xmrig | 8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf

Analysis

max time kernel
62s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07-07-2024 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
Size

1006KB
MD5

7fc800928fc7ee21a4b0c6bd66b05817
SHA1

5e4d25ee3279c48488988a25a709ee962a9f6baf
SHA256

8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf
SHA512

e738198d3fc9de6d9f7d087c0431963efc454885ee27f6068fcc8b0108d7fe7d25a6abc16d219d5ecc3aac7e49217b70f4d0ed316108d025dfc51c2e9f597577
SSDEEP

24576:zv3/fTLF671TilQFG4P5PmK/lzapjlRPRWRG6JP:Lz071uv4BPm6l+XPRW5V

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/984-118-0x00007FF7DF440000-0x00007FF7DF832000-memory.dmp	xmrig
behavioral2/memory/4344-132-0x00007FF7E4FE0000-0x00007FF7E53D2000-memory.dmp	xmrig
behavioral2/memory/2940-192-0x00007FF63D570000-0x00007FF63D962000-memory.dmp	xmrig
behavioral2/memory/756-201-0x00007FF7541D0000-0x00007FF7545C2000-memory.dmp	xmrig
behavioral2/memory/4196-217-0x00007FF7986E0000-0x00007FF798AD2000-memory.dmp	xmrig
behavioral2/memory/400-213-0x00007FF681640000-0x00007FF681A32000-memory.dmp	xmrig
behavioral2/memory/3852-209-0x00007FF69AF80000-0x00007FF69B372000-memory.dmp	xmrig
behavioral2/memory/5084-205-0x00007FF6B49C0000-0x00007FF6B4DB2000-memory.dmp	xmrig
behavioral2/memory/4712-186-0x00007FF7490C0000-0x00007FF7494B2000-memory.dmp	xmrig
behavioral2/memory/2972-180-0x00007FF78E2F0000-0x00007FF78E6E2000-memory.dmp	xmrig
behavioral2/memory/2852-174-0x00007FF735470000-0x00007FF735862000-memory.dmp	xmrig
behavioral2/memory/2308-2459-0x00007FF76C5B0000-0x00007FF76C9A2000-memory.dmp	xmrig
behavioral2/memory/1924-168-0x00007FF656E40000-0x00007FF657232000-memory.dmp	xmrig
behavioral2/memory/3828-162-0x00007FF65D270000-0x00007FF65D662000-memory.dmp	xmrig
behavioral2/memory/2432-156-0x00007FF7C3BA0000-0x00007FF7C3F92000-memory.dmp	xmrig
behavioral2/memory/2844-150-0x00007FF73D630000-0x00007FF73DA22000-memory.dmp	xmrig
behavioral2/memory/2156-146-0x00007FF745610000-0x00007FF745A02000-memory.dmp	xmrig
behavioral2/memory/4680-142-0x00007FF7422E0000-0x00007FF7426D2000-memory.dmp	xmrig
behavioral2/memory/4924-137-0x00007FF7BABF0000-0x00007FF7BAFE2000-memory.dmp	xmrig
behavioral2/memory/1088-136-0x00007FF6E2C00000-0x00007FF6E2FF2000-memory.dmp	xmrig
behavioral2/memory/1512-127-0x00007FF62B050000-0x00007FF62B442000-memory.dmp	xmrig
behavioral2/memory/1500-114-0x00007FF6B83A0000-0x00007FF6B8792000-memory.dmp	xmrig
behavioral2/memory/3712-117-0x00007FF7B6A30000-0x00007FF7B6E22000-memory.dmp	xmrig
behavioral2/memory/4688-107-0x00007FF726BE0000-0x00007FF726FD2000-memory.dmp	xmrig
behavioral2/memory/2308-2473-0x00007FF76C5B0000-0x00007FF76C9A2000-memory.dmp	xmrig
behavioral2/memory/2972-2475-0x00007FF78E2F0000-0x00007FF78E6E2000-memory.dmp	xmrig
behavioral2/memory/1500-2477-0x00007FF6B83A0000-0x00007FF6B8792000-memory.dmp	xmrig
behavioral2/memory/4688-2479-0x00007FF726BE0000-0x00007FF726FD2000-memory.dmp	xmrig
behavioral2/memory/3712-2483-0x00007FF7B6A30000-0x00007FF7B6E22000-memory.dmp	xmrig
behavioral2/memory/1512-2485-0x00007FF62B050000-0x00007FF62B442000-memory.dmp	xmrig
behavioral2/memory/2940-2487-0x00007FF63D570000-0x00007FF63D962000-memory.dmp	xmrig
behavioral2/memory/984-2489-0x00007FF7DF440000-0x00007FF7DF832000-memory.dmp	xmrig
behavioral2/memory/4344-2493-0x00007FF7E4FE0000-0x00007FF7E53D2000-memory.dmp	xmrig
behavioral2/memory/1088-2491-0x00007FF6E2C00000-0x00007FF6E2FF2000-memory.dmp	xmrig
behavioral2/memory/4712-2481-0x00007FF7490C0000-0x00007FF7494B2000-memory.dmp	xmrig
behavioral2/memory/4924-2495-0x00007FF7BABF0000-0x00007FF7BAFE2000-memory.dmp	xmrig
behavioral2/memory/4680-2497-0x00007FF7422E0000-0x00007FF7426D2000-memory.dmp	xmrig
behavioral2/memory/2156-2501-0x00007FF745610000-0x00007FF745A02000-memory.dmp	xmrig
behavioral2/memory/2844-2499-0x00007FF73D630000-0x00007FF73DA22000-memory.dmp	xmrig
behavioral2/memory/2432-2503-0x00007FF7C3BA0000-0x00007FF7C3F92000-memory.dmp	xmrig
behavioral2/memory/756-2505-0x00007FF7541D0000-0x00007FF7545C2000-memory.dmp	xmrig
behavioral2/memory/2852-2511-0x00007FF735470000-0x00007FF735862000-memory.dmp	xmrig
behavioral2/memory/3852-2513-0x00007FF69AF80000-0x00007FF69B372000-memory.dmp	xmrig
behavioral2/memory/3828-2515-0x00007FF65D270000-0x00007FF65D662000-memory.dmp	xmrig
behavioral2/memory/1924-2509-0x00007FF656E40000-0x00007FF657232000-memory.dmp	xmrig
behavioral2/memory/400-2517-0x00007FF681640000-0x00007FF681A32000-memory.dmp	xmrig
behavioral2/memory/5084-2507-0x00007FF6B49C0000-0x00007FF6B4DB2000-memory.dmp	xmrig
behavioral2/memory/4196-2519-0x00007FF7986E0000-0x00007FF798AD2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3528	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2308	mcfAYtN.exe
2972	IJNCYkC.exe
4712	ARkxThl.exe
4688	Zcvcxim.exe
1500	BWZpDim.exe
3712	WjHQSQm.exe
984	DqFRBNT.exe
1512	WDMmNAb.exe
4344	HWeiIBr.exe
2940	VxlJNCf.exe
1088	JreKxfN.exe
4924	QKxkOwR.exe
4680	EvhrOTf.exe
2156	xSSPLWn.exe
2844	TzNFGzz.exe
2432	KIFNkBK.exe
756	HoSedxO.exe
3828	khKbwLG.exe
5084	LVFZCId.exe
1924	QQKCQmb.exe
2852	bUZEyys.exe
3852	TuPlNZG.exe
400	ApILLlt.exe
4196	TiWtjxk.exe
5112	TzqzTFA.exe
1664	LfBOuhx.exe
2044	boSTGzo.exe
2840	XQYrIAJ.exe
1780	rwjKGVv.exe
4812	ecqnfTg.exe
2180	BHQAoGc.exe
1268	mozauvS.exe
1552	mLGZtcw.exe
3908	lQHqxDc.exe
4584	FaDGJLH.exe
3164	YVyDWAg.exe
1784	QVePAJc.exe
4532	NygRffu.exe
4752	NVHXYqD.exe
2408	sVcSpFE.exe
3892	DGADnWl.exe
1256	noawWAz.exe
4476	KDMJbge.exe
3516	HgOGCFa.exe
4424	ThXTgBX.exe
3884	hMzqlax.exe
4164	KevtjDb.exe
408	NunIfah.exe
1352	jycTfEf.exe
4288	OECyDKo.exe
4000	mmLVYcp.exe
2020	NqFfjJj.exe
4540	TIHaRGn.exe
5096	eMeTfEf.exe
4488	mddcFIj.exe
4520	NxlAbUq.exe
2140	SPXqZPH.exe
5004	diPRMrE.exe
4024	pEkptZY.exe
4588	QGuWhFG.exe
5052	rJEpDUZ.exe
3424	iTPyLVE.exe
3756	uQIJkMz.exe
4064	egKtKUk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1548-0-0x00007FF7C5890000-0x00007FF7C5C82000-memory.dmp	upx
behavioral2/files/0x00070000000233e3-17.dat	upx
behavioral2/files/0x00070000000233e7-29.dat	upx
behavioral2/files/0x00070000000233ea-43.dat	upx
behavioral2/files/0x00070000000233ec-56.dat	upx
behavioral2/files/0x00070000000233ed-65.dat	upx
behavioral2/files/0x00070000000233ef-74.dat	upx
behavioral2/files/0x00070000000233f1-89.dat	upx
behavioral2/files/0x00080000000233f4-108.dat	upx
behavioral2/memory/984-118-0x00007FF7DF440000-0x00007FF7DF832000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-125.dat	upx
behavioral2/memory/4344-132-0x00007FF7E4FE0000-0x00007FF7E53D2000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-138.dat	upx
behavioral2/files/0x00080000000233f3-147.dat	upx
behavioral2/files/0x00070000000233fb-159.dat	upx
behavioral2/files/0x00070000000233fd-181.dat	upx
behavioral2/memory/2940-192-0x00007FF63D570000-0x00007FF63D962000-memory.dmp	upx
behavioral2/memory/756-201-0x00007FF7541D0000-0x00007FF7545C2000-memory.dmp	upx
behavioral2/memory/4196-217-0x00007FF7986E0000-0x00007FF798AD2000-memory.dmp	upx
behavioral2/memory/400-213-0x00007FF681640000-0x00007FF681A32000-memory.dmp	upx
behavioral2/memory/3852-209-0x00007FF69AF80000-0x00007FF69B372000-memory.dmp	upx
behavioral2/memory/5084-205-0x00007FF6B49C0000-0x00007FF6B4DB2000-memory.dmp	upx
behavioral2/files/0x0007000000023401-195.dat	upx
behavioral2/files/0x00070000000233ff-193.dat	upx
behavioral2/files/0x0007000000023400-189.dat	upx
behavioral2/files/0x00070000000233fe-187.dat	upx
behavioral2/memory/4712-186-0x00007FF7490C0000-0x00007FF7494B2000-memory.dmp	upx
behavioral2/memory/2972-180-0x00007FF78E2F0000-0x00007FF78E6E2000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-175.dat	upx
behavioral2/memory/2852-174-0x00007FF735470000-0x00007FF735862000-memory.dmp	upx
behavioral2/memory/2308-2459-0x00007FF76C5B0000-0x00007FF76C9A2000-memory.dmp	upx
behavioral2/memory/1924-168-0x00007FF656E40000-0x00007FF657232000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-163.dat	upx
behavioral2/memory/3828-162-0x00007FF65D270000-0x00007FF65D662000-memory.dmp	upx
behavioral2/memory/2432-156-0x00007FF7C3BA0000-0x00007FF7C3F92000-memory.dmp	upx
behavioral2/files/0x00080000000233e0-151.dat	upx
behavioral2/memory/2844-150-0x00007FF73D630000-0x00007FF73DA22000-memory.dmp	upx
behavioral2/memory/2156-146-0x00007FF745610000-0x00007FF745A02000-memory.dmp	upx
behavioral2/memory/4680-142-0x00007FF7422E0000-0x00007FF7426D2000-memory.dmp	upx
behavioral2/memory/4924-137-0x00007FF7BABF0000-0x00007FF7BAFE2000-memory.dmp	upx
behavioral2/memory/1088-136-0x00007FF6E2C00000-0x00007FF6E2FF2000-memory.dmp	upx
behavioral2/files/0x00070000000233f5-134.dat	upx
behavioral2/files/0x00070000000233f8-130.dat	upx
behavioral2/memory/1512-127-0x00007FF62B050000-0x00007FF62B442000-memory.dmp	upx
behavioral2/files/0x00070000000233f6-123.dat	upx
behavioral2/files/0x00070000000233f2-119.dat	upx
behavioral2/memory/1500-114-0x00007FF6B83A0000-0x00007FF6B8792000-memory.dmp	upx
behavioral2/files/0x00070000000233f0-111.dat	upx
behavioral2/memory/3712-117-0x00007FF7B6A30000-0x00007FF7B6E22000-memory.dmp	upx
behavioral2/memory/4688-107-0x00007FF726BE0000-0x00007FF726FD2000-memory.dmp	upx
behavioral2/files/0x00070000000233ee-88.dat	upx
behavioral2/files/0x00070000000233e9-60.dat	upx
behavioral2/files/0x00070000000233e8-53.dat	upx
behavioral2/files/0x00070000000233eb-51.dat	upx
behavioral2/files/0x00070000000233e5-32.dat	upx
behavioral2/files/0x00070000000233e6-23.dat	upx
behavioral2/files/0x00070000000233e4-27.dat	upx
behavioral2/memory/2308-2473-0x00007FF76C5B0000-0x00007FF76C9A2000-memory.dmp	upx
behavioral2/memory/2972-2475-0x00007FF78E2F0000-0x00007FF78E6E2000-memory.dmp	upx
behavioral2/memory/1500-2477-0x00007FF6B83A0000-0x00007FF6B8792000-memory.dmp	upx
behavioral2/memory/4688-2479-0x00007FF726BE0000-0x00007FF726FD2000-memory.dmp	upx
behavioral2/memory/3712-2483-0x00007FF7B6A30000-0x00007FF7B6E22000-memory.dmp	upx
behavioral2/memory/1512-2485-0x00007FF62B050000-0x00007FF62B442000-memory.dmp	upx
behavioral2/memory/2940-2487-0x00007FF63D570000-0x00007FF63D962000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZrjWfKd.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\yBdvCgs.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\ugFnXnx.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\gAwgXtG.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\ILOHYbQ.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\xUahWRO.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\qtjHAHU.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\tchRwjh.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\QdEVToR.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\iBjXKAU.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\nUoJdLj.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\yrufswP.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\UHZFvfv.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\ADjKEFK.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\MjxkdWO.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\lJToxIe.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\rXsDPfT.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\bHvGAvN.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\RsUJWmm.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\HjpRbzx.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\JeQIkhI.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\MYpwXEk.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\llrbEMV.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\BHpdCCE.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\DPDDDeS.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\CPBVaaY.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\rUiUzkN.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\WdEpUQQ.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\Uisnwld.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\LfBOuhx.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\XrEYQir.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\SQKSpKd.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\tJBixhu.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\YbcbSTG.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\oWRbXTg.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\ihbnUPv.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\mgjPsCU.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\ZsITeoa.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\vPsFOat.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\syplxKT.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\hnwvKHL.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\RJkzdHM.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\oUqKPXK.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\EaeAeVB.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\iMIaJOz.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\hkPKQNf.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\nSfeshl.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\ybQqFxm.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\uKtlQGD.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\mZKXSSa.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\JreKxfN.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\VgsOtfu.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\wgUXswE.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\bFUjKBg.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\vaQSGUs.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\tqmJaJw.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\FOaKcLf.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\AbTNZzB.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\MDKcKXm.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\XpUoqIf.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\MSZPuhn.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\BQWGmIf.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\OFcKEVW.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
File created	C:\Windows\System\xLbgOyI.exe	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3528	powershell.exe
3528	powershell.exe
3528	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
Token: SeLockMemoryPrivilege	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
Token: SeDebugPrivilege	3528	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3528	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	81
PID 1548 wrote to memory of 3528	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	81
PID 1548 wrote to memory of 2308	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	82
PID 1548 wrote to memory of 2308	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	82
PID 1548 wrote to memory of 2972	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	83
PID 1548 wrote to memory of 2972	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	83
PID 1548 wrote to memory of 4712	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	84
PID 1548 wrote to memory of 4712	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	84
PID 1548 wrote to memory of 4688	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	85
PID 1548 wrote to memory of 4688	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	85
PID 1548 wrote to memory of 1500	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	86
PID 1548 wrote to memory of 1500	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	86
PID 1548 wrote to memory of 3712	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	87
PID 1548 wrote to memory of 3712	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	87
PID 1548 wrote to memory of 984	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	88
PID 1548 wrote to memory of 984	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	88
PID 1548 wrote to memory of 4344	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	89
PID 1548 wrote to memory of 4344	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	89
PID 1548 wrote to memory of 1512	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	90
PID 1548 wrote to memory of 1512	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	90
PID 1548 wrote to memory of 2940	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	91
PID 1548 wrote to memory of 2940	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	91
PID 1548 wrote to memory of 1088	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	92
PID 1548 wrote to memory of 1088	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	92
PID 1548 wrote to memory of 4924	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	93
PID 1548 wrote to memory of 4924	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	93
PID 1548 wrote to memory of 4680	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	94
PID 1548 wrote to memory of 4680	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	94
PID 1548 wrote to memory of 2156	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	95
PID 1548 wrote to memory of 2156	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	95
PID 1548 wrote to memory of 2432	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	96
PID 1548 wrote to memory of 2432	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	96
PID 1548 wrote to memory of 2844	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	97
PID 1548 wrote to memory of 2844	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	97
PID 1548 wrote to memory of 756	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	98
PID 1548 wrote to memory of 756	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	98
PID 1548 wrote to memory of 3828	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	99
PID 1548 wrote to memory of 3828	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	99
PID 1548 wrote to memory of 5084	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	100
PID 1548 wrote to memory of 5084	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	100
PID 1548 wrote to memory of 1924	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	101
PID 1548 wrote to memory of 1924	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	101
PID 1548 wrote to memory of 2852	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	102
PID 1548 wrote to memory of 2852	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	102
PID 1548 wrote to memory of 3852	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	103
PID 1548 wrote to memory of 3852	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	103
PID 1548 wrote to memory of 400	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	104
PID 1548 wrote to memory of 400	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	104
PID 1548 wrote to memory of 4196	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	105
PID 1548 wrote to memory of 4196	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	105
PID 1548 wrote to memory of 5112	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	106
PID 1548 wrote to memory of 5112	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	106
PID 1548 wrote to memory of 1664	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	107
PID 1548 wrote to memory of 1664	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	107
PID 1548 wrote to memory of 2044	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	108
PID 1548 wrote to memory of 2044	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	108
PID 1548 wrote to memory of 2840	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	109
PID 1548 wrote to memory of 2840	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	109
PID 1548 wrote to memory of 1780	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	110
PID 1548 wrote to memory of 1780	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	110
PID 1548 wrote to memory of 4812	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	111
PID 1548 wrote to memory of 4812	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	111
PID 1548 wrote to memory of 2180	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	112
PID 1548 wrote to memory of 2180	1548	8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe	112

C:\Users\Admin\AppData\Local\Temp\8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe
"C:\Users\Admin\AppData\Local\Temp\8e584b57d2d32ff09e749dc6a13ebe682f336ff527b2ccbadb71e7dbfcd54fdf.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3528
- C:\Windows\System\mcfAYtN.exe
  C:\Windows\System\mcfAYtN.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\IJNCYkC.exe
  C:\Windows\System\IJNCYkC.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\ARkxThl.exe
  C:\Windows\System\ARkxThl.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\Zcvcxim.exe
  C:\Windows\System\Zcvcxim.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\BWZpDim.exe
  C:\Windows\System\BWZpDim.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\WjHQSQm.exe
  C:\Windows\System\WjHQSQm.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\DqFRBNT.exe
  C:\Windows\System\DqFRBNT.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\HWeiIBr.exe
  C:\Windows\System\HWeiIBr.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\WDMmNAb.exe
  C:\Windows\System\WDMmNAb.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\VxlJNCf.exe
  C:\Windows\System\VxlJNCf.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\JreKxfN.exe
  C:\Windows\System\JreKxfN.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\QKxkOwR.exe
  C:\Windows\System\QKxkOwR.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\EvhrOTf.exe
  C:\Windows\System\EvhrOTf.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\xSSPLWn.exe
  C:\Windows\System\xSSPLWn.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\KIFNkBK.exe
  C:\Windows\System\KIFNkBK.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\TzNFGzz.exe
  C:\Windows\System\TzNFGzz.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\HoSedxO.exe
  C:\Windows\System\HoSedxO.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\khKbwLG.exe
  C:\Windows\System\khKbwLG.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\LVFZCId.exe
  C:\Windows\System\LVFZCId.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\QQKCQmb.exe
  C:\Windows\System\QQKCQmb.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\bUZEyys.exe
  C:\Windows\System\bUZEyys.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\TuPlNZG.exe
  C:\Windows\System\TuPlNZG.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\ApILLlt.exe
  C:\Windows\System\ApILLlt.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\TiWtjxk.exe
  C:\Windows\System\TiWtjxk.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\TzqzTFA.exe
  C:\Windows\System\TzqzTFA.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\LfBOuhx.exe
  C:\Windows\System\LfBOuhx.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\boSTGzo.exe
  C:\Windows\System\boSTGzo.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\XQYrIAJ.exe
  C:\Windows\System\XQYrIAJ.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\rwjKGVv.exe
  C:\Windows\System\rwjKGVv.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\ecqnfTg.exe
  C:\Windows\System\ecqnfTg.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\BHQAoGc.exe
  C:\Windows\System\BHQAoGc.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\mozauvS.exe
  C:\Windows\System\mozauvS.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\mLGZtcw.exe
  C:\Windows\System\mLGZtcw.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\lQHqxDc.exe
  C:\Windows\System\lQHqxDc.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\FaDGJLH.exe
  C:\Windows\System\FaDGJLH.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\YVyDWAg.exe
  C:\Windows\System\YVyDWAg.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\QVePAJc.exe
  C:\Windows\System\QVePAJc.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\NygRffu.exe
  C:\Windows\System\NygRffu.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\NVHXYqD.exe
  C:\Windows\System\NVHXYqD.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\sVcSpFE.exe
  C:\Windows\System\sVcSpFE.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\DGADnWl.exe
  C:\Windows\System\DGADnWl.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\noawWAz.exe
  C:\Windows\System\noawWAz.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\KDMJbge.exe
  C:\Windows\System\KDMJbge.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\HgOGCFa.exe
  C:\Windows\System\HgOGCFa.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\ThXTgBX.exe
  C:\Windows\System\ThXTgBX.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\hMzqlax.exe
  C:\Windows\System\hMzqlax.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\KevtjDb.exe
  C:\Windows\System\KevtjDb.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\NunIfah.exe
  C:\Windows\System\NunIfah.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\jycTfEf.exe
  C:\Windows\System\jycTfEf.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\OECyDKo.exe
  C:\Windows\System\OECyDKo.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\mmLVYcp.exe
  C:\Windows\System\mmLVYcp.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\NqFfjJj.exe
  C:\Windows\System\NqFfjJj.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\TIHaRGn.exe
  C:\Windows\System\TIHaRGn.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\eMeTfEf.exe
  C:\Windows\System\eMeTfEf.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\mddcFIj.exe
  C:\Windows\System\mddcFIj.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\NxlAbUq.exe
  C:\Windows\System\NxlAbUq.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\SPXqZPH.exe
  C:\Windows\System\SPXqZPH.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\diPRMrE.exe
  C:\Windows\System\diPRMrE.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\pEkptZY.exe
  C:\Windows\System\pEkptZY.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\QGuWhFG.exe
  C:\Windows\System\QGuWhFG.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\rJEpDUZ.exe
  C:\Windows\System\rJEpDUZ.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\iTPyLVE.exe
  C:\Windows\System\iTPyLVE.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\uQIJkMz.exe
  C:\Windows\System\uQIJkMz.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\egKtKUk.exe
  C:\Windows\System\egKtKUk.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\XxwwSfI.exe
  C:\Windows\System\XxwwSfI.exe
  2⤵
  PID:4292
- C:\Windows\System\xUWlsyU.exe
  C:\Windows\System\xUWlsyU.exe
  2⤵
  PID:2376
- C:\Windows\System\ODqRLzA.exe
  C:\Windows\System\ODqRLzA.exe
  2⤵
  PID:3564
- C:\Windows\System\dyzxuud.exe
  C:\Windows\System\dyzxuud.exe
  2⤵
  PID:5088
- C:\Windows\System\nWefCsF.exe
  C:\Windows\System\nWefCsF.exe
  2⤵
  PID:3044
- C:\Windows\System\GQaRbuN.exe
  C:\Windows\System\GQaRbuN.exe
  2⤵
  PID:4872
- C:\Windows\System\PeHyfSW.exe
  C:\Windows\System\PeHyfSW.exe
  2⤵
  PID:4928
- C:\Windows\System\DOAnjTq.exe
  C:\Windows\System\DOAnjTq.exe
  2⤵
  PID:4432
- C:\Windows\System\uDUEWFt.exe
  C:\Windows\System\uDUEWFt.exe
  2⤵
  PID:1248
- C:\Windows\System\qPkEebb.exe
  C:\Windows\System\qPkEebb.exe
  2⤵
  PID:2832
- C:\Windows\System\KueJGyp.exe
  C:\Windows\System\KueJGyp.exe
  2⤵
  PID:2836
- C:\Windows\System\WBzxuoj.exe
  C:\Windows\System\WBzxuoj.exe
  2⤵
  PID:1840
- C:\Windows\System\FPKThYi.exe
  C:\Windows\System\FPKThYi.exe
  2⤵
  PID:824
- C:\Windows\System\vOXBvDj.exe
  C:\Windows\System\vOXBvDj.exe
  2⤵
  PID:1288
- C:\Windows\System\uJUicXC.exe
  C:\Windows\System\uJUicXC.exe
  2⤵
  PID:3472
- C:\Windows\System\ZuKDQDy.exe
  C:\Windows\System\ZuKDQDy.exe
  2⤵
  PID:4944
- C:\Windows\System\OiOVnED.exe
  C:\Windows\System\OiOVnED.exe
  2⤵
  PID:1944
- C:\Windows\System\GeImjiA.exe
  C:\Windows\System\GeImjiA.exe
  2⤵
  PID:3864
- C:\Windows\System\LerjIFm.exe
  C:\Windows\System\LerjIFm.exe
  2⤵
  PID:1168
- C:\Windows\System\ctbUblW.exe
  C:\Windows\System\ctbUblW.exe
  2⤵
  PID:2496
- C:\Windows\System\JAtNrYO.exe
  C:\Windows\System\JAtNrYO.exe
  2⤵
  PID:2440
- C:\Windows\System\FAZhzIy.exe
  C:\Windows\System\FAZhzIy.exe
  2⤵
  PID:4276
- C:\Windows\System\HmxpHXy.exe
  C:\Windows\System\HmxpHXy.exe
  2⤵
  PID:5036
- C:\Windows\System\sgVLlQD.exe
  C:\Windows\System\sgVLlQD.exe
  2⤵
  PID:2812
- C:\Windows\System\ilGqfks.exe
  C:\Windows\System\ilGqfks.exe
  2⤵
  PID:2220
- C:\Windows\System\WrzPokt.exe
  C:\Windows\System\WrzPokt.exe
  2⤵
  PID:4956
- C:\Windows\System\jIkHvMI.exe
  C:\Windows\System\jIkHvMI.exe
  2⤵
  PID:1888
- C:\Windows\System\koKpSXQ.exe
  C:\Windows\System\koKpSXQ.exe
  2⤵
  PID:5020
- C:\Windows\System\BRuVwkD.exe
  C:\Windows\System\BRuVwkD.exe
  2⤵
  PID:3968
- C:\Windows\System\vFneFeu.exe
  C:\Windows\System\vFneFeu.exe
  2⤵
  PID:4952
- C:\Windows\System\xUlZNJy.exe
  C:\Windows\System\xUlZNJy.exe
  2⤵
  PID:2596
- C:\Windows\System\YscLzYP.exe
  C:\Windows\System\YscLzYP.exe
  2⤵
  PID:4304
- C:\Windows\System\ZrjWfKd.exe
  C:\Windows\System\ZrjWfKd.exe
  2⤵
  PID:2816
- C:\Windows\System\VcxzGRs.exe
  C:\Windows\System\VcxzGRs.exe
  2⤵
  PID:1524
- C:\Windows\System\mwdsXOr.exe
  C:\Windows\System\mwdsXOr.exe
  2⤵
  PID:3576
- C:\Windows\System\TTKOqUA.exe
  C:\Windows\System\TTKOqUA.exe
  2⤵
  PID:488
- C:\Windows\System\wHBBaWI.exe
  C:\Windows\System\wHBBaWI.exe
  2⤵
  PID:3984
- C:\Windows\System\suGEreR.exe
  C:\Windows\System\suGEreR.exe
  2⤵
  PID:5008
- C:\Windows\System\llrbEMV.exe
  C:\Windows\System\llrbEMV.exe
  2⤵
  PID:4804
- C:\Windows\System\IimKlfh.exe
  C:\Windows\System\IimKlfh.exe
  2⤵
  PID:412
- C:\Windows\System\HXmNbQa.exe
  C:\Windows\System\HXmNbQa.exe
  2⤵
  PID:2760
- C:\Windows\System\KMgAakP.exe
  C:\Windows\System\KMgAakP.exe
  2⤵
  PID:2784
- C:\Windows\System\xwHTfaW.exe
  C:\Windows\System\xwHTfaW.exe
  2⤵
  PID:5144
- C:\Windows\System\aUeKNLm.exe
  C:\Windows\System\aUeKNLm.exe
  2⤵
  PID:5200
- C:\Windows\System\gAJFAgx.exe
  C:\Windows\System\gAJFAgx.exe
  2⤵
  PID:5220
- C:\Windows\System\wkOcLFP.exe
  C:\Windows\System\wkOcLFP.exe
  2⤵
  PID:5268
- C:\Windows\System\WhtAEZL.exe
  C:\Windows\System\WhtAEZL.exe
  2⤵
  PID:5292
- C:\Windows\System\xPKOcyK.exe
  C:\Windows\System\xPKOcyK.exe
  2⤵
  PID:5308
- C:\Windows\System\ZvHYKGV.exe
  C:\Windows\System\ZvHYKGV.exe
  2⤵
  PID:5328
- C:\Windows\System\ARMvMCI.exe
  C:\Windows\System\ARMvMCI.exe
  2⤵
  PID:5348
- C:\Windows\System\njNmTmT.exe
  C:\Windows\System\njNmTmT.exe
  2⤵
  PID:5372
- C:\Windows\System\gtuDuMa.exe
  C:\Windows\System\gtuDuMa.exe
  2⤵
  PID:5396
- C:\Windows\System\MOCLZTR.exe
  C:\Windows\System\MOCLZTR.exe
  2⤵
  PID:5432
- C:\Windows\System\MZvJMXk.exe
  C:\Windows\System\MZvJMXk.exe
  2⤵
  PID:5484
- C:\Windows\System\DnAtrAn.exe
  C:\Windows\System\DnAtrAn.exe
  2⤵
  PID:5516
- C:\Windows\System\bPccyEi.exe
  C:\Windows\System\bPccyEi.exe
  2⤵
  PID:5532
- C:\Windows\System\qltEHwa.exe
  C:\Windows\System\qltEHwa.exe
  2⤵
  PID:5556
- C:\Windows\System\CUnGlRE.exe
  C:\Windows\System\CUnGlRE.exe
  2⤵
  PID:5608
- C:\Windows\System\ymdtqVA.exe
  C:\Windows\System\ymdtqVA.exe
  2⤵
  PID:5644
- C:\Windows\System\PnqrVuU.exe
  C:\Windows\System\PnqrVuU.exe
  2⤵
  PID:5660
- C:\Windows\System\FCyiizm.exe
  C:\Windows\System\FCyiizm.exe
  2⤵
  PID:5680
- C:\Windows\System\tphgDqt.exe
  C:\Windows\System\tphgDqt.exe
  2⤵
  PID:5700
- C:\Windows\System\IYBnWSs.exe
  C:\Windows\System\IYBnWSs.exe
  2⤵
  PID:5720
- C:\Windows\System\OSaapox.exe
  C:\Windows\System\OSaapox.exe
  2⤵
  PID:5736
- C:\Windows\System\Nwcmggh.exe
  C:\Windows\System\Nwcmggh.exe
  2⤵
  PID:5776
- C:\Windows\System\uXQseFi.exe
  C:\Windows\System\uXQseFi.exe
  2⤵
  PID:5800
- C:\Windows\System\XRdKNya.exe
  C:\Windows\System\XRdKNya.exe
  2⤵
  PID:5816
- C:\Windows\System\LiqlDOK.exe
  C:\Windows\System\LiqlDOK.exe
  2⤵
  PID:5844
- C:\Windows\System\lCPlvPc.exe
  C:\Windows\System\lCPlvPc.exe
  2⤵
  PID:5868
- C:\Windows\System\MrMdYVt.exe
  C:\Windows\System\MrMdYVt.exe
  2⤵
  PID:5896
- C:\Windows\System\RPURZaH.exe
  C:\Windows\System\RPURZaH.exe
  2⤵
  PID:5948
- C:\Windows\System\sfaBsiE.exe
  C:\Windows\System\sfaBsiE.exe
  2⤵
  PID:6040
- C:\Windows\System\nsflddY.exe
  C:\Windows\System\nsflddY.exe
  2⤵
  PID:6072
- C:\Windows\System\HCNomiu.exe
  C:\Windows\System\HCNomiu.exe
  2⤵
  PID:6096
- C:\Windows\System\ElfwGGw.exe
  C:\Windows\System\ElfwGGw.exe
  2⤵
  PID:6124
- C:\Windows\System\vatxWRV.exe
  C:\Windows\System\vatxWRV.exe
  2⤵
  PID:1028
- C:\Windows\System\muoGWQh.exe
  C:\Windows\System\muoGWQh.exe
  2⤵
  PID:5028
- C:\Windows\System\zbPvvMJ.exe
  C:\Windows\System\zbPvvMJ.exe
  2⤵
  PID:5180
- C:\Windows\System\RLWKJUv.exe
  C:\Windows\System\RLWKJUv.exe
  2⤵
  PID:5216
- C:\Windows\System\DhMWMRD.exe
  C:\Windows\System\DhMWMRD.exe
  2⤵
  PID:5192
- C:\Windows\System\PFlzmud.exe
  C:\Windows\System\PFlzmud.exe
  2⤵
  PID:5320
- C:\Windows\System\kuHBhPt.exe
  C:\Windows\System\kuHBhPt.exe
  2⤵
  PID:5344
- C:\Windows\System\UKlaXku.exe
  C:\Windows\System\UKlaXku.exe
  2⤵
  PID:5424
- C:\Windows\System\LfnOXUa.exe
  C:\Windows\System\LfnOXUa.exe
  2⤵
  PID:5456
- C:\Windows\System\nsXSHrr.exe
  C:\Windows\System\nsXSHrr.exe
  2⤵
  PID:5744
- C:\Windows\System\efaYVkH.exe
  C:\Windows\System\efaYVkH.exe
  2⤵
  PID:5668
- C:\Windows\System\RlCJDdJ.exe
  C:\Windows\System\RlCJDdJ.exe
  2⤵
  PID:5708
- C:\Windows\System\tVoFmId.exe
  C:\Windows\System\tVoFmId.exe
  2⤵
  PID:5760
- C:\Windows\System\HgBXzLi.exe
  C:\Windows\System\HgBXzLi.exe
  2⤵
  PID:5788
- C:\Windows\System\ZUGoYSV.exe
  C:\Windows\System\ZUGoYSV.exe
  2⤵
  PID:5944
- C:\Windows\System\exrzjfs.exe
  C:\Windows\System\exrzjfs.exe
  2⤵
  PID:5992
- C:\Windows\System\MOkZpVZ.exe
  C:\Windows\System\MOkZpVZ.exe
  2⤵
  PID:6008
- C:\Windows\System\zhdNVJC.exe
  C:\Windows\System\zhdNVJC.exe
  2⤵
  PID:6028
- C:\Windows\System\nvfAfJm.exe
  C:\Windows\System\nvfAfJm.exe
  2⤵
  PID:6108
- C:\Windows\System\WHKtqfo.exe
  C:\Windows\System\WHKtqfo.exe
  2⤵
  PID:5248
- C:\Windows\System\qfDcNiE.exe
  C:\Windows\System\qfDcNiE.exe
  2⤵
  PID:5380
- C:\Windows\System\rgeNBzC.exe
  C:\Windows\System\rgeNBzC.exe
  2⤵
  PID:5732
- C:\Windows\System\eHDQxOO.exe
  C:\Windows\System\eHDQxOO.exe
  2⤵
  PID:5812
- C:\Windows\System\wVtLSGz.exe
  C:\Windows\System\wVtLSGz.exe
  2⤵
  PID:5856
- C:\Windows\System\EBdfTzt.exe
  C:\Windows\System\EBdfTzt.exe
  2⤵
  PID:5984
- C:\Windows\System\ZYcPywG.exe
  C:\Windows\System\ZYcPywG.exe
  2⤵
  PID:5940
- C:\Windows\System\pgEIZkN.exe
  C:\Windows\System\pgEIZkN.exe
  2⤵
  PID:5136
- C:\Windows\System\IfZykCY.exe
  C:\Windows\System\IfZykCY.exe
  2⤵
  PID:3148
- C:\Windows\System\NiBqrTB.exe
  C:\Windows\System\NiBqrTB.exe
  2⤵
  PID:5576
- C:\Windows\System\aiTdvfE.exe
  C:\Windows\System\aiTdvfE.exe
  2⤵
  PID:5888
- C:\Windows\System\dAzstel.exe
  C:\Windows\System\dAzstel.exe
  2⤵
  PID:6156
- C:\Windows\System\VECbOVF.exe
  C:\Windows\System\VECbOVF.exe
  2⤵
  PID:6180
- C:\Windows\System\kSBtXBX.exe
  C:\Windows\System\kSBtXBX.exe
  2⤵
  PID:6196
- C:\Windows\System\JgsnCAh.exe
  C:\Windows\System\JgsnCAh.exe
  2⤵
  PID:6220
- C:\Windows\System\hmDlJcv.exe
  C:\Windows\System\hmDlJcv.exe
  2⤵
  PID:6236
- C:\Windows\System\UKLFouF.exe
  C:\Windows\System\UKLFouF.exe
  2⤵
  PID:6256
- C:\Windows\System\mQDZvmj.exe
  C:\Windows\System\mQDZvmj.exe
  2⤵
  PID:6280
- C:\Windows\System\NhSfAks.exe
  C:\Windows\System\NhSfAks.exe
  2⤵
  PID:6332
- C:\Windows\System\qxskmvT.exe
  C:\Windows\System\qxskmvT.exe
  2⤵
  PID:6352
- C:\Windows\System\XkkrkNF.exe
  C:\Windows\System\XkkrkNF.exe
  2⤵
  PID:6408
- C:\Windows\System\VnZZqCb.exe
  C:\Windows\System\VnZZqCb.exe
  2⤵
  PID:6424
- C:\Windows\System\MPONQJi.exe
  C:\Windows\System\MPONQJi.exe
  2⤵
  PID:6492
- C:\Windows\System\oPYRHGJ.exe
  C:\Windows\System\oPYRHGJ.exe
  2⤵
  PID:6508
- C:\Windows\System\taTEVgV.exe
  C:\Windows\System\taTEVgV.exe
  2⤵
  PID:6532
- C:\Windows\System\cANxshy.exe
  C:\Windows\System\cANxshy.exe
  2⤵
  PID:6572
- C:\Windows\System\YlKlNQO.exe
  C:\Windows\System\YlKlNQO.exe
  2⤵
  PID:6620
- C:\Windows\System\vGUwIZc.exe
  C:\Windows\System\vGUwIZc.exe
  2⤵
  PID:6676
- C:\Windows\System\XwTdkvw.exe
  C:\Windows\System\XwTdkvw.exe
  2⤵
  PID:6704
- C:\Windows\System\QOdjFSz.exe
  C:\Windows\System\QOdjFSz.exe
  2⤵
  PID:6728
- C:\Windows\System\zCftEZu.exe
  C:\Windows\System\zCftEZu.exe
  2⤵
  PID:6748
- C:\Windows\System\hgqhLOf.exe
  C:\Windows\System\hgqhLOf.exe
  2⤵
  PID:6772
- C:\Windows\System\dRhMrMP.exe
  C:\Windows\System\dRhMrMP.exe
  2⤵
  PID:6800
- C:\Windows\System\uCPgGBU.exe
  C:\Windows\System\uCPgGBU.exe
  2⤵
  PID:6816
- C:\Windows\System\aQHPOpD.exe
  C:\Windows\System\aQHPOpD.exe
  2⤵
  PID:6832
- C:\Windows\System\nSXoCeq.exe
  C:\Windows\System\nSXoCeq.exe
  2⤵
  PID:6856
- C:\Windows\System\JWdLKLb.exe
  C:\Windows\System\JWdLKLb.exe
  2⤵
  PID:6872
- C:\Windows\System\CYBDLNg.exe
  C:\Windows\System\CYBDLNg.exe
  2⤵
  PID:6892
- C:\Windows\System\vBBQiYK.exe
  C:\Windows\System\vBBQiYK.exe
  2⤵
  PID:6936
- C:\Windows\System\EYljlTO.exe
  C:\Windows\System\EYljlTO.exe
  2⤵
  PID:6964
- C:\Windows\System\oOgIDJM.exe
  C:\Windows\System\oOgIDJM.exe
  2⤵
  PID:6984
- C:\Windows\System\MDKcKXm.exe
  C:\Windows\System\MDKcKXm.exe
  2⤵
  PID:7004
- C:\Windows\System\XwZlnFk.exe
  C:\Windows\System\XwZlnFk.exe
  2⤵
  PID:7024
- C:\Windows\System\UIiozDc.exe
  C:\Windows\System\UIiozDc.exe
  2⤵
  PID:7084
- C:\Windows\System\dPhEnsT.exe
  C:\Windows\System\dPhEnsT.exe
  2⤵
  PID:7100
- C:\Windows\System\pwSjnJx.exe
  C:\Windows\System\pwSjnJx.exe
  2⤵
  PID:7128
- C:\Windows\System\LtMfxcv.exe
  C:\Windows\System\LtMfxcv.exe
  2⤵
  PID:5784
- C:\Windows\System\ameCYwX.exe
  C:\Windows\System\ameCYwX.exe
  2⤵
  PID:5692
- C:\Windows\System\ijbdBZF.exe
  C:\Windows\System\ijbdBZF.exe
  2⤵
  PID:6216
- C:\Windows\System\tYcBSBw.exe
  C:\Windows\System\tYcBSBw.exe
  2⤵
  PID:6264
- C:\Windows\System\OeHUNgg.exe
  C:\Windows\System\OeHUNgg.exe
  2⤵
  PID:6004
- C:\Windows\System\KdQFcaB.exe
  C:\Windows\System\KdQFcaB.exe
  2⤵
  PID:6176
- C:\Windows\System\FjFxllV.exe
  C:\Windows\System\FjFxllV.exe
  2⤵
  PID:6436
- C:\Windows\System\DXTtLOe.exe
  C:\Windows\System\DXTtLOe.exe
  2⤵
  PID:6384
- C:\Windows\System\yrOYcVM.exe
  C:\Windows\System\yrOYcVM.exe
  2⤵
  PID:6376
- C:\Windows\System\pQKGrHG.exe
  C:\Windows\System\pQKGrHG.exe
  2⤵
  PID:6592
- C:\Windows\System\shqLYTF.exe
  C:\Windows\System\shqLYTF.exe
  2⤵
  PID:6668
- C:\Windows\System\nGBwIPC.exe
  C:\Windows\System\nGBwIPC.exe
  2⤵
  PID:6700
- C:\Windows\System\itPIzcZ.exe
  C:\Windows\System\itPIzcZ.exe
  2⤵
  PID:6760
- C:\Windows\System\sbGVmBY.exe
  C:\Windows\System\sbGVmBY.exe
  2⤵
  PID:6824
- C:\Windows\System\KNIMVLY.exe
  C:\Windows\System\KNIMVLY.exe
  2⤵
  PID:6840
- C:\Windows\System\SqJcHLv.exe
  C:\Windows\System\SqJcHLv.exe
  2⤵
  PID:6868
- C:\Windows\System\JlGigzH.exe
  C:\Windows\System\JlGigzH.exe
  2⤵
  PID:6980
- C:\Windows\System\VLyYuHS.exe
  C:\Windows\System\VLyYuHS.exe
  2⤵
  PID:7016
- C:\Windows\System\BDajkNj.exe
  C:\Windows\System\BDajkNj.exe
  2⤵
  PID:6248
- C:\Windows\System\tFCXFyj.exe
  C:\Windows\System\tFCXFyj.exe
  2⤵
  PID:5176
- C:\Windows\System\zQREnvY.exe
  C:\Windows\System\zQREnvY.exe
  2⤵
  PID:6344
- C:\Windows\System\TdbGikE.exe
  C:\Windows\System\TdbGikE.exe
  2⤵
  PID:6484
- C:\Windows\System\CnSnoQu.exe
  C:\Windows\System\CnSnoQu.exe
  2⤵
  PID:6296
- C:\Windows\System\vGfasLT.exe
  C:\Windows\System\vGfasLT.exe
  2⤵
  PID:6320
- C:\Windows\System\llCLMoz.exe
  C:\Windows\System\llCLMoz.exe
  2⤵
  PID:6996
- C:\Windows\System\wAoYqiL.exe
  C:\Windows\System\wAoYqiL.exe
  2⤵
  PID:6956
- C:\Windows\System\xbLbdPw.exe
  C:\Windows\System\xbLbdPw.exe
  2⤵
  PID:5384
- C:\Windows\System\tOJrXZg.exe
  C:\Windows\System\tOJrXZg.exe
  2⤵
  PID:6204
- C:\Windows\System\zqTwPZX.exe
  C:\Windows\System\zqTwPZX.exe
  2⤵
  PID:7096
- C:\Windows\System\IoXNKtT.exe
  C:\Windows\System\IoXNKtT.exe
  2⤵
  PID:7240
- C:\Windows\System\YwHPOWm.exe
  C:\Windows\System\YwHPOWm.exe
  2⤵
  PID:7256
- C:\Windows\System\LkUPuzx.exe
  C:\Windows\System\LkUPuzx.exe
  2⤵
  PID:7276
- C:\Windows\System\OusqGpx.exe
  C:\Windows\System\OusqGpx.exe
  2⤵
  PID:7312
- C:\Windows\System\Bykscus.exe
  C:\Windows\System\Bykscus.exe
  2⤵
  PID:7328
- C:\Windows\System\wtMRBWn.exe
  C:\Windows\System\wtMRBWn.exe
  2⤵
  PID:7364
- C:\Windows\System\elFVIFk.exe
  C:\Windows\System\elFVIFk.exe
  2⤵
  PID:7392
- C:\Windows\System\fgTxzGg.exe
  C:\Windows\System\fgTxzGg.exe
  2⤵
  PID:7408
- C:\Windows\System\kMpKHmE.exe
  C:\Windows\System\kMpKHmE.exe
  2⤵
  PID:7440
- C:\Windows\System\oIUNDzZ.exe
  C:\Windows\System\oIUNDzZ.exe
  2⤵
  PID:7468
- C:\Windows\System\FJQuuwU.exe
  C:\Windows\System\FJQuuwU.exe
  2⤵
  PID:7500
- C:\Windows\System\sMDIJta.exe
  C:\Windows\System\sMDIJta.exe
  2⤵
  PID:7548
- C:\Windows\System\ebXcRJQ.exe
  C:\Windows\System\ebXcRJQ.exe
  2⤵
  PID:7568
- C:\Windows\System\WXQOrTf.exe
  C:\Windows\System\WXQOrTf.exe
  2⤵
  PID:7592
- C:\Windows\System\agaGbEt.exe
  C:\Windows\System\agaGbEt.exe
  2⤵
  PID:7616
- C:\Windows\System\ZbREsMD.exe
  C:\Windows\System\ZbREsMD.exe
  2⤵
  PID:7636
- C:\Windows\System\McziOLG.exe
  C:\Windows\System\McziOLG.exe
  2⤵
  PID:7680
- C:\Windows\System\ZKyeymX.exe
  C:\Windows\System\ZKyeymX.exe
  2⤵
  PID:7724
- C:\Windows\System\LeDBqiM.exe
  C:\Windows\System\LeDBqiM.exe
  2⤵
  PID:7752
- C:\Windows\System\FKcsYsV.exe
  C:\Windows\System\FKcsYsV.exe
  2⤵
  PID:7780
- C:\Windows\System\oxPBQuC.exe
  C:\Windows\System\oxPBQuC.exe
  2⤵
  PID:7796
- C:\Windows\System\rctghtX.exe
  C:\Windows\System\rctghtX.exe
  2⤵
  PID:7816
- C:\Windows\System\GLBXKEH.exe
  C:\Windows\System\GLBXKEH.exe
  2⤵
  PID:7848
- C:\Windows\System\xyhnMlq.exe
  C:\Windows\System\xyhnMlq.exe
  2⤵
  PID:7876
- C:\Windows\System\QYHYoJi.exe
  C:\Windows\System\QYHYoJi.exe
  2⤵
  PID:7916
- C:\Windows\System\LfHZYyD.exe
  C:\Windows\System\LfHZYyD.exe
  2⤵
  PID:7944
- C:\Windows\System\RnWUosO.exe
  C:\Windows\System\RnWUosO.exe
  2⤵
  PID:7968
- C:\Windows\System\eopwIWH.exe
  C:\Windows\System\eopwIWH.exe
  2⤵
  PID:7984
- C:\Windows\System\irpsCJs.exe
  C:\Windows\System\irpsCJs.exe
  2⤵
  PID:8004
- C:\Windows\System\jivspBj.exe
  C:\Windows\System\jivspBj.exe
  2⤵
  PID:8020
- C:\Windows\System\liuQstW.exe
  C:\Windows\System\liuQstW.exe
  2⤵
  PID:8040
- C:\Windows\System\hFTjppa.exe
  C:\Windows\System\hFTjppa.exe
  2⤵
  PID:8056
- C:\Windows\System\BVJGXxZ.exe
  C:\Windows\System\BVJGXxZ.exe
  2⤵
  PID:8076
- C:\Windows\System\nMBcLcI.exe
  C:\Windows\System\nMBcLcI.exe
  2⤵
  PID:8152
- C:\Windows\System\WYDYYwp.exe
  C:\Windows\System\WYDYYwp.exe
  2⤵
  PID:7124
- C:\Windows\System\wssoCLw.exe
  C:\Windows\System\wssoCLw.exe
  2⤵
  PID:7184
- C:\Windows\System\GShdAQi.exe
  C:\Windows\System\GShdAQi.exe
  2⤵
  PID:7232
- C:\Windows\System\FcEiGtc.exe
  C:\Windows\System\FcEiGtc.exe
  2⤵
  PID:7344
- C:\Windows\System\sSsxyqL.exe
  C:\Windows\System\sSsxyqL.exe
  2⤵
  PID:7384
- C:\Windows\System\MEkHIBp.exe
  C:\Windows\System\MEkHIBp.exe
  2⤵
  PID:7428
- C:\Windows\System\UdJZiWs.exe
  C:\Windows\System\UdJZiWs.exe
  2⤵
  PID:7544
- C:\Windows\System\qbOeWrb.exe
  C:\Windows\System\qbOeWrb.exe
  2⤵
  PID:7580
- C:\Windows\System\yRZoDAV.exe
  C:\Windows\System\yRZoDAV.exe
  2⤵
  PID:7660
- C:\Windows\System\QSSnAng.exe
  C:\Windows\System\QSSnAng.exe
  2⤵
  PID:7632
- C:\Windows\System\ivVDxGd.exe
  C:\Windows\System\ivVDxGd.exe
  2⤵
  PID:7760
- C:\Windows\System\mzNdQAq.exe
  C:\Windows\System\mzNdQAq.exe
  2⤵
  PID:7788
- C:\Windows\System\YnvIBeq.exe
  C:\Windows\System\YnvIBeq.exe
  2⤵
  PID:7868
- C:\Windows\System\AXkezmM.exe
  C:\Windows\System\AXkezmM.exe
  2⤵
  PID:1132
- C:\Windows\System\fLXwbxq.exe
  C:\Windows\System\fLXwbxq.exe
  2⤵
  PID:7976
- C:\Windows\System\ZsKpFiy.exe
  C:\Windows\System\ZsKpFiy.exe
  2⤵
  PID:7980
- C:\Windows\System\SLNCaVq.exe
  C:\Windows\System\SLNCaVq.exe
  2⤵
  PID:8096
- C:\Windows\System\bNEvZjI.exe
  C:\Windows\System\bNEvZjI.exe
  2⤵
  PID:8112
- C:\Windows\System\MFgLwZw.exe
  C:\Windows\System\MFgLwZw.exe
  2⤵
  PID:8188
- C:\Windows\System\btCUiGH.exe
  C:\Windows\System\btCUiGH.exe
  2⤵
  PID:6556
- C:\Windows\System\LTPuMot.exe
  C:\Windows\System\LTPuMot.exe
  2⤵
  PID:2228
- C:\Windows\System\FUnkZrM.exe
  C:\Windows\System\FUnkZrM.exe
  2⤵
  PID:7516
- C:\Windows\System\obUFNnB.exe
  C:\Windows\System\obUFNnB.exe
  2⤵
  PID:4260
- C:\Windows\System\cnMjHEo.exe
  C:\Windows\System\cnMjHEo.exe
  2⤵
  PID:7628
- C:\Windows\System\ocMgFRa.exe
  C:\Windows\System\ocMgFRa.exe
  2⤵
  PID:7832
- C:\Windows\System\GKMntBM.exe
  C:\Windows\System\GKMntBM.exe
  2⤵
  PID:7768
- C:\Windows\System\ydgCDct.exe
  C:\Windows\System\ydgCDct.exe
  2⤵
  PID:7952
- C:\Windows\System\cYUTZNV.exe
  C:\Windows\System\cYUTZNV.exe
  2⤵
  PID:7520
- C:\Windows\System\ShWFlAe.exe
  C:\Windows\System\ShWFlAe.exe
  2⤵
  PID:4308
- C:\Windows\System\CcmdQmf.exe
  C:\Windows\System\CcmdQmf.exe
  2⤵
  PID:7748
- C:\Windows\System\HjEHQWc.exe
  C:\Windows\System\HjEHQWc.exe
  2⤵
  PID:8036
- C:\Windows\System\cgxDJtT.exe
  C:\Windows\System\cgxDJtT.exe
  2⤵
  PID:7624
- C:\Windows\System\tpGTUwd.exe
  C:\Windows\System\tpGTUwd.exe
  2⤵
  PID:8196
- C:\Windows\System\HRBpBVv.exe
  C:\Windows\System\HRBpBVv.exe
  2⤵
  PID:8220
- C:\Windows\System\irQdmEm.exe
  C:\Windows\System\irQdmEm.exe
  2⤵
  PID:8236
- C:\Windows\System\OVwwNXz.exe
  C:\Windows\System\OVwwNXz.exe
  2⤵
  PID:8256
- C:\Windows\System\CNctHlj.exe
  C:\Windows\System\CNctHlj.exe
  2⤵
  PID:8276
- C:\Windows\System\EOQGmfU.exe
  C:\Windows\System\EOQGmfU.exe
  2⤵
  PID:8336
- C:\Windows\System\yfMhavV.exe
  C:\Windows\System\yfMhavV.exe
  2⤵
  PID:8352
- C:\Windows\System\ZTqrkOR.exe
  C:\Windows\System\ZTqrkOR.exe
  2⤵
  PID:8380
- C:\Windows\System\eiWayyj.exe
  C:\Windows\System\eiWayyj.exe
  2⤵
  PID:8420
- C:\Windows\System\ltmzITV.exe
  C:\Windows\System\ltmzITV.exe
  2⤵
  PID:8448
- C:\Windows\System\VViGzMg.exe
  C:\Windows\System\VViGzMg.exe
  2⤵
  PID:8484
- C:\Windows\System\ISBvyKj.exe
  C:\Windows\System\ISBvyKj.exe
  2⤵
  PID:8516
- C:\Windows\System\LthMFBP.exe
  C:\Windows\System\LthMFBP.exe
  2⤵
  PID:8540
- C:\Windows\System\vWEKSbV.exe
  C:\Windows\System\vWEKSbV.exe
  2⤵
  PID:8556
- C:\Windows\System\yNOoBCL.exe
  C:\Windows\System\yNOoBCL.exe
  2⤵
  PID:8580
- C:\Windows\System\LAiIhDJ.exe
  C:\Windows\System\LAiIhDJ.exe
  2⤵
  PID:8612
- C:\Windows\System\cINqztV.exe
  C:\Windows\System\cINqztV.exe
  2⤵
  PID:8632
- C:\Windows\System\vhCnqNk.exe
  C:\Windows\System\vhCnqNk.exe
  2⤵
  PID:8656
- C:\Windows\System\dsPbsmG.exe
  C:\Windows\System\dsPbsmG.exe
  2⤵
  PID:8676
- C:\Windows\System\odIybzE.exe
  C:\Windows\System\odIybzE.exe
  2⤵
  PID:8696
- C:\Windows\System\rnZKUAZ.exe
  C:\Windows\System\rnZKUAZ.exe
  2⤵
  PID:8720
- C:\Windows\System\yiPBqBi.exe
  C:\Windows\System\yiPBqBi.exe
  2⤵
  PID:8756
- C:\Windows\System\xilFxtw.exe
  C:\Windows\System\xilFxtw.exe
  2⤵
  PID:8780
- C:\Windows\System\xIyEVqL.exe
  C:\Windows\System\xIyEVqL.exe
  2⤵
  PID:8796
- C:\Windows\System\xILrdWK.exe
  C:\Windows\System\xILrdWK.exe
  2⤵
  PID:8820
- C:\Windows\System\VrqAffL.exe
  C:\Windows\System\VrqAffL.exe
  2⤵
  PID:8836
- C:\Windows\System\vLpXoLv.exe
  C:\Windows\System\vLpXoLv.exe
  2⤵
  PID:8852
- C:\Windows\System\LwGkkrz.exe
  C:\Windows\System\LwGkkrz.exe
  2⤵
  PID:8880
- C:\Windows\System\CuUAzFG.exe
  C:\Windows\System\CuUAzFG.exe
  2⤵
  PID:8896
- C:\Windows\System\dfLzrop.exe
  C:\Windows\System\dfLzrop.exe
  2⤵
  PID:8960
- C:\Windows\System\jalQJxa.exe
  C:\Windows\System\jalQJxa.exe
  2⤵
  PID:9020
- C:\Windows\System\QGRZxxZ.exe
  C:\Windows\System\QGRZxxZ.exe
  2⤵
  PID:9076
- C:\Windows\System\cBGMosv.exe
  C:\Windows\System\cBGMosv.exe
  2⤵
  PID:9116
- C:\Windows\System\yWiJmPZ.exe
  C:\Windows\System\yWiJmPZ.exe
  2⤵
  PID:9136
- C:\Windows\System\NASWtMH.exe
  C:\Windows\System\NASWtMH.exe
  2⤵
  PID:9160
- C:\Windows\System\eLXCTCQ.exe
  C:\Windows\System\eLXCTCQ.exe
  2⤵
  PID:9176
- C:\Windows\System\WACFoFW.exe
  C:\Windows\System\WACFoFW.exe
  2⤵
  PID:9192
- C:\Windows\System\LscpDee.exe
  C:\Windows\System\LscpDee.exe
  2⤵
  PID:9212
- C:\Windows\System\ybkmyHH.exe
  C:\Windows\System\ybkmyHH.exe
  2⤵
  PID:7264
- C:\Windows\System\bqoKwbs.exe
  C:\Windows\System\bqoKwbs.exe
  2⤵
  PID:8212
- C:\Windows\System\awyFjtQ.exe
  C:\Windows\System\awyFjtQ.exe
  2⤵
  PID:8360
- C:\Windows\System\TEPvekD.exe
  C:\Windows\System\TEPvekD.exe
  2⤵
  PID:8408
- C:\Windows\System\hAXCzkt.exe
  C:\Windows\System\hAXCzkt.exe
  2⤵
  PID:8480
- C:\Windows\System\tiTllpI.exe
  C:\Windows\System\tiTllpI.exe
  2⤵
  PID:8500
- C:\Windows\System\uzuowoW.exe
  C:\Windows\System\uzuowoW.exe
  2⤵
  PID:8568
- C:\Windows\System\rPJgkvB.exe
  C:\Windows\System\rPJgkvB.exe
  2⤵
  PID:8596
- C:\Windows\System\zWVztzz.exe
  C:\Windows\System\zWVztzz.exe
  2⤵
  PID:8708
- C:\Windows\System\RoFHcBP.exe
  C:\Windows\System\RoFHcBP.exe
  2⤵
  PID:8748
- C:\Windows\System\NeIaVCe.exe
  C:\Windows\System\NeIaVCe.exe
  2⤵
  PID:8804
- C:\Windows\System\aATtwJM.exe
  C:\Windows\System\aATtwJM.exe
  2⤵
  PID:8808
- C:\Windows\System\jYqdzKn.exe
  C:\Windows\System\jYqdzKn.exe
  2⤵
  PID:8956
- C:\Windows\System\DwILsnp.exe
  C:\Windows\System\DwILsnp.exe
  2⤵
  PID:9052
- C:\Windows\System\SVRVZPT.exe
  C:\Windows\System\SVRVZPT.exe
  2⤵
  PID:9112
- C:\Windows\System\dLIkLjN.exe
  C:\Windows\System\dLIkLjN.exe
  2⤵
  PID:9172
- C:\Windows\System\WRecvsO.exe
  C:\Windows\System\WRecvsO.exe
  2⤵
  PID:8344
- C:\Windows\System\uobwNxd.exe
  C:\Windows\System\uobwNxd.exe
  2⤵
  PID:8208
- C:\Windows\System\bgcJekP.exe
  C:\Windows\System\bgcJekP.exe
  2⤵
  PID:8712
- C:\Windows\System\yiTYTML.exe
  C:\Windows\System\yiTYTML.exe
  2⤵
  PID:9128
- C:\Windows\System\ZsrXQll.exe
  C:\Windows\System\ZsrXQll.exe
  2⤵
  PID:8976
- C:\Windows\System\ynkGaNU.exe
  C:\Windows\System\ynkGaNU.exe
  2⤵
  PID:9168
- C:\Windows\System\PcxspgH.exe
  C:\Windows\System\PcxspgH.exe
  2⤵
  PID:9124
- C:\Windows\System\vrwBQLc.exe
  C:\Windows\System\vrwBQLc.exe
  2⤵
  PID:8672
- C:\Windows\System\vyThlBo.exe
  C:\Windows\System\vyThlBo.exe
  2⤵
  PID:9220
- C:\Windows\System\ADUdSRw.exe
  C:\Windows\System\ADUdSRw.exe
  2⤵
  PID:9236
- C:\Windows\System\lnTCvNN.exe
  C:\Windows\System\lnTCvNN.exe
  2⤵
  PID:9252
- C:\Windows\System\lHfxhux.exe
  C:\Windows\System\lHfxhux.exe
  2⤵
  PID:9272
- C:\Windows\System\GyzGRtV.exe
  C:\Windows\System\GyzGRtV.exe
  2⤵
  PID:9288
- C:\Windows\System\mPDtiaQ.exe
  C:\Windows\System\mPDtiaQ.exe
  2⤵
  PID:9308
- C:\Windows\System\jBdOInx.exe
  C:\Windows\System\jBdOInx.exe
  2⤵
  PID:9324
- C:\Windows\System\GgEBCEf.exe
  C:\Windows\System\GgEBCEf.exe
  2⤵
  PID:9340
- C:\Windows\System\wCblrux.exe
  C:\Windows\System\wCblrux.exe
  2⤵
  PID:9364
- C:\Windows\System\evEGkyo.exe
  C:\Windows\System\evEGkyo.exe
  2⤵
  PID:9396
- C:\Windows\System\KkfVKLD.exe
  C:\Windows\System\KkfVKLD.exe
  2⤵
  PID:9420
- C:\Windows\System\yFhDRWA.exe
  C:\Windows\System\yFhDRWA.exe
  2⤵
  PID:9484
- C:\Windows\System\QwweyKp.exe
  C:\Windows\System\QwweyKp.exe
  2⤵
  PID:9512
- C:\Windows\System\hiRelgT.exe
  C:\Windows\System\hiRelgT.exe
  2⤵
  PID:9544
- C:\Windows\System\ltIrpnw.exe
  C:\Windows\System\ltIrpnw.exe
  2⤵
  PID:9568
- C:\Windows\System\wHKvZuZ.exe
  C:\Windows\System\wHKvZuZ.exe
  2⤵
  PID:9592
- C:\Windows\System\naHwLPI.exe
  C:\Windows\System\naHwLPI.exe
  2⤵
  PID:9676
- C:\Windows\System\gVEqeJO.exe
  C:\Windows\System\gVEqeJO.exe
  2⤵
  PID:9696
- C:\Windows\System\YkKCcgc.exe
  C:\Windows\System\YkKCcgc.exe
  2⤵
  PID:9756
- C:\Windows\System\KAOrqHR.exe
  C:\Windows\System\KAOrqHR.exe
  2⤵
  PID:9780
- C:\Windows\System\swCkxVj.exe
  C:\Windows\System\swCkxVj.exe
  2⤵
  PID:9852
- C:\Windows\System\DrWzxby.exe
  C:\Windows\System\DrWzxby.exe
  2⤵
  PID:9884
- C:\Windows\System\bKpeEia.exe
  C:\Windows\System\bKpeEia.exe
  2⤵
  PID:9928
- C:\Windows\System\RzHCQVc.exe
  C:\Windows\System\RzHCQVc.exe
  2⤵
  PID:9948
- C:\Windows\System\SkMbzPS.exe
  C:\Windows\System\SkMbzPS.exe
  2⤵
  PID:9968
- C:\Windows\System\DAxDEkV.exe
  C:\Windows\System\DAxDEkV.exe
  2⤵
  PID:10000
- C:\Windows\System\rjTdGhD.exe
  C:\Windows\System\rjTdGhD.exe
  2⤵
  PID:10024
- C:\Windows\System\fRwBdgK.exe
  C:\Windows\System\fRwBdgK.exe
  2⤵
  PID:10076
- C:\Windows\System\eUXZdkv.exe
  C:\Windows\System\eUXZdkv.exe
  2⤵
  PID:10100
- C:\Windows\System\BwnFHyA.exe
  C:\Windows\System\BwnFHyA.exe
  2⤵
  PID:10136
- C:\Windows\System\aQTlsSR.exe
  C:\Windows\System\aQTlsSR.exe
  2⤵
  PID:10152
- C:\Windows\System\nMTjavQ.exe
  C:\Windows\System\nMTjavQ.exe
  2⤵
  PID:10180
- C:\Windows\System\ULWelGB.exe
  C:\Windows\System\ULWelGB.exe
  2⤵
  PID:10212
- C:\Windows\System\ibbasQY.exe
  C:\Windows\System\ibbasQY.exe
  2⤵
  PID:10236
- C:\Windows\System\BUsSRyS.exe
  C:\Windows\System\BUsSRyS.exe
  2⤵
  PID:8744
- C:\Windows\System\DspYrds.exe
  C:\Windows\System\DspYrds.exe
  2⤵
  PID:9372
- C:\Windows\System\RAbdObJ.exe
  C:\Windows\System\RAbdObJ.exe
  2⤵
  PID:8392
- C:\Windows\System\OwSBkFp.exe
  C:\Windows\System\OwSBkFp.exe
  2⤵
  PID:9300
- C:\Windows\System\NKtKEig.exe
  C:\Windows\System\NKtKEig.exe
  2⤵
  PID:9392
- C:\Windows\System\hiThaTl.exe
  C:\Windows\System\hiThaTl.exe
  2⤵
  PID:9504
- C:\Windows\System\YyAEIbA.exe
  C:\Windows\System\YyAEIbA.exe
  2⤵
  PID:9244
- C:\Windows\System\IVLMgIM.exe
  C:\Windows\System\IVLMgIM.exe
  2⤵
  PID:9380
- C:\Windows\System\NxjJHWA.exe
  C:\Windows\System\NxjJHWA.exe
  2⤵
  PID:9500
- C:\Windows\System\SLxzKmd.exe
  C:\Windows\System\SLxzKmd.exe
  2⤵
  PID:9520
- C:\Windows\System\muwvGaT.exe
  C:\Windows\System\muwvGaT.exe
  2⤵
  PID:9612
- C:\Windows\System\vHhPdlr.exe
  C:\Windows\System\vHhPdlr.exe
  2⤵
  PID:760
- C:\Windows\System\QPfJUrI.exe
  C:\Windows\System\QPfJUrI.exe
  2⤵
  PID:9808
- C:\Windows\System\ptIcYsX.exe
  C:\Windows\System\ptIcYsX.exe
  2⤵
  PID:9804
- C:\Windows\System\qxUzqLT.exe
  C:\Windows\System\qxUzqLT.exe
  2⤵
  PID:9908
- C:\Windows\System\JfAWYfc.exe
  C:\Windows\System\JfAWYfc.exe
  2⤵
  PID:9964
- C:\Windows\System\ZSShYHr.exe
  C:\Windows\System\ZSShYHr.exe
  2⤵
  PID:9988
- C:\Windows\System\UfbflYr.exe
  C:\Windows\System\UfbflYr.exe
  2⤵
  PID:10016
- C:\Windows\System\zpSdyrn.exe
  C:\Windows\System\zpSdyrn.exe
  2⤵
  PID:10160
- C:\Windows\System\IhBKaAr.exe
  C:\Windows\System\IhBKaAr.exe
  2⤵
  PID:10176
- C:\Windows\System\ArYxwUo.exe
  C:\Windows\System\ArYxwUo.exe
  2⤵
  PID:9412
- C:\Windows\System\DDMSJvP.exe
  C:\Windows\System\DDMSJvP.exe
  2⤵
  PID:9356
- C:\Windows\System\vTxAKHZ.exe
  C:\Windows\System\vTxAKHZ.exe
  2⤵
  PID:436
- C:\Windows\System\kYEeBkV.exe
  C:\Windows\System\kYEeBkV.exe
  2⤵
  PID:9480
- C:\Windows\System\FJHlHak.exe
  C:\Windows\System\FJHlHak.exe
  2⤵
  PID:9752
- C:\Windows\System\fSvFAUy.exe
  C:\Windows\System\fSvFAUy.exe
  2⤵
  PID:9800
- C:\Windows\System\jMVOCOK.exe
  C:\Windows\System\jMVOCOK.exe
  2⤵
  PID:9860
- C:\Windows\System\dDPXLGn.exe
  C:\Windows\System\dDPXLGn.exe
  2⤵
  PID:9388
- C:\Windows\System\IfwrrLP.exe
  C:\Windows\System\IfwrrLP.exe
  2⤵
  PID:9640
- C:\Windows\System\uEpIRgq.exe
  C:\Windows\System\uEpIRgq.exe
  2⤵
  PID:9812
- C:\Windows\System\TpOUQBP.exe
  C:\Windows\System\TpOUQBP.exe
  2⤵
  PID:9832
- C:\Windows\System\Qehyxzr.exe
  C:\Windows\System\Qehyxzr.exe
  2⤵
  PID:9960
- C:\Windows\System\KjXkWmD.exe
  C:\Windows\System\KjXkWmD.exe
  2⤵
  PID:4536
- C:\Windows\System\uVOeoUa.exe
  C:\Windows\System\uVOeoUa.exe
  2⤵
  PID:9336
- C:\Windows\System\DapwUKV.exe
  C:\Windows\System\DapwUKV.exe
  2⤵
  PID:884
- C:\Windows\System\ZadFPSO.exe
  C:\Windows\System\ZadFPSO.exe
  2⤵
  PID:10284
- C:\Windows\System\IAKTwaH.exe
  C:\Windows\System\IAKTwaH.exe
  2⤵
  PID:10304
- C:\Windows\System\bBnKtsW.exe
  C:\Windows\System\bBnKtsW.exe
  2⤵
  PID:10324
- C:\Windows\System\zovZOKc.exe
  C:\Windows\System\zovZOKc.exe
  2⤵
  PID:10340
- C:\Windows\System\nmwalsa.exe
  C:\Windows\System\nmwalsa.exe
  2⤵
  PID:10364
- C:\Windows\System\AcfOyAY.exe
  C:\Windows\System\AcfOyAY.exe
  2⤵
  PID:10388
- C:\Windows\System\DBqvQvp.exe
  C:\Windows\System\DBqvQvp.exe
  2⤵
  PID:10404
- C:\Windows\System\EBoNYcP.exe
  C:\Windows\System\EBoNYcP.exe
  2⤵
  PID:10436
- C:\Windows\System\MsYYTPx.exe
  C:\Windows\System\MsYYTPx.exe
  2⤵
  PID:10452
- C:\Windows\System\zUdObjs.exe
  C:\Windows\System\zUdObjs.exe
  2⤵
  PID:10472
- C:\Windows\System\etrybph.exe
  C:\Windows\System\etrybph.exe
  2⤵
  PID:10504
- C:\Windows\System\RnZMeiE.exe
  C:\Windows\System\RnZMeiE.exe
  2⤵
  PID:10528
- C:\Windows\System\SlexGpq.exe
  C:\Windows\System\SlexGpq.exe
  2⤵
  PID:10584
- C:\Windows\System\dNJUhug.exe
  C:\Windows\System\dNJUhug.exe
  2⤵
  PID:10608
- C:\Windows\System\ETOsIfG.exe
  C:\Windows\System\ETOsIfG.exe
  2⤵
  PID:10624
- C:\Windows\System\mGcQCsW.exe
  C:\Windows\System\mGcQCsW.exe
  2⤵
  PID:10648
- C:\Windows\System\wjfPToR.exe
  C:\Windows\System\wjfPToR.exe
  2⤵
  PID:10708
- C:\Windows\System\YGnXpCL.exe
  C:\Windows\System\YGnXpCL.exe
  2⤵
  PID:10732
- C:\Windows\System\earRmhi.exe
  C:\Windows\System\earRmhi.exe
  2⤵
  PID:10752
- C:\Windows\System\kdnNczP.exe
  C:\Windows\System\kdnNczP.exe
  2⤵
  PID:10800
- C:\Windows\System\lsWTloj.exe
  C:\Windows\System\lsWTloj.exe
  2⤵
  PID:10824
- C:\Windows\System\XjeSHWC.exe
  C:\Windows\System\XjeSHWC.exe
  2⤵
  PID:10840
- C:\Windows\System\WXCjUkw.exe
  C:\Windows\System\WXCjUkw.exe
  2⤵
  PID:10864
- C:\Windows\System\KkdCLUh.exe
  C:\Windows\System\KkdCLUh.exe
  2⤵
  PID:10892
- C:\Windows\System\NZgulEu.exe
  C:\Windows\System\NZgulEu.exe
  2⤵
  PID:10940
- C:\Windows\System\XLfmTWb.exe
  C:\Windows\System\XLfmTWb.exe
  2⤵
  PID:10960
- C:\Windows\System\zyilZOB.exe
  C:\Windows\System\zyilZOB.exe
  2⤵
  PID:11012
- C:\Windows\System\uwAZThw.exe
  C:\Windows\System\uwAZThw.exe
  2⤵
  PID:11036
- C:\Windows\System\UrWpKEL.exe
  C:\Windows\System\UrWpKEL.exe
  2⤵
  PID:11064
- C:\Windows\System\YVeLKxK.exe
  C:\Windows\System\YVeLKxK.exe
  2⤵
  PID:11100
- C:\Windows\System\JiYnnEr.exe
  C:\Windows\System\JiYnnEr.exe
  2⤵
  PID:11124
- C:\Windows\System\URjjzmz.exe
  C:\Windows\System\URjjzmz.exe
  2⤵
  PID:11148
- C:\Windows\System\zCMGFFA.exe
  C:\Windows\System\zCMGFFA.exe
  2⤵
  PID:11172
- C:\Windows\System\oblwPgN.exe
  C:\Windows\System\oblwPgN.exe
  2⤵
  PID:11188
- C:\Windows\System\dZSQifF.exe
  C:\Windows\System\dZSQifF.exe
  2⤵
  PID:11252
- C:\Windows\System\TcpvkgJ.exe
  C:\Windows\System\TcpvkgJ.exe
  2⤵
  PID:10244
- C:\Windows\System\pgvCTDo.exe
  C:\Windows\System\pgvCTDo.exe
  2⤵
  PID:10320
- C:\Windows\System\iAfvzXV.exe
  C:\Windows\System\iAfvzXV.exe
  2⤵
  PID:10360
- C:\Windows\System\RIgQZWC.exe
  C:\Windows\System\RIgQZWC.exe
  2⤵
  PID:10416
- C:\Windows\System\BtNYQsS.exe
  C:\Windows\System\BtNYQsS.exe
  2⤵
  PID:10460
- C:\Windows\System\bexUmZI.exe
  C:\Windows\System\bexUmZI.exe
  2⤵
  PID:10500
- C:\Windows\System\GWkqnnO.exe
  C:\Windows\System\GWkqnnO.exe
  2⤵
  PID:10496
- C:\Windows\System\wIzGBBO.exe
  C:\Windows\System\wIzGBBO.exe
  2⤵
  PID:10564
- C:\Windows\System\GnZHIQm.exe
  C:\Windows\System\GnZHIQm.exe
  2⤵
  PID:10636
- C:\Windows\System\xtKpXSb.exe
  C:\Windows\System\xtKpXSb.exe
  2⤵
  PID:10680
- C:\Windows\System\QEfeDrq.exe
  C:\Windows\System\QEfeDrq.exe
  2⤵
  PID:2512
- C:\Windows\System\bFIOQki.exe
  C:\Windows\System\bFIOQki.exe
  2⤵
  PID:10788
- C:\Windows\System\tIGMtUk.exe
  C:\Windows\System\tIGMtUk.exe
  2⤵
  PID:10876
- C:\Windows\System\wUiikUj.exe
  C:\Windows\System\wUiikUj.exe
  2⤵
  PID:10952
- C:\Windows\System\TcxixLH.exe
  C:\Windows\System\TcxixLH.exe
  2⤵
  PID:11032
- C:\Windows\System\jRIXkCG.exe
  C:\Windows\System\jRIXkCG.exe
  2⤵
  PID:11056
- C:\Windows\System\owKJEjY.exe
  C:\Windows\System\owKJEjY.exe
  2⤵
  PID:11136
- C:\Windows\System\KIpcPcA.exe
  C:\Windows\System\KIpcPcA.exe
  2⤵
  PID:11180
- C:\Windows\System\sAynEbP.exe
  C:\Windows\System\sAynEbP.exe
  2⤵
  PID:11184
- C:\Windows\System\IyFzHjs.exe
  C:\Windows\System\IyFzHjs.exe
  2⤵
  PID:11248
- C:\Windows\System\TGKwgWk.exe
  C:\Windows\System\TGKwgWk.exe
  2⤵
  PID:10292
- C:\Windows\System\ydZHTtE.exe
  C:\Windows\System\ydZHTtE.exe
  2⤵
  PID:10396
- C:\Windows\System\xZVCkTz.exe
  C:\Windows\System\xZVCkTz.exe
  2⤵
  PID:10516
- C:\Windows\System\DvSVdUF.exe
  C:\Windows\System\DvSVdUF.exe
  2⤵
  PID:10616
- C:\Windows\System\annbKTd.exe
  C:\Windows\System\annbKTd.exe
  2⤵
  PID:10700
- C:\Windows\System\QYKVeON.exe
  C:\Windows\System\QYKVeON.exe
  2⤵
  PID:10832
- C:\Windows\System\ORSIVKx.exe
  C:\Windows\System\ORSIVKx.exe
  2⤵
  PID:11004
- C:\Windows\System\QGzbtEG.exe
  C:\Windows\System\QGzbtEG.exe
  2⤵
  PID:11112
- C:\Windows\System\rYXOabD.exe
  C:\Windows\System\rYXOabD.exe
  2⤵
  PID:11164
- C:\Windows\System\dbGQwNt.exe
  C:\Windows\System\dbGQwNt.exe
  2⤵
  PID:10884
- C:\Windows\System\cngJxnn.exe
  C:\Windows\System\cngJxnn.exe
  2⤵
  PID:10728
- C:\Windows\System\uPFLBQW.exe
  C:\Windows\System\uPFLBQW.exe
  2⤵
  PID:11116
- C:\Windows\System\JaVKXAP.exe
  C:\Windows\System\JaVKXAP.exe
  2⤵
  PID:11220
- C:\Windows\System\ZEMKNoX.exe
  C:\Windows\System\ZEMKNoX.exe
  2⤵
  PID:11272
- C:\Windows\System\kZSqOkW.exe
  C:\Windows\System\kZSqOkW.exe
  2⤵
  PID:11340
- C:\Windows\System\AZQwliG.exe
  C:\Windows\System\AZQwliG.exe
  2⤵
  PID:11360
- C:\Windows\System\aLATztm.exe
  C:\Windows\System\aLATztm.exe
  2⤵
  PID:11384
- C:\Windows\System\dUJRaFg.exe
  C:\Windows\System\dUJRaFg.exe
  2⤵
  PID:11400
- C:\Windows\System\dMDeLIP.exe
  C:\Windows\System\dMDeLIP.exe
  2⤵
  PID:11444
- C:\Windows\System\fNfQubv.exe
  C:\Windows\System\fNfQubv.exe
  2⤵
  PID:11468
- C:\Windows\System\PvEQUyD.exe
  C:\Windows\System\PvEQUyD.exe
  2⤵
  PID:11508
- C:\Windows\System\gCGhjbt.exe
  C:\Windows\System\gCGhjbt.exe
  2⤵
  PID:11536
- C:\Windows\System\tQAZKVR.exe
  C:\Windows\System\tQAZKVR.exe
  2⤵
  PID:11552
- C:\Windows\System\vpEFcsS.exe
  C:\Windows\System\vpEFcsS.exe
  2⤵
  PID:11572
- C:\Windows\System\hBxWzbq.exe
  C:\Windows\System\hBxWzbq.exe
  2⤵
  PID:11588
- C:\Windows\System\HMLNBMt.exe
  C:\Windows\System\HMLNBMt.exe
  2⤵
  PID:11616
- C:\Windows\System\BpCkZXa.exe
  C:\Windows\System\BpCkZXa.exe
  2⤵
  PID:11664
- C:\Windows\System\lPOnVQS.exe
  C:\Windows\System\lPOnVQS.exe
  2⤵
  PID:11696
- C:\Windows\System\NmIAzUD.exe
  C:\Windows\System\NmIAzUD.exe
  2⤵
  PID:11712
- C:\Windows\System\DnUoIpM.exe
  C:\Windows\System\DnUoIpM.exe
  2⤵
  PID:11736
- C:\Windows\System\uxUOdch.exe
  C:\Windows\System\uxUOdch.exe
  2⤵
  PID:11788
- C:\Windows\System\xMndKNe.exe
  C:\Windows\System\xMndKNe.exe
  2⤵
  PID:11816
- C:\Windows\System\RFiFQlP.exe
  C:\Windows\System\RFiFQlP.exe
  2⤵
  PID:11836
- C:\Windows\System\QYrRYKN.exe
  C:\Windows\System\QYrRYKN.exe
  2⤵
  PID:11864
- C:\Windows\System\JFIgJGo.exe
  C:\Windows\System\JFIgJGo.exe
  2⤵
  PID:11892
- C:\Windows\System\xJEdLYL.exe
  C:\Windows\System\xJEdLYL.exe
  2⤵
  PID:11920
- C:\Windows\System\AwDNIOF.exe
  C:\Windows\System\AwDNIOF.exe
  2⤵
  PID:11948
- C:\Windows\System\yLNXaLR.exe
  C:\Windows\System\yLNXaLR.exe
  2⤵
  PID:11980
- C:\Windows\System\dPyyTHL.exe
  C:\Windows\System\dPyyTHL.exe
  2⤵
  PID:12020
- C:\Windows\System\vzJWRNE.exe
  C:\Windows\System\vzJWRNE.exe
  2⤵
  PID:12044
- C:\Windows\System\hQaUIdz.exe
  C:\Windows\System\hQaUIdz.exe
  2⤵
  PID:12072
- C:\Windows\System\TqdaisD.exe
  C:\Windows\System\TqdaisD.exe
  2⤵
  PID:12088
- C:\Windows\System\GMKubMV.exe
  C:\Windows\System\GMKubMV.exe
  2⤵
  PID:12108
- C:\Windows\System\KmreBfO.exe
  C:\Windows\System\KmreBfO.exe
  2⤵
  PID:12144
- C:\Windows\System\Ferybqd.exe
  C:\Windows\System\Ferybqd.exe
  2⤵
  PID:12168
- C:\Windows\System\yyUknQL.exe
  C:\Windows\System\yyUknQL.exe
  2⤵
  PID:12184
- C:\Windows\System\FEyMjLw.exe
  C:\Windows\System\FEyMjLw.exe
  2⤵
  PID:12228
- C:\Windows\System\UuAlBvK.exe
  C:\Windows\System\UuAlBvK.exe
  2⤵
  PID:12256
- C:\Windows\System\PPgTjRd.exe
  C:\Windows\System\PPgTjRd.exe
  2⤵
  PID:12280
- C:\Windows\System\NWdYfNB.exe
  C:\Windows\System\NWdYfNB.exe
  2⤵
  PID:10748
- C:\Windows\System\AZGAcRf.exe
  C:\Windows\System\AZGAcRf.exe
  2⤵
  PID:11096
- C:\Windows\System\mVEfyVr.exe
  C:\Windows\System\mVEfyVr.exe
  2⤵
  PID:11356
- C:\Windows\System\SBysdDx.exe
  C:\Windows\System\SBysdDx.exe
  2⤵
  PID:11368
- C:\Windows\System\lLElzui.exe
  C:\Windows\System\lLElzui.exe
  2⤵
  PID:11440
- C:\Windows\System\IIUGivx.exe
  C:\Windows\System\IIUGivx.exe
  2⤵
  PID:11460
- C:\Windows\System\KLiKZLH.exe
  C:\Windows\System\KLiKZLH.exe
  2⤵
  PID:11496
- C:\Windows\System\VAcRMFW.exe
  C:\Windows\System\VAcRMFW.exe
  2⤵
  PID:11544
- C:\Windows\System\SEyaWIQ.exe
  C:\Windows\System\SEyaWIQ.exe
  2⤵
  PID:11636
- C:\Windows\System\mwuMgbO.exe
  C:\Windows\System\mwuMgbO.exe
  2⤵
  PID:11724
- C:\Windows\System\FgGuiZa.exe
  C:\Windows\System\FgGuiZa.exe
  2⤵
  PID:11852
- C:\Windows\System\eoDmMJZ.exe
  C:\Windows\System\eoDmMJZ.exe
  2⤵
  PID:11884
- C:\Windows\System\NnQPfyO.exe
  C:\Windows\System\NnQPfyO.exe
  2⤵
  PID:11960
- C:\Windows\System\WBfvqwv.exe
  C:\Windows\System\WBfvqwv.exe
  2⤵
  PID:12012
- C:\Windows\System\ZZEhkqd.exe
  C:\Windows\System\ZZEhkqd.exe
  2⤵
  PID:12136
- C:\Windows\System\RWHkNjH.exe
  C:\Windows\System\RWHkNjH.exe
  2⤵
  PID:12176
- C:\Windows\System\apbNUBu.exe
  C:\Windows\System\apbNUBu.exe
  2⤵
  PID:12252
- C:\Windows\System\ynynDst.exe
  C:\Windows\System\ynynDst.exe
  2⤵
  PID:11316
- C:\Windows\System\ePNNuAy.exe
  C:\Windows\System\ePNNuAy.exe
  2⤵
  PID:11304
- C:\Windows\System\StlTtGO.exe
  C:\Windows\System\StlTtGO.exe
  2⤵
  PID:11492
- C:\Windows\System\MmIEtvP.exe
  C:\Windows\System\MmIEtvP.exe
  2⤵
  PID:11528
- C:\Windows\System\FkMWUKR.exe
  C:\Windows\System\FkMWUKR.exe
  2⤵
  PID:11856
- C:\Windows\System\mPEBUeh.exe
  C:\Windows\System\mPEBUeh.exe
  2⤵
  PID:3804
- C:\Windows\System\VAvyeXx.exe
  C:\Windows\System\VAvyeXx.exe
  2⤵
  PID:11976
- C:\Windows\System\gaPNWot.exe
  C:\Windows\System\gaPNWot.exe
  2⤵
  PID:12268
- C:\Windows\System\FCgMNmX.exe
  C:\Windows\System\FCgMNmX.exe
  2⤵
  PID:11416
- C:\Windows\System\jjeSIkb.exe
  C:\Windows\System\jjeSIkb.exe
  2⤵
  PID:11672
- C:\Windows\System\UIsnPbE.exe
  C:\Windows\System\UIsnPbE.exe
  2⤵
  PID:10660
- C:\Windows\System\SaCXOCf.exe
  C:\Windows\System\SaCXOCf.exe
  2⤵
  PID:12340
- C:\Windows\System\CcJYTUB.exe
  C:\Windows\System\CcJYTUB.exe
  2⤵
  PID:12360
- C:\Windows\System\pYrWYqK.exe
  C:\Windows\System\pYrWYqK.exe
  2⤵
  PID:12380
- C:\Windows\System\nfovSKv.exe
  C:\Windows\System\nfovSKv.exe
  2⤵
  PID:12400
- C:\Windows\System\YVvcZqU.exe
  C:\Windows\System\YVvcZqU.exe
  2⤵
  PID:12444
- C:\Windows\System\zmamRvB.exe
  C:\Windows\System\zmamRvB.exe
  2⤵
  PID:12472
- C:\Windows\System\mHrBlhS.exe
  C:\Windows\System\mHrBlhS.exe
  2⤵
  PID:12492
- C:\Windows\System\wywBQgt.exe
  C:\Windows\System\wywBQgt.exe
  2⤵
  PID:12524
- C:\Windows\System\jCHxDWH.exe
  C:\Windows\System\jCHxDWH.exe
  2⤵
  PID:12544
- C:\Windows\System\OsywnWb.exe
  C:\Windows\System\OsywnWb.exe
  2⤵
  PID:12612
- C:\Windows\System\cbGKzQf.exe
  C:\Windows\System\cbGKzQf.exe
  2⤵
  PID:12640
- C:\Windows\System\WbOicap.exe
  C:\Windows\System\WbOicap.exe
  2⤵
  PID:12664
- C:\Windows\System\ugExyAa.exe
  C:\Windows\System\ugExyAa.exe
  2⤵
  PID:12752
- C:\Windows\System\Rnibpiq.exe
  C:\Windows\System\Rnibpiq.exe
  2⤵
  PID:12768
- C:\Windows\System\gHKwxxu.exe
  C:\Windows\System\gHKwxxu.exe
  2⤵
  PID:12800
- C:\Windows\System\lskWpwd.exe
  C:\Windows\System\lskWpwd.exe
  2⤵
  PID:12816
- C:\Windows\System\sgYEZLs.exe
  C:\Windows\System\sgYEZLs.exe
  2⤵
  PID:12836
- C:\Windows\System\AzNEXSg.exe
  C:\Windows\System\AzNEXSg.exe
  2⤵
  PID:12852
- C:\Windows\System\ZAMVClp.exe
  C:\Windows\System\ZAMVClp.exe
  2⤵
  PID:12912
- C:\Windows\System\CRkqZms.exe
  C:\Windows\System\CRkqZms.exe
  2⤵
  PID:12932
- C:\Windows\System\gzfZbmY.exe
  C:\Windows\System\gzfZbmY.exe
  2⤵
  PID:12948
- C:\Windows\System\cEngGmU.exe
  C:\Windows\System\cEngGmU.exe
  2⤵
  PID:12968
- C:\Windows\System\fCfkEfY.exe
  C:\Windows\System\fCfkEfY.exe
  2⤵
  PID:12984
- C:\Windows\System\fXOXfih.exe
  C:\Windows\System\fXOXfih.exe
  2⤵
  PID:13024
- C:\Windows\System\SyvwyGO.exe
  C:\Windows\System\SyvwyGO.exe
  2⤵
  PID:13068
- C:\Windows\System\VkPXEUE.exe
  C:\Windows\System\VkPXEUE.exe
  2⤵
  PID:13104
- C:\Windows\System\bAOHgpT.exe
  C:\Windows\System\bAOHgpT.exe
  2⤵
  PID:13120
- C:\Windows\System\OEZLHEk.exe
  C:\Windows\System\OEZLHEk.exe
  2⤵
  PID:13144
- C:\Windows\System\eXNtgsL.exe
  C:\Windows\System\eXNtgsL.exe
  2⤵
  PID:13160
- C:\Windows\System\JtjuOUs.exe
  C:\Windows\System\JtjuOUs.exe
  2⤵
  PID:13192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l4n2bj1u.cfb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ARkxThl.exe

Filesize
1007KB

MD5
e60df12647b0d5f6a9c41a0a8dd7d284

SHA1
16e8574dac26e8cecc2bf3bb8a15330b1a22f47c

SHA256
01c11770eb01fdbb3de1d5b73255f8aa44662d3613d6c9dec605fc9c6e6faaa2

SHA512
9f0ef16c21129bcaab69c3e670cbbdd14648dfc3330cf6457d6d6d79da9b653a0e952d5dd731a3dd133cee37542309d125a36a5c574b68215f3235090370c160

Download Submit
C:\Windows\System\ApILLlt.exe

Filesize
1012KB

MD5
236bd888535a8897a9584549fbc5c9c5

SHA1
57cdc85c3fbbdb0d98eb2e28491916b8df2d5d5a

SHA256
a892e186263fb3947b8624e6e74bca4bfe8efcc022e28288f0df7d9249a14371

SHA512
35f3eec638e6dbd95347fab18e2bfdf5632818853bed243758dec147b91b99afc36f35ff466e8dc1c4baba04902821cf8b1aa3abed5dbee8ce01aa29b5cdd16a

Download Submit
C:\Windows\System\BHQAoGc.exe

Filesize
1014KB

MD5
ae59199c53429bfeaf4d982a10a6f4b3

SHA1
5d98d64ed33bb5ee07350d7d38e33e35105240fb

SHA256
f2b85a8ffbf72f2b246ed8e369edb49d4ec255da5538d78314d409a237f08a5f

SHA512
3453a9879804339df1366c13c62cdc46291a35a9bfe2ff054ffc65b55e7c9cf71efd03807f7cc109280e12294f6e74bc4cba3dc3f2ffe47f758f5a3aa2b65660

Download Submit
C:\Windows\System\BWZpDim.exe

Filesize
1007KB

MD5
09ce253a84401b93332e7b72904853c6

SHA1
8415661d297ff98cedb289febb56ea9db73b60b3

SHA256
3efb8765d312e83f9e843dda827ad93dd8d533f901dc79388e7f251d31404c00

SHA512
d8078c55dd687362043e2da11b30cc32994965ca78ff8fc53a535af5086123047b23428256c72b61f61e883c8fefb45e296a8453c999eff2b7efc4fe49c37be0

Download Submit
C:\Windows\System\DqFRBNT.exe

Filesize
1008KB

MD5
46e07ee17b87f8d2868df8ec7cd21acf

SHA1
26492651acbe01afe014e0296ef62e77963befe8

SHA256
e1c3541a2d4f30054cc1eaece1b9a9b5ed120f039205c368ac57534933a90d2b

SHA512
541b5b907b450c18fb0b8f01ebf0a7045101f3483ac0a47e1cea0e932cb2858329513947fb810ed28bab91889856c6a24249d64fdf98dc28dbde2a65dc06f7c7

Download Submit
C:\Windows\System\EvhrOTf.exe

Filesize
1009KB

MD5
284ed74c859582a4e53a572cafc175f1

SHA1
cfbebda0039838155db00779a23c04adce49df05

SHA256
54f50b23220b242def7ceef16d7a188d7190476e930ef903d3393585fdb88ade

SHA512
4a40f86d8b02355354890762f0ce32f58b5a4236e34a6c29d485a7df128da1c23c0f20e014a4bf743b25420ebcbc549893e2cf68f7fa388c195cd8d80076195a

Download Submit
C:\Windows\System\HWeiIBr.exe

Filesize
1008KB

MD5
f8101d795f2c9ab9b6ee58ee4c69a974

SHA1
258a3aa32bf2045b89e30e33f639d2bee9d90920

SHA256
b895a85108460c9dcf8f839a2da45db128f8fcef16ed43bbecc23cbbf116216c

SHA512
db4f5dabe529fc675e02ac480933f9ae48329342ade3fd815f4dbd5db0cbdb3db545e74700774f2170d0b1dbc278551c9922da9c364e7c7fd1f7133db6dad459

Download Submit
C:\Windows\System\HoSedxO.exe

Filesize
1010KB

MD5
76ec6f06d5b7c54a2853f90c31998cb0

SHA1
d17ab8843ca9142b863bf7f77f2f1413afd8c611

SHA256
d14ec098dd972f11c2c49f847ec367126d9c3d2d57ca84d804fd106d3c77a0b5

SHA512
b377d5b885b0b7ad8921b6c46418d7e3ed5da6e31155926108bf44868b1b14e2230650985ad98f298c7b85d279f73b5c73a4ae00b8075e8b1c9333c3e4bba5aa

Download Submit
C:\Windows\System\IJNCYkC.exe

Filesize
1007KB

MD5
fbe119e2499e30f1968f14bb38faa632

SHA1
cd69c055ffb346e1ee798e668022038e26351da8

SHA256
5e9bca09eeb5fae0b1b49774a01b4786bf516c16fcc66b020169c6a4f4f08693

SHA512
3ea6c96760f8a551ee8a61d3316e72d79e32f8bcb5e5312582ae8f399c981f3350595fdc708c4c8535be442be3a511bd8187b953b6cb9526efc528971bd8068c

Download Submit
C:\Windows\System\JreKxfN.exe

Filesize
1009KB

MD5
bfff253c7f0bab3184d72ae9470af4cc

SHA1
9beec5acc2c8d43bcb9c45d3bd55ba4d41b2e565

SHA256
647e6961278f5e384abdc1703b55a6a49b748b1586562013256677ea8dfb1320

SHA512
1caafead5b89246e208d280ba85935f2467396e53b8b07697f235e278d66bc996804665d8add3063e962445035d8573bce367c0db67502ac86ed58517af5debb

Download Submit
C:\Windows\System\KIFNkBK.exe

Filesize
1010KB

MD5
d1f27ca5d82ca66b54fbefb47f322512

SHA1
5d47fbc6c496ff9a564da3b67f592409ce81f21b

SHA256
db8a647c925124bc7f74ba4ab183b24c041377513587dc8713030eb3ad8666fb

SHA512
157335a9f7079ee180c8a46e227529c00e02f5b8f6c071b62a67fcb8e12dd1680454ea80ee61e1c6835a2f4e4bd2bd5227a2e665613dd1e63d0c9cddf2d06e1c

Download Submit
C:\Windows\System\LVFZCId.exe

Filesize
1011KB

MD5
737dace8c21d8f1a9da60d0d401d5eb0

SHA1
8d2bbf1fc7465455dc52844f2ab84d6e36b81456

SHA256
d7265aa4244767e68e67d05851c103b72a5b85611531970db3a3d2b945ad8434

SHA512
a301da8636abde28cc5eb155297fa004b1c21b669f44f9d9a4c5d566eacc205931ef9a20565aca06371e6925345e1f4cd3bdb7d87d3fbca60752c70400fc4c7c

Download Submit
C:\Windows\System\LfBOuhx.exe

Filesize
1013KB

MD5
0f8eb582c884b6ad0bce7b2f21221765

SHA1
0caa665638146ec5a194b7af3b7cdf3a95c9098b

SHA256
cf45c35a298abc0b560b6bf2b63137f620995b32e92f23f6b3bf664e7f4ea052

SHA512
7ce3ea0d8993b56335fde4efcc51fa29e4e6fcd2b35d207a22f2a39bea77e6e2d7069b506622f320b9bd729b95c670c063549b1683f80be955f55b8b286ba9f8

Download Submit
C:\Windows\System\QKxkOwR.exe

Filesize
1009KB

MD5
1e8c3232c618b4604dc81812c2bee1b3

SHA1
f1a19cd31e50d8427e98789b4fdea6b9584b4767

SHA256
d10825658a0289323b96c6d921660c6494ac2a62c65f81c5e57bf3112ddc767f

SHA512
86464ef143161b6950cbec9a2aeb58b2e5c5cc86a890d93bfe14d4e8539fceb711fe026c8860421efbdbebb8f28acff1c86e525ac586c28762b2764cd51c36da

Download Submit
C:\Windows\System\QQKCQmb.exe

Filesize
1011KB

MD5
b86c9dd176e2acbe1cf535ef64651071

SHA1
da66e57fc309fb067e392c2d960e74438e2dcee6

SHA256
df8f94148092c2232c58c873ff3d5f45cea8542e5a45c85a3e7fbac859d897af

SHA512
1ccad02ee3fbf327d92dd945b3e9a324485ef8d76555235fc23268000e5841a0760c5692c0ee805476c7d2e4f5325dd7cf238bf41e6d01675fe4de543bb4e3fc

Download Submit
C:\Windows\System\TiWtjxk.exe

Filesize
1012KB

MD5
7522f693cca3d5879fc6d4c81838a17c

SHA1
f689179e8d56929a22aaeff65b3f3eab7405cc25

SHA256
517b7bf676d8089e05f66c8c47b4c1b1c261ca14495497ac8e93ab2793122420

SHA512
0a9f5c8081a49eac46b6cecf1a42ed03030fe0b28b0c589bd01a2414c419ee61f3b74bdd848f25096958600e532c0e0b5a1458b3c5aae7720437838c5f79b971

Download Submit
C:\Windows\System\TuPlNZG.exe

Filesize
1012KB

MD5
e09479094034ef0971419e375a49954a

SHA1
efc27e57a1193982cb48695fc25926d96ad1b2ba

SHA256
ab97f328ff02ac8be989555e23544223c9057d2ae1f6bce7261755ec7b552706

SHA512
6fedcf3e2ac2c79deb037f20fd361f13942076c145a4e1289d840a48c0aa963849a98f468d279ca44f9b928115e92565a906133de2abb847a210a388c73b48f4

Download Submit
C:\Windows\System\TzNFGzz.exe

Filesize
1010KB

MD5
ad53c1a8943653be313b3d2c1f083ae8

SHA1
03e47a9adfdbe6de9e1c7c9b3b34716cd00fb7d8

SHA256
289cbe76630471613059b4c413a5f1e0a990946f9acd1ddfffd9cc85512d5d01

SHA512
e7434da98ed5493543e73c51aa3861211eed0b793f5b1fd48674f187a7c2cd92b4963ddb2b4ff8d4695ebd90c4f1a0c52006a64b1c9120987c4d7502a2d147a2

Download Submit
C:\Windows\System\TzqzTFA.exe

Filesize
1012KB

MD5
4565117659982fdc0840517c269698c7

SHA1
6772de0c42722bf5bf6ff786baa3ec0e8d9cc1fe

SHA256
7635924e13c03e51bcca37bd441eb82748f73a9d13f5aedf0bd6bbb62f00ebb1

SHA512
083428bed80958e4b521f8044fdae25f86fb1169debd3070351c210476b402ff305b2dc9464f6ff9ddb0553de3b07fbf0a6dea9eb8454e3e39c367a51c703067

Download Submit
C:\Windows\System\VxlJNCf.exe

Filesize
1009KB

MD5
536c4803e4faf26f070f3668844f59d1

SHA1
a51b2974934664d31dc9b097b62e46599337d002

SHA256
f3e3f132e87e542b93aa4ceef4b24efb086ee26a1775a5aac5e7db7579d02567

SHA512
c29f498b0f2684d78cb09473ec2a34466ba1ecf9f33226067d3eaaa2f63595c380b854db653dea9de6431fea34714cdc4a773ba2cd39eac3743a18da5be03e04

Download Submit
C:\Windows\System\WDMmNAb.exe

Filesize
1008KB

MD5
65b8f1c3a08fa4658b1d094225c4b974

SHA1
c8f278eb31b5add27fe11f2372d1a699eddd78cc

SHA256
49f481af93d75f92e0b2f2ab99663053f77ec32b73c4088e6539b788cf413701

SHA512
6ec17cff9566db4e19240001ee912abec041d462e589ce81de43517febe04fc2001a30bc9345702f859b45bf6c9d7109ceec3fe8409ebd21c99f82762aaa675b

Download Submit
C:\Windows\System\WjHQSQm.exe

Filesize
1008KB

MD5
cfddb649d79c103dcff5dff17fcad75d

SHA1
2ca5b2977b9f113ee465dde5cd4a94eedacb6834

SHA256
ead0b55ace8d7689325e686e1f93442ae827403cec521c287ec7b43826c8c85c

SHA512
cf1f046f153f906381d8cf4bbe1e055ee9b925e3fb100d932b0e2a493ef7af051abacd0e37a32a1aaa7f2aaf879adbdb850cfd54e91d430ffde8e303445608d9

Download Submit
C:\Windows\System\XQYrIAJ.exe

Filesize
1013KB

MD5
f54d5f56b5f37e804d4823fd9c9ef9ac

SHA1
4d95156c180d5e5a5b1af3b958d2f6945f5b0a12

SHA256
5e33615426e388848b7695a65740b8aa6c24c5057f42bf944db68967db243fad

SHA512
b4e20eb7d09123e418512925f6e77df1832640bdb980d538f8b945283a9aae0c6b276391ed8aabf7aade3e00e2abca326b67d78b6881fc919f8c5960be261fc3

Download Submit
C:\Windows\System\Zcvcxim.exe

Filesize
1007KB

MD5
d507ee7544d8f6507f63969080b02559

SHA1
1b88ddf652633917f65d588f5fe1119b74a929e0

SHA256
7c585b43000fbc94ca65ab14a6efa069157ee7633749746d3709a453d5dcd13e

SHA512
0bfb3b5f0c44b68da35730c8c8beba0807933d063cc778ce308674a8d8b6c2062a61c9939fff9b4a2d2361917b7c7351339e1c84ee27ce628d99becd37c83213

Download Submit
C:\Windows\System\bUZEyys.exe

Filesize
1011KB

MD5
0c29f0b311165c5a475c4354686b235f

SHA1
bef22a884143c1ed0d660e07036509d2c52e9f52

SHA256
e73e0fd141083c3d95e2376e3714d2da9973b1abaf46b4effd900b67e3f76285

SHA512
7c20c48badfbc74f2f6989a67555c00c675b7ab10862f34ed7f5d91fa3c2ed5cbaaaed531022cea45bb852d69940232b07959278a9342af37f02bb566a42d9b0

Download Submit
C:\Windows\System\boSTGzo.exe

Filesize
1013KB

MD5
f14e57c49160bd6cebab8c84f0598eeb

SHA1
99ef85e3b1d52291e446bcc0ff620be4855c261b

SHA256
4d46fe3836a8c6cc8760fea2fcdac9543af6c4ae5239128b0b06d2ef57458a6a

SHA512
310f03650b515e8e1e674b4e5dbb02f732e55327ee32eb0bf2ba177b46d12edff4aa3460eea7357de190ed21dd5225177f7d7b95258e982759a35bf0cb41d087

Download Submit
C:\Windows\System\ecqnfTg.exe

Filesize
1014KB

MD5
37cbd0075aa8cbaac5b1595776246705

SHA1
00a52208db83e032443b817b101b0fee1b5d50ee

SHA256
e649aef209371bb7b057994b044887e2a72336d60f064fe1e7c28b2433a5b608

SHA512
7aaaf27e37507bf1109f4e1bc693bd8791bcb6067b443b2521e10728222ec1cffc6496d4b87595d31cb8887f6500dda667bdcd06cd64e9ca643fed1d06da2d9b

Download Submit
C:\Windows\System\khKbwLG.exe

Filesize
1011KB

MD5
2b835b270aaf7ed58e59b79a18c988b1

SHA1
e5ea7ee9d710a37be6bfcfc1f0da1a6fd92cde6f

SHA256
98819169483263ab99d56a5a338d2203b8cec2b36c6d5377b34b8d980bfe986f

SHA512
fc800e7eb95e267c84b6d0cf8d669eef6f5cf82d56a51a510ca2cb158acb22ea3f82e623fce25e9e1ce0346433b54da5ae772f5bfe008b4435b54dde68f72aca

Download Submit
C:\Windows\System\mLGZtcw.exe

Filesize
1014KB

MD5
4b899d8900883e6b1018f9c3b3352580

SHA1
ab2ea7c22af39829d531e511364bddd94c1961e3

SHA256
ff6c1eea3e9c64550c1c9a17d8f79a80e2fbf5f72917229648ce3d83d4f613bb

SHA512
1ba8b7dd92bd085bf4f5a6bcaa44019b64a1dc7479965f35820c87790de4b998537404dfab6fea107d12ee7445655bcb59e3c1e4521464c80d9a1f86290efdfa

Download Submit
C:\Windows\System\mcfAYtN.exe

Filesize
1006KB

MD5
553f754f5c614ca25528774801980b69

SHA1
a3ae6bf5c44ce49034667aec17c79b72077a67b1

SHA256
fff7a9838d147699a1abc9479c880f66449099c34046f8d8a34bc5bd4a34d111

SHA512
f1e32fefda3effa3f8d6ef5b97dc5a0a4fbb172aa42885418c72fbd990d210e9dae4751509cdbcdd732d8c9e42ad78e60ae40a37ff797c8b6e5807a25b8c0be0

Download Submit
C:\Windows\System\mozauvS.exe

Filesize
1014KB

MD5
0f6039dce791e07d2b15f99f05067ab1

SHA1
3fc44468ef6dd482ffbf8e885435c73159109c20

SHA256
ec44d9b29aaeb6caae34ad0dde22bec6b81cb0dd28cf6b1657cef3d72c42f38e

SHA512
6a965e8426f263740279d9d73431011ceff2cdd33afc52e3a0a8cf16bc13fc3c3c87fb5372acd5ac23af750ffb4bd345ebcd580fed84af48cb1ee00109cfb3fc

Download Submit
C:\Windows\System\rwjKGVv.exe

Filesize
1013KB

MD5
27e0b658259041e6e7917c9eb856b328

SHA1
6f5c92c323689c936750f57186e6930ebb865c27

SHA256
dac8a2acde08cf8cf7dffff028ad4139c57f34d39fb1129890df816e56007052

SHA512
cb7a24042659c2beb2232073cea6c2bee40b44f4b03121326781c6520192adf04ed1a417f5cb86ace0434daa060d2037bd7e182ab0c14cea0d4d440d201fd5b7

Download Submit
C:\Windows\System\xSSPLWn.exe

Filesize
1010KB

MD5
ea6e8fce27520f771a403fb665b83a99

SHA1
83738490c28fa8c98e3369ed2ae95bcb7b960865

SHA256
9ba30ef3f715b34db2184b026016c0eea96dfedc3248c5815b637dc4473ba0db

SHA512
f08e328e21395ea12f46d68ae2ab14e760d878f94d02480b55acc3cb696c4201ae953d9f5861a4cf38aacc33a72aeacaeabf5fe9b4281744973d73394b9dee05

Download Submit
memory/400-213-0x00007FF681640000-0x00007FF681A32000-memory.dmp

Filesize
3.9MB

Download
memory/400-2517-0x00007FF681640000-0x00007FF681A32000-memory.dmp

Filesize
3.9MB

Download
memory/756-201-0x00007FF7541D0000-0x00007FF7545C2000-memory.dmp

Filesize
3.9MB

Download
memory/756-2505-0x00007FF7541D0000-0x00007FF7545C2000-memory.dmp

Filesize
3.9MB

Download
memory/984-118-0x00007FF7DF440000-0x00007FF7DF832000-memory.dmp

Filesize
3.9MB

Download
memory/984-2489-0x00007FF7DF440000-0x00007FF7DF832000-memory.dmp

Filesize
3.9MB

Download
memory/1088-136-0x00007FF6E2C00000-0x00007FF6E2FF2000-memory.dmp

Filesize
3.9MB

Download
memory/1088-2491-0x00007FF6E2C00000-0x00007FF6E2FF2000-memory.dmp

Filesize
3.9MB

Download
memory/1500-114-0x00007FF6B83A0000-0x00007FF6B8792000-memory.dmp

Filesize
3.9MB

Download
memory/1500-2477-0x00007FF6B83A0000-0x00007FF6B8792000-memory.dmp

Filesize
3.9MB

Download
memory/1512-2485-0x00007FF62B050000-0x00007FF62B442000-memory.dmp

Filesize
3.9MB

Download
memory/1512-127-0x00007FF62B050000-0x00007FF62B442000-memory.dmp

Filesize
3.9MB

Download
memory/1548-0-0x00007FF7C5890000-0x00007FF7C5C82000-memory.dmp

Filesize
3.9MB

Download
memory/1548-1-0x00000253BDA70000-0x00000253BDA80000-memory.dmp

Filesize
64KB

Download
memory/1924-2509-0x00007FF656E40000-0x00007FF657232000-memory.dmp

Filesize
3.9MB

Download
memory/1924-168-0x00007FF656E40000-0x00007FF657232000-memory.dmp

Filesize
3.9MB

Download
memory/2156-2501-0x00007FF745610000-0x00007FF745A02000-memory.dmp

Filesize
3.9MB

Download
memory/2156-146-0x00007FF745610000-0x00007FF745A02000-memory.dmp

Filesize
3.9MB

Download
memory/2308-2459-0x00007FF76C5B0000-0x00007FF76C9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-2473-0x00007FF76C5B0000-0x00007FF76C9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-16-0x00007FF76C5B0000-0x00007FF76C9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-2503-0x00007FF7C3BA0000-0x00007FF7C3F92000-memory.dmp

Filesize
3.9MB

Download
memory/2432-156-0x00007FF7C3BA0000-0x00007FF7C3F92000-memory.dmp

Filesize
3.9MB

Download
memory/2844-2499-0x00007FF73D630000-0x00007FF73DA22000-memory.dmp

Filesize
3.9MB

Download
memory/2844-150-0x00007FF73D630000-0x00007FF73DA22000-memory.dmp

Filesize
3.9MB

Download
memory/2852-174-0x00007FF735470000-0x00007FF735862000-memory.dmp

Filesize
3.9MB

Download
memory/2852-2511-0x00007FF735470000-0x00007FF735862000-memory.dmp

Filesize
3.9MB

Download
memory/2940-192-0x00007FF63D570000-0x00007FF63D962000-memory.dmp

Filesize
3.9MB

Download
memory/2940-2487-0x00007FF63D570000-0x00007FF63D962000-memory.dmp

Filesize
3.9MB

Download
memory/2972-180-0x00007FF78E2F0000-0x00007FF78E6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-2475-0x00007FF78E2F0000-0x00007FF78E6E2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-48-0x00007FFA53DD0000-0x00007FFA54891000-memory.dmp

Filesize
10.8MB

Download
memory/3528-86-0x00007FFA53DD0000-0x00007FFA54891000-memory.dmp

Filesize
10.8MB

Download
memory/3528-9-0x00007FFA53DD3000-0x00007FFA53DD5000-memory.dmp

Filesize
8KB

Download
memory/3528-75-0x00000126F5F10000-0x00000126F5F32000-memory.dmp

Filesize
136KB

Download
memory/3712-117-0x00007FF7B6A30000-0x00007FF7B6E22000-memory.dmp

Filesize
3.9MB

Download
memory/3712-2483-0x00007FF7B6A30000-0x00007FF7B6E22000-memory.dmp

Filesize
3.9MB

Download
memory/3828-2515-0x00007FF65D270000-0x00007FF65D662000-memory.dmp

Filesize
3.9MB

Download
memory/3828-162-0x00007FF65D270000-0x00007FF65D662000-memory.dmp

Filesize
3.9MB

Download
memory/3852-209-0x00007FF69AF80000-0x00007FF69B372000-memory.dmp

Filesize
3.9MB

Download
memory/3852-2513-0x00007FF69AF80000-0x00007FF69B372000-memory.dmp

Filesize
3.9MB

Download
memory/4196-217-0x00007FF7986E0000-0x00007FF798AD2000-memory.dmp

Filesize
3.9MB

Download
memory/4196-2519-0x00007FF7986E0000-0x00007FF798AD2000-memory.dmp

Filesize
3.9MB

Download
memory/4344-2493-0x00007FF7E4FE0000-0x00007FF7E53D2000-memory.dmp

Filesize
3.9MB

Download
memory/4344-132-0x00007FF7E4FE0000-0x00007FF7E53D2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-2497-0x00007FF7422E0000-0x00007FF7426D2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-142-0x00007FF7422E0000-0x00007FF7426D2000-memory.dmp

Filesize
3.9MB

Download
memory/4688-107-0x00007FF726BE0000-0x00007FF726FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4688-2479-0x00007FF726BE0000-0x00007FF726FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-2481-0x00007FF7490C0000-0x00007FF7494B2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-186-0x00007FF7490C0000-0x00007FF7494B2000-memory.dmp

Filesize
3.9MB

Download
memory/4924-137-0x00007FF7BABF0000-0x00007FF7BAFE2000-memory.dmp

Filesize
3.9MB

Download
memory/4924-2495-0x00007FF7BABF0000-0x00007FF7BAFE2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-2507-0x00007FF6B49C0000-0x00007FF6B4DB2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-205-0x00007FF6B49C0000-0x00007FF6B4DB2000-memory.dmp

Filesize
3.9MB

Download