows\System\rEJeCVo.exe
  2⤵
  PID:12124
- C:\Windows\System\mtvMmFV.exe
  C:\Windows\System\mtvMmFV.exe
  2⤵
  PID:12152
- C:\Windows\System\cqBUnQO.exe
  C:\Windows\System\cqBUnQO.exe
  2⤵
  PID:12172
- C:\Windows\System\fsXaxSc.exe
  C:\Windows\System\fsXaxSc.exe
  2⤵
  PID:12204
- C:\Windows\System\edsrxCX.exe
  C:\Windows\System\edsrxCX.exe
  2⤵
  PID:12236
- C:\Windows\System\jxSrDlS.exe
  C:\Windows\System\jxSrDlS.exe
  2⤵
  PID:12256
- C:\Windows\System\kbuJACw.exe
  C:\Windows\System\kbuJACw.exe
  2⤵
  PID:12280
- C:\Windows\System\gQTCCfI.exe
  C:\Windows\System\gQTCCfI.exe
  2⤵
  PID:10844
- C:\Windows\System\BUxyhVt.exe
  C:\Windows\System\BUxyhVt.exe
  2⤵
  PID:11340
- C:\Windows\System\yTHoheb.exe
  C:\Windows\System\yTHoheb.exe
  2⤵
  PID:11440
- C:\Windows\System\XBYfhiw.exe
  C:\Windows\System\XBYfhiw.exe
  2⤵
  PID:11496
- C:\Windows\System\oKAzPAs.exe
  C:\Windows\System\oKAzPAs.exe
  2⤵
  PID:11576
- C:\Windows\System\OEPqTUZ.exe
  C:\Windows\System\OEPqTUZ.exe
  2⤵
  PID:11600
- C:\Windows\System\SoXqYBS.exe
  C:\Windows\System\SoXqYBS.exe
  2⤵
  PID:11684
- C:\Windows\System\EFLvQZD.exe
  C:\Windows\System\EFLvQZD.exe
  2⤵
  PID:11748
- C:\Windows\System\oztgfuo.exe
  C:\Windows\System\oztgfuo.exe
  2⤵
  PID:11824
- C:\Windows\System\OtJFWXP.exe
  C:\Windows\System\OtJFWXP.exe
  2⤵
  PID:11876
- C:\Windows\System\cCNGvaO.exe
  C:\Windows\System\cCNGvaO.exe
  2⤵
  PID:11932
- C:\Windows\System\ERigtlX.exe
  C:\Windows\System\ERigtlX.exe
  2⤵
  PID:12000
- C:\Windows\System\wzEMJBJ.exe
  C:\Windows\System\wzEMJBJ.exe
  2⤵
  PID:12052
- C:\Windows\System\mqCYxsd.exe
  C:\Windows\System\mqCYxsd.exe
  2⤵
  PID:12116
- C:\Windows\System\kHqypMw.exe
  C:\Windows\System\kHqypMw.exe
  2⤵
  PID:12168
- C:\Windows\System\OxhJpLU.exe
  C:\Windows\System\OxhJpLU.exe
  2⤵
  PID:11268
- C:\Windows\System\TZmgwqO.exe
  C:\Windows\System\TZmgwqO.exe
  2⤵
  PID:11740
- C:\Windows\System\FggEoyV.exe
  C:\Windows\System\FggEoyV.exe
  2⤵
  PID:11916
- C:\Windows\System\yNvvPOE.exe
  C:\Windows\System\yNvvPOE.exe
  2⤵
  PID:12032
- C:\Windows\System\fKPYxVi.exe
  C:\Windows\System\fKPYxVi.exe
  2⤵
  PID:12092
- C:\Windows\System\XmQbAWn.exe
  C:\Windows\System\XmQbAWn.exe
  2⤵
  PID:12164
- C:\Windows\System\SHWTLcv.exe
  C:\Windows\System\SHWTLcv.exe
  2⤵
  PID:11492
- C:\Windows\System\QPDnlmC.exe
  C:\Windows\System\QPDnlmC.exe
  2⤵
  PID:11292
- C:\Windows\System\cOQaMAc.exe
  C:\Windows\System\cOQaMAc.exe
  2⤵
  PID:11428
- C:\Windows\System\aTrCeFB.exe
  C:\Windows\System\aTrCeFB.exe
  2⤵
  PID:1244
- C:\Windows\System\qiOhywy.exe
  C:\Windows\System\qiOhywy.exe
  2⤵
  PID:12048
- C:\Windows\System\xEXSyNZ.exe
  C:\Windows\System\xEXSyNZ.exe
  2⤵
  PID:11960
- C:\Windows\System\YnlcQLe.exe
  C:\Windows\System\YnlcQLe.exe
  2⤵
  PID:12020
- C:\Windows\System\WDkizer.exe
  C:\Windows\System\WDkizer.exe
  2⤵
  PID:12296
- C:\Windows\System\UIpZBGh.exe
  C:\Windows\System\UIpZBGh.exe
  2⤵
  PID:12360
- C:\Windows\System\cRtpeSY.exe
  C:\Windows\System\cRtpeSY.exe
  2⤵
  PID:12384
- C:\Windows\System\MslnHZI.exe
  C:\Windows\System\MslnHZI.exe
  2⤵
  PID:12408
- C:\Windows\System\bMnMtGP.exe
  C:\Windows\System\bMnMtGP.exe
  2⤵
  PID:12428
- C:\Windows\System\vToAwJC.exe
  C:\Windows\System\vToAwJC.exe
  2⤵
  PID:12456
- C:\Windows\System\kVahnui.exe
  C:\Windows\System\kVahnui.exe
  2⤵
  PID:12484
- C:\Windows\System\YiyPlqY.exe
  C:\Windows\System\YiyPlqY.exe
  2⤵
  PID:12512
- C:\Windows\System\uBNqXEO.exe
  C:\Windows\System\uBNqXEO.exe
  2⤵
  PID:12536
- C:\Windows\System\INVSbon.exe
  C:\Windows\System\INVSbon.exe
  2⤵
  PID:12556
- C:\Windows\System\DXSFoCa.exe
  C:\Windows\System\DXSFoCa.exe
  2⤵
  PID:12600
- C:\Windows\System\CmGGzbz.exe
  C:\Windows\System\CmGGzbz.exe
  2⤵
  PID:12636
- C:\Windows\System\rataXdI.exe
  C:\Windows\System\rataXdI.exe
  2⤵
  PID:12660
- C:\Windows\System\FIiULIx.exe
  C:\Windows\System\FIiULIx.exe
  2⤵
  PID:12684
- C:\Windows\System\QWGwifj.exe
  C:\Windows\System\QWGwifj.exe
  2⤵
  PID:12728
- C:\Windows\System\vVeOzAj.exe
  C:\Windows\System\vVeOzAj.exe
  2⤵
  PID:12752
- C:\Windows\System\DTYydhe.exe
  C:\Windows\System\DTYydhe.exe
  2⤵
  PID:12772
- C:\Windows\System\gHjxpiq.exe
  C:\Windows\System\gHjxpiq.exe
  2⤵
  PID:12792
- C:\Windows\System\FdKBXxj.exe
  C:\Windows\System\FdKBXxj.exe
  2⤵
  PID:12820
- C:\Windows\System\ZoFikpV.exe
  C:\Windows\System\ZoFikpV.exe
  2⤵
  PID:12856
- C:\Windows\System\CpubhHR.exe
  C:\Windows\System\CpubhHR.exe
  2⤵
  PID:12876
- C:\Windows\System\WJXjQvf.exe
  C:\Windows\System\WJXjQvf.exe
  2⤵
  PID:12900
- C:\Windows\System\GElZAhu.exe
  C:\Windows\System\GElZAhu.exe
  2⤵
  PID:12928
- C:\Windows\System\CrWlVaQ.exe
  C:\Windows\System\CrWlVaQ.exe
  2⤵
  PID:12948
- C:\Windows\System\uEJKQGN.exe
  C:\Windows\System\uEJKQGN.exe
  2⤵
  PID:13000
- C:\Windows\System\qKlBcGG.exe
  C:\Windows\System\qKlBcGG.exe
  2⤵
  PID:13028
- C:\Windows\System\zAUeGql.exe
  C:\Windows\System\zAUeGql.exe
  2⤵
  PID:13044
- C:\Windows\System\swwCcMx.exe
  C:\Windows\System\swwCcMx.exe
  2⤵
  PID:13064
- C:\Windows\System\WRswZLO.exe
  C:\Windows\System\WRswZLO.exe
  2⤵
  PID:13124
- C:\Windows\System\kaySPrA.exe
  C:\Windows\System\kaySPrA.exe
  2⤵
  PID:13148
- C:\Windows\System\KDPPjdG.exe
  C:\Windows\System\KDPPjdG.exe
  2⤵
  PID:13168
- C:\Windows\System\CyZYlvD.exe
  C:\Windows\System\CyZYlvD.exe
  2⤵
  PID:13188
- C:\Windows\System\hCLYZHH.exe
  C:\Windows\System\hCLYZHH.exe
  2⤵
  PID:13216
- C:\Windows\System\SxgTTaN.exe
  C:\Windows\System\SxgTTaN.exe
  2⤵
  PID:13240
- C:\Windows\System\EUyfhWo.exe
  C:\Windows\System\EUyfhWo.exe
  2⤵
  PID:13280
- C:\Windows\System\SSbLCMX.exe
  C:\Windows\System\SSbLCMX.exe
  2⤵
  PID:13308
- C:\Windows\System\qFWGlBo.exe
  C:\Windows\System\qFWGlBo.exe
  2⤵
  PID:4648
- C:\Windows\System\qCRbwJj.exe
  C:\Windows\System\qCRbwJj.exe
  2⤵
  PID:12352
- C:\Windows\System\YAKUOWf.exe
  C:\Windows\System\YAKUOWf.exe
  2⤵
  PID:12424
- C:\Windows\System\WndGqla.exe
  C:\Windows\System\WndGqla.exe
  2⤵
  PID:12524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pgkewmg5.pfb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CLTWIXI.exe

Filesize
2.1MB

MD5
ba66a25fc06fa7dc7f76f01a01f3747b

SHA1
f686b0bd0b2b7f71084d7b785de2523599775ad6

SHA256
6ce7c6caab36ee519dc6f6a1f6e406eeb3898904abcd957bf7f3db261458854b

SHA512
fa043eb678eb77df5cbdd96a8e74c9467daf5644caceba2bce8c8241974b2464648d87e385abf7bf8207a2a3e7d1501c5cfce3e322c6cab16525fa1f37fbd51e

Download Submit
C:\Windows\System\DmSsFqc.exe

Filesize
2.1MB

MD5
34d00555ee62fe8871c136ddec2779e0

SHA1
40ec472b71d59c3c924bf9c8c738a28a2540f513

SHA256
aa057e268db18754bd870dee5334763818560f9f10a81faddff13725f2af8e9e

SHA512
a474fecef6e509eec4cf89fabd300fad10a6b9f57f47988870a5595a8963585b1c0619a4ebf59ad994767ff1fe1ebdc757544903e096e66de4ba51cf59210fd1

Download Submit
C:\Windows\System\GHPnVJt.exe

Filesize
2.1MB

MD5
9d6311cc983b003b53eb422924fe9495

SHA1
6d3647f98cf9b51356972f174d416ee9b9e84f6d

SHA256
fe4f727f6e6ccd60738b2c36ac45cd98f277b742d8714dc409f979558b978019

SHA512
c8c2084c6af146e8042528c523d0cbdea915d0997d1c1cec03cfcf149718479a27a412ec65811a4d6da8819b704e3f0ee7b4cb60598a4386e1e3f87bedc87faf

Download Submit
C:\Windows\System\IrJvagS.exe

Filesize
2.1MB

MD5
ac1fc981c0ce8cc060377997acaadc4c

SHA1
f3b6f75d3df4b491163c94f8ce1d326321f14f5a

SHA256
df92a8352aa1e9eee87dc19123c7469b74bd3de7bfb6941551d47f6a18e5a6fb

SHA512
e790c5697bac4c614932b49b52b97fecf3b3058a1498ada0a37ebc1ad6729daf3f5a0792039e858332f43d68c29e358474794b2518ef1aac7c9b24f27f87c777

Download Submit
C:\Windows\System\IwhUsIK.exe

Filesize
2.1MB

MD5
fcacbc90ba510b6cdb08d6e1b1f148e9

SHA1
b92b68f081685b0e90b2fb32d68f1a03bb9b63c1

SHA256
bd3c9a8b3e00d89c8c3f20a034aca7fe8359c9333b73a48c359799db0da40ca7

SHA512
55f97d427cf7c6f3b5caded50d37d9c49932b6387168fc3740ede594ee4984ae0d0fd86f42c9d514cfab279a5fcac7e1d4e9ae441b11d3a1645e53a37716065a

Download Submit
C:\Windows\System\JZKdQzV.exe

Filesize
2.1MB

MD5
9b7b972d93045945cfe2ccd8ee99b055

SHA1
d8bde577cef4ac19925352476ea3953b505922a5

SHA256
cd92a0fa541ce97538a80b68f67b2452dd42c0a377a0b6d12643ea7ea9716e46

SHA512
0dece9897bfc92d29a9fa1d559e22e46b9b85d33c7df2e05b84cc51932e35888a8afba01e1b20084123926973b9b9895c8f6bc6706e0aefbe368d1f1ac4afda6

Download Submit
C:\Windows\System\KThFzSg.exe

Filesize
2.1MB

MD5
d8b163b09b663a2130b4ecff85f113a2

SHA1
2bd7bf6d5c54581e8cf9d1efb01fff44c6d2298c

SHA256
544839dff6abb324ef928a681d1c2d3aaf1801df97d2e7543a381dd3c577205a

SHA512
752ede4f17a51e7c842e63b9899ef5eb6c6b0608be008a7e0a4b2ff5da3686997ba738bf9718de95f745baca64ab1d79826468ade9c45c0047e6a5158c04d6ee

Download Submit
C:\Windows\System\QKkmZFZ.exe

Filesize
2.1MB

MD5
ff314ab3791f8474ba0d60946241eb11

SHA1
bbfb525135809dbd9ab0a32d82f3186e5d0cb937

SHA256
a140c054e151216f5b4912956c3b3c1ebc8158b27b2471142c86d6cd7ed94993

SHA512
010897614b6a9afb3022e3aa0356d495a720004df23e6485cf8bea766e41f474d72cb76911ac3e67c95299b9ca316e476dff99d40f3c172fb56a333e4c80601d

Download Submit
C:\Windows\System\QdXUGzt.exe

Filesize
2.1MB

MD5
391dccac75202f7464ede1ef74032d2e

SHA1
812bf126b623574bad56fe5196112bdcaf2239ad

SHA256
0d53504f77b7c2a6b0bcd4c8d4dd0e3a345420adad061bb1580faeeeb667d596

SHA512
95d872683764e7a1617d5be49147e7b2f3032e84dfbb2a91ad383c34e0d2511b538d794bea9414dd12f9e6b2318bee51a9723c59c4c3d95574a427d28f54f953

Download Submit
C:\Windows\System\RLpJKtu.exe

Filesize
2.1MB

MD5
50e1fee879d77a12cf798e68a8ec9909

SHA1
5306e863ee2af90760d7cd51225d61ee4a7daa48

SHA256
1d30a7a4fb53f491db7bcf0d71f24a684c0bcc836a2eb76681cf0a89789e3d12

SHA512
99c928f5af57a5287e244f9aa66404c4d238f30423fea7034745b2999417a8d2c1fa32e5c7f451ddf142279c3934e0437ff3c9e70791a9d427a5f9c244623579

Download Submit
C:\Windows\System\RVEzDnY.exe

Filesize
2.1MB

MD5
2bd32ba9e0d8c6e607765b45bfdda972

SHA1
91c46c1e6ca7bc1773a3ad2ed229d11f26d6a17c

SHA256
c245ab35d0f6ef9dd5d5009ba78bcbb8399b3250f266e51a78d8a18f13f3d43e

SHA512
8e912a421b4138374e18589a8329395d170010f3d0663959ff6426167e4e0c5cc98122b091bc0051e1de7d1c6f87f1f2b55819386ab57cbcf27835c1d8d0984b

Download Submit
C:\Windows\System\RgMIXnn.exe

Filesize
2.1MB

MD5
17155e7fc61574782349cac603be97f4

SHA1
3118779f77803ad44dfdc25c83e3ca71994b4cf1

SHA256
5eb4b48ff5296038cc3d9966445bd8dde1b36fc85052c46d7959c56b109ff5e7

SHA512
d3d7463b2bc807b0d98fbd020a885a246aa1e095a9e8876b17288ee380ee48f329a488dc719833f5b48b4de7bd59a263531552cc2e173df6f64d69b4b7a44c67

Download Submit
C:\Windows\System\SgsRMCE.exe

Filesize
2.1MB

MD5
476a31abbb70fd7830d71f3dc1aaebf9

SHA1
6715c36bab4854d33ef9fec24c0617390fc98ac0

SHA256
0ea1a0f2a0a3266c9385e4cd4d3ae11012ef86058e7a3b26d5ac2bb5da772c9c

SHA512
b5b9b373abc430813a394e9fe536ae1ea2ae675e61941722ba34b3bb48e4bd170afbdcbbd6512374ae24162e852899893aba67bfa03c4603e9a402d7377c0992

Download Submit
C:\Windows\System\UXaLNAv.exe

Filesize
2.1MB

MD5
c06682146a9d5d27bd77fddf8f9ff494

SHA1
6072a6d98cea1d085a0de433e8825b046286fbdf

SHA256
6426da141eb73d8ed7cbab55ce1c4f0a5ea798757e8963b84a5a221d20630177

SHA512
9c48d93b6567b5d12c65a8ad96b756c08e2e819f3559eb6615c580b5e45e07c9ae3f766ef9dc9735e2eef8ef0d6cdb8c7880623b08f6ff1e4a1c14c8ddd94cef

Download Submit
C:\Windows\System\VIcmlJW.exe

Filesize
2.1MB

MD5
7655b56950605337b42667a7257ef79b

SHA1
d0fec5c6a28aaa7d97afb0497d2870eab88149c1

SHA256
cb039a2c404394c910ece857d9899e8555017aaa671df3c3f18646aa69af97a7

SHA512
dbdc3ea4eb0529907e04d51625a839cd86bff9532440bc79b3f846f183c983c8f8c663c41fff35f0f98937ca486aee37d669836cd18118a576560d5a3a3996ef

Download Submit
C:\Windows\System\WeKagkf.exe

Filesize
2.1MB

MD5
cdfe45b0f3b291248df0f595e58ab44f

SHA1
1b4c0ed381be8fed0c30f7aa36147b5d10e33514

SHA256
ebb429b65d7b28801ec6b83e05225447db408a6afc3b868a5847f294853fa284

SHA512
a36758d88d7e4622a88535741883dabdf4ec25bf2dfea146df92e94b8f71222d96499a300cb8f68db9ddc01f892d6f7bd7a85710ee9059dc7fd755b1cd68d37e

Download Submit
C:\Windows\System\WoNlhbP.exe

Filesize
2.1MB

MD5
1602cf87e30153d102c133b25c76b9fc

SHA1
3a4ebb8f36a52110bd284265f5d3df8ca7282ac1

SHA256
62d4a02d84ee81ea852353b31bbb55acebed165ed387e0f8bede2c53be74689e

SHA512
43d34c79162b07a7ffccc95982d83272a0519a8cec008b3346a88019355de9095c1444c6d6e372c76b51ec3a1e3fa8e9e79e67052496b6f233691ed9d3a47726

Download Submit
C:\Windows\System\XEaHopW.exe

Filesize
2.1MB

MD5
859b9d45d64d15398b55f1ea08778b4d

SHA1
a8d25d859702aa34e924a9d3ec69be31695637d5

SHA256
e44ffa0c4e87f0ef01b828cac835ff89aac5179d556e611cee40d81d4be6e201

SHA512
cd1f5c7040ba40d5309865c297a244685d788a3212c4c2531b456c2f83d01d32c93dae20583bf133415b433c4be85ab85305c6823195a80be35e54d9ff7303ba

Download Submit
C:\Windows\System\XfkwRTm.exe

Filesize
2.1MB

MD5
3b84c425a552d47a154c41de939acd41

SHA1
b59b66cfa5ca81c82425f8d672c1a6afa57d1c2a

SHA256
b9c45f690f811e6416a6716a81b166cf1584a5e5c087f37b3fe27d8cfa1c5f0b

SHA512
b91992814eaba5feae4dff4eb38b8ddf6f61434cf233edbff6648b23374dd3af7e831e94c181dab59bd6a222c2b778777ac337b10d08600d0ac25c95dfa9ed42

Download Submit
C:\Windows\System\YkrFIQd.exe

Filesize
2.1MB

MD5
b2da485b2c8684b9bfa7d1592efec0e6

SHA1
ee9a7d9ae7980e16c7c4a9a081f4d910899527de

SHA256
21439565816bd35e530e860ed933d1e1208165fd99c2a6b15f740ca3b8fcf1ea

SHA512
86fe612055fb7e7744c981f48790773b166febea694a4bfe743b430ceef269a2801a775ece90db326754407bdbfbcbb06ed1783dc0b3a066c17ba2e95f4c6180

Download Submit
C:\Windows\System\bPABivm.exe

Filesize
2.1MB

MD5
d074a5d7ed7551cbb2b8c63258fcffa8

SHA1
16e07033ce3fdda341e7d64a486ac269a9233287

SHA256
ad0eda657601fb75dbfa359bb417762feb9c93c2c8b4ad03b256c741c6bb1313

SHA512
7956b949939c2e9d01a35ec3d4b54510b806c3fcb8a6cf5b3f50c09690037c982ba7bd1e53761745c1f6f7235345ea8d0b7d74626e7ac79aaa4cb93b3f930e63

Download Submit
C:\Windows\System\cpDWUpu.exe

Filesize
2.1MB

MD5
28f81e88cdff831009b98d5e48ebe4a3

SHA1
f3f8ed793d71043df4824e89c6f2022cd27d937c

SHA256
26fa3b763def17d5d92825888529ca3bf954ad26f4d7a7c7d1167d742cf33440

SHA512
9d550a8dc1802207df7d5429c13c662905b432deb34924e1e368f02be5e4bf6647ee480e0938039f300a255a9362746b9fca057594af0da9b88e4c9472261cad

Download Submit
C:\Windows\System\eFteprv.exe

Filesize
2.1MB

MD5
4d84f1724832edd63ec1068568e4b9e1

SHA1
23506220b2d836d3701a8cf85117a9ca37eeac86

SHA256
3e78e4a6236df5bad111c52b1ec863b0cf3ad6dd845b197c7d4cc8f9e1540752

SHA512
541ed98a4abbf4a15ffd6b44060775520170e116803ecfdfbcbd8e4cb40bef789eea31a7344e434bafa75266d0e2e2dbf22c34f476842cd4b36c6e10a862f812

Download Submit
C:\Windows\System\eKWqqmp.exe

Filesize
2.1MB

MD5
65dffaf484cac2745bf852c34571ea78

SHA1
c7102a68e174b5058fc19eacc8b40368b48419f4

SHA256
abf9117907845eea682288a00a3ff2b5412294ffae574fcfa62277832c561ddf

SHA512
29b2c567674454052179316f5c72b8a70866db6eeead276582e16d8c4ca5ba05a1835801e0c0a9fc7c6683edca2c9e51aec833318eb4d92a17d4fe4dea4f51e0

Download Submit
C:\Windows\System\fTpbMXa.exe

Filesize
2.1MB

MD5
4e3f74593bba0344ba4407fed8360b0c

SHA1
b197eb9f7f40406ce5685f48260f7258a6cfb0a7

SHA256
1a57fe44a2fa2419dad44c0c9daa92aab2d307f803f18a4ece18e83c6063a2f9

SHA512
d99cb33b6141b39dd021e7d1b8c3af937f9a5579fea6da0d2935bc112b89e29067e413d115f16f63592b8be58f4da8ff5ae70584bbcb4fdc7af8c2b08a923ed4

Download Submit
C:\Windows\System\gGoejjq.exe

Filesize
2.1MB

MD5
b67c5a65e82ceb7be1194436f6f29aa7

SHA1
18f65623825dc8c1f86497d40bdb3f63120a722b

SHA256
a7e2d57b0c0b48eeef64b464906a0d6eaf07c5c99e01ee80a5383dae44b3f1a0

SHA512
0b0caa3d16dec1a0b771c4184238dea7655f1381e3b2c383c24454f0736700548d5869e57fd8319a6e1afbf25306dd66988f9e8a4ce550f8fb18611b49449040

Download Submit
C:\Windows\System\gaBFwcu.exe

Filesize
2.1MB

MD5
ee05ef88c3aff0dfc36cdeb82c067a51

SHA1
de66bd21813fd2be990da1b6ce21fa7e12d7bc59

SHA256
35df03d2ba94c6b7dcbddd1bbede096e8d3b9666a97c09570f69bc4f902a55b1

SHA512
cc1a56b3eee2d642993a9bd64464cc68434b03bf74a003d9f019509379f09b651fdd157562d39fe6cc952dac2f2463820b48c93eaf7e709e0b33483475bfc07f

Download Submit
C:\Windows\System\gzvyAgk.exe

Filesize
2.1MB

MD5
2ef1453831e443b5900133e225b0e391

SHA1
e9406c5817157cb929a4b38555dd03fd526be8d8

SHA256
ec1b7f5455ff622fda369d0d8f49e38293624bf635f5b7d7716eadafe65146cb

SHA512
34e7500292034767ee65fb9087f94f1b893e19e51f6da45d3deeab311ecbfd6c4f44f7f47778c1f7b9390c2d8b1993e47ef0706098e430c4d4c8112199b3ccae

Download Submit
C:\Windows\System\jSAVcNe.exe

Filesize
2.1MB

MD5
f8abb4f75371751fc81aec3044f862e2

SHA1
633bf3538477f269a3d739c57e5932b2e248a7a4

SHA256
4a237375ad349d93fffa2e4d32e2e0656714aa0dde7113359a5680bc2c762714

SHA512
8e462578c6e6cb7fdd2824cd02dd65fd758b62b515c8194d34fd1add1002c06e1a437acceed862547632939de92305b3602b7221c5cee2e33a2f94a8483a609e

Download Submit
C:\Windows\System\qrWgOYy.exe

Filesize
2.1MB

MD5
d030bc72dffadfd644f40b0528d63fb7

SHA1
980a96669d24523a7d08ce085be2b48935140008

SHA256
8ded6694f4bc84fc0c21a2923db00e80eb418af51bb0b2009cb2c218f7db5de3

SHA512
fc8bd12bd05ca37e37e93369509591dca7c6de8c7e3d61073c6718efdf88ea422da1b80a54820efdf6f2c21f97bb72acb3f48f9887f6b74ec56b73b028405205

Download Submit
C:\Windows\System\qvmdVCT.exe

Filesize
2.1MB

MD5
214764fddbc9ccb012f5a2faba1f8135

SHA1
9385292c1c68a6ef896d54d165d6456ff0463c36

SHA256
20d982e12d5f35fed8e3261d3c0ca1700e4d2ed2f84ed8fa94e0742ef7630d28

SHA512
c3960fb0ef8fa19f70ad263474f2e782e2829f602af04ea09c2860d1a3db21a921a421175553f4c0cb265a3700e93bf79abfee80407be3cd2ff6dfa01274c3ae

Download Submit
C:\Windows\System\rMSYgYa.exe

Filesize
2.1MB

MD5
deff060342e87b05f4cb311a7b2f512a

SHA1
1df55315c96674fbb5bf97982d75f72beb3bc23f

SHA256
8bb516fe0cca0efdf4002c097a316401d536e1a7db6e8b6bef597bb640cf1d3c

SHA512
061ed86d494fda90793aba0a2aad36c11589efac32bb7c9ddb441f262d994ba2e82521624fc66623585c5472322c397879212a849399d95ecb69a0bbd3debc18

Download Submit
C:\Windows\System\tHitlWN.exe

Filesize
2.1MB

MD5
ccbcbc816f6b7dbc8ccbf8f80df164be

SHA1
5ffdbd2fa2b11a21a4e040d8b34f76e876cca6e1

SHA256
acb91d07e206c32da1b0796208634f0dd1943c9f4c6f754e34995d09b589b7ea

SHA512
937da0530fd691a6429de8ff63f67688bc577dd133bff567177d94b9c6dfdf76820d1aae67baa0f85f00f653fdbcdbe5085bfb037f9440c02b5b353f2c860705

Download Submit
memory/8-2082-0x00007FF783D30000-0x00007FF784122000-memory.dmp

Filesize
3.9MB

Download
memory/8-2009-0x00007FF783D30000-0x00007FF784122000-memory.dmp

Filesize
3.9MB

Download
memory/8-123-0x00007FF783D30000-0x00007FF784122000-memory.dmp

Filesize
3.9MB

Download
memory/448-2076-0x00007FF6090D0000-0x00007FF6094C2000-memory.dmp

Filesize
3.9MB

Download
memory/448-1815-0x00007FF6090D0000-0x00007FF6094C2000-memory.dmp

Filesize
3.9MB

Download
memory/448-97-0x00007FF6090D0000-0x00007FF6094C2000-memory.dmp

Filesize
3.9MB

Download
memory/892-2070-0x00007FF711560000-0x00007FF711952000-memory.dmp

Filesize
3.9MB

Download
memory/892-120-0x00007FF711560000-0x00007FF711952000-memory.dmp

Filesize
3.9MB

Download
memory/984-2060-0x00007FF7760E0000-0x00007FF7764D2000-memory.dmp

Filesize
3.9MB

Download
memory/984-118-0x00007FF7760E0000-0x00007FF7764D2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-163-0x00007FF7A45F0000-0x00007FF7A49E2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-2143-0x00007FF7A45F0000-0x00007FF7A49E2000-memory.dmp

Filesize
3.9MB

Download
memory/1312-2057-0x00007FF621540000-0x00007FF621932000-memory.dmp

Filesize
3.9MB

Download
memory/1312-65-0x00007FF621540000-0x00007FF621932000-memory.dmp

Filesize
3.9MB

Download
memory/1680-80-0x00007FF7D1FF0000-0x00007FF7D23E2000-memory.dmp

Filesize
3.9MB

Download
memory/1680-2062-0x00007FF7D1FF0000-0x00007FF7D23E2000-memory.dmp

Filesize
3.9MB

Download
memory/1684-48-0x00007FF62B7D0000-0x00007FF62BBC2000-memory.dmp

Filesize
3.9MB

Download
memory/1684-2055-0x00007FF62B7D0000-0x00007FF62BBC2000-memory.dmp

Filesize
3.9MB

Download
memory/1764-2072-0x00007FF633DF0000-0x00007FF6341E2000-memory.dmp

Filesize
3.9MB

Download
memory/1764-95-0x00007FF633DF0000-0x00007FF6341E2000-memory.dmp

Filesize
3.9MB

Download
memory/1764-1807-0x00007FF633DF0000-0x00007FF6341E2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-46-0x00007FF725820000-0x00007FF725C12000-memory.dmp

Filesize
3.9MB

Download
memory/1992-2050-0x00007FF725820000-0x00007FF725C12000-memory.dmp

Filesize
3.9MB

Download
memory/2024-1794-0x00007FF648730000-0x00007FF648B22000-memory.dmp

Filesize
3.9MB

Download
memory/2024-11-0x00007FF648730000-0x00007FF648B22000-memory.dmp

Filesize
3.9MB

Download
memory/2024-2048-0x00007FF648730000-0x00007FF648B22000-memory.dmp

Filesize
3.9MB

Download
memory/2036-2074-0x00007FF685650000-0x00007FF685A42000-memory.dmp

Filesize
3.9MB

Download
memory/2036-121-0x00007FF685650000-0x00007FF685A42000-memory.dmp

Filesize
3.9MB

Download
memory/2276-90-0x00007FF65E5C0000-0x00007FF65E9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-2066-0x00007FF65E5C0000-0x00007FF65E9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-81-0x00007FF76B330000-0x00007FF76B722000-memory.dmp

Filesize
3.9MB

Download
memory/2852-2064-0x00007FF76B330000-0x00007FF76B722000-memory.dmp

Filesize
3.9MB

Download
memory/2924-2058-0x00007FF64C300000-0x00007FF64C6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-79-0x00007FF64C300000-0x00007FF64C6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-1-0x000002B204000000-0x000002B204010000-memory.dmp

Filesize
64KB

Download
memory/2972-0-0x00007FF70B480000-0x00007FF70B872000-memory.dmp

Filesize
3.9MB

Download
memory/2972-1793-0x00007FF70B480000-0x00007FF70B872000-memory.dmp

Filesize
3.9MB

Download
memory/3640-1397-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp

Filesize
10.8MB

Download
memory/3640-60-0x000001ED25C10000-0x000001ED25C32000-memory.dmp

Filesize
136KB

Download
memory/3640-6-0x00007FFEE9C43000-0x00007FFEE9C45000-memory.dmp

Filesize
8KB

Download
memory/3640-32-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp

Filesize
10.8MB

Download
memory/3640-105-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp

Filesize
10.8MB

Download
memory/3668-160-0x00007FF7E93C0000-0x00007FF7E97B2000-memory.dmp

Filesize
3.9MB

Download
memory/3668-2141-0x00007FF7E93C0000-0x00007FF7E97B2000-memory.dmp

Filesize
3.9MB

Download
memory/3944-2037-0x00007FF676D60000-0x00007FF677152000-memory.dmp

Filesize
3.9MB

Download
memory/3944-143-0x00007FF676D60000-0x00007FF677152000-memory.dmp

Filesize
3.9MB

Download
memory/3944-2139-0x00007FF676D60000-0x00007FF677152000-memory.dmp

Filesize
3.9MB

Download
memory/4048-2052-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp

Filesize
3.9MB

Download
memory/4048-108-0x00007FF78BAB0000-0x00007FF78BEA2000-memory.dmp

Filesize
3.9MB

Download
memory/4140-2080-0x00007FF7F3930000-0x00007FF7F3D22000-memory.dmp

Filesize
3.9MB

Download
memory/4140-124-0x00007FF7F3930000-0x00007FF7F3D22000-memory.dmp

Filesize
3.9MB

Download
memory/4164-119-0x00007FF642E70000-0x00007FF643262000-memory.dmp

Filesize
3.9MB

Download
memory/4164-2069-0x00007FF642E70000-0x00007FF643262000-memory.dmp

Filesize
3.9MB

Download
memory/4584-138-0x00007FF60EBB0000-0x00007FF60EFA2000-memory.dmp

Filesize
3.9MB

Download
memory/4584-2137-0x00007FF60EBB0000-0x00007FF60EFA2000-memory.dmp

Filesize
3.9MB

Download
memory/4584-2011-0x00007FF60EBB0000-0x00007FF60EFA2000-memory.dmp

Filesize
3.9MB

Download
memory/4624-177-0x00007FF668D90000-0x00007FF669182000-memory.dmp

Filesize
3.9MB

Download
memory/4624-2046-0x00007FF668D90000-0x00007FF669182000-memory.dmp

Filesize
3.9MB

Download
memory/4624-2145-0x00007FF668D90000-0x00007FF669182000-memory.dmp

Filesize
3.9MB

Download
memory/4864-122-0x00007FF6EC080000-0x00007FF6EC472000-memory.dmp

Filesize
3.9MB

Download
memory/4864-2079-0x00007FF6EC080000-0x00007FF6EC472000-memory.dmp

Filesize
3.9MB

Download
memory/5052-125-0x00007FF61B200000-0x00007FF61B5F2000-memory.dmp

Filesize
3.9MB

Download
memory/5052-2084-0x00007FF61B200000-0x00007FF61B5F2000-memory.dmp

Filesize
3.9MB

Download
memory/5052-2010-0x00007FF61B200000-0x00007FF61B5F2000-memory.dmp

Filesize
3.9MB

Download