xmrig | 3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
Size

3.9MB
MD5

c448f464ff2d4493a627f791b7542fd2
SHA1

2720fbb7d8625b5598d5ec3b714ad90645f21e92
SHA256

3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85
SHA512

2079c215baa8600f3775bca03916d561566c71f3475554d8b1538068ca6362425533bae92a35608f4d494c6c8c485f52dc46fc8f416f0bcedf610a60b731317e
SSDEEP

98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWt:SbBeSFkp

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5008-0-0x00007FF6EBA10000-0x00007FF6EBE06000-memory.dmp	xmrig
behavioral2/files/0x00080000000235fb-9.dat	xmrig
behavioral2/files/0x00080000000235fe-21.dat	xmrig
behavioral2/files/0x00070000000235ff-25.dat	xmrig
behavioral2/files/0x0007000000023600-31.dat	xmrig
behavioral2/files/0x0007000000023603-38.dat	xmrig
behavioral2/files/0x0007000000023604-45.dat	xmrig
behavioral2/files/0x0007000000023602-62.dat	xmrig
behavioral2/files/0x000700000002360a-70.dat	xmrig
behavioral2/files/0x0007000000023605-79.dat	xmrig
behavioral2/files/0x0008000000023608-93.dat	xmrig
behavioral2/files/0x0008000000023609-106.dat	xmrig
behavioral2/files/0x000700000002360e-118.dat	xmrig
behavioral2/memory/768-122-0x00007FF618F40000-0x00007FF619336000-memory.dmp	xmrig
behavioral2/memory/2408-125-0x00007FF6E8C10000-0x00007FF6E9006000-memory.dmp	xmrig
behavioral2/memory/2916-129-0x00007FF6AAA40000-0x00007FF6AAE36000-memory.dmp	xmrig
behavioral2/memory/540-133-0x00007FF672AA0000-0x00007FF672E96000-memory.dmp	xmrig
behavioral2/memory/3784-135-0x00007FF6C8790000-0x00007FF6C8B86000-memory.dmp	xmrig
behavioral2/memory/2208-134-0x00007FF79D1A0000-0x00007FF79D596000-memory.dmp	xmrig
behavioral2/memory/3852-132-0x00007FF7E3960000-0x00007FF7E3D56000-memory.dmp	xmrig
behavioral2/memory/3512-131-0x00007FF7BC080000-0x00007FF7BC476000-memory.dmp	xmrig
behavioral2/memory/2080-130-0x00007FF7DA590000-0x00007FF7DA986000-memory.dmp	xmrig
behavioral2/memory/4816-128-0x00007FF61A8F0000-0x00007FF61ACE6000-memory.dmp	xmrig
behavioral2/memory/1268-127-0x00007FF733380000-0x00007FF733776000-memory.dmp	xmrig
behavioral2/memory/4668-126-0x00007FF60A250000-0x00007FF60A646000-memory.dmp	xmrig
behavioral2/memory/2312-124-0x00007FF73B140000-0x00007FF73B536000-memory.dmp	xmrig
behavioral2/memory/3828-123-0x00007FF625240000-0x00007FF625636000-memory.dmp	xmrig
behavioral2/memory/1440-121-0x00007FF710BA0000-0x00007FF710F96000-memory.dmp	xmrig
behavioral2/memory/1612-120-0x00007FF695360000-0x00007FF695756000-memory.dmp	xmrig
behavioral2/files/0x00080000000235fc-116.dat	xmrig
behavioral2/files/0x000700000002360d-114.dat	xmrig
behavioral2/memory/2984-113-0x00007FF78E560000-0x00007FF78E956000-memory.dmp	xmrig
behavioral2/memory/3156-112-0x00007FF789B80000-0x00007FF789F76000-memory.dmp	xmrig
behavioral2/files/0x000700000002360c-108.dat	xmrig
behavioral2/memory/1112-102-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp	xmrig
behavioral2/memory/4736-98-0x00007FF64A790000-0x00007FF64AB86000-memory.dmp	xmrig
behavioral2/files/0x000700000002360b-90.dat	xmrig
behavioral2/files/0x0007000000023606-76.dat	xmrig
behavioral2/files/0x0007000000023607-67.dat	xmrig
behavioral2/files/0x0007000000023601-41.dat	xmrig
behavioral2/files/0x0007000000023384-12.dat	xmrig
behavioral2/files/0x000700000002360f-250.dat	xmrig
behavioral2/memory/4988-290-0x00007FF628230000-0x00007FF628626000-memory.dmp	xmrig
behavioral2/files/0x0007000000023652-371.dat	xmrig
behavioral2/files/0x000700000002365b-391.dat	xmrig
behavioral2/files/0x0007000000023656-388.dat	xmrig
behavioral2/files/0x0007000000023650-367.dat	xmrig
behavioral2/files/0x000700000002364c-358.dat	xmrig
behavioral2/files/0x0007000000023649-348.dat	xmrig
behavioral2/files/0x0007000000023648-335.dat	xmrig
behavioral2/memory/3300-331-0x00007FF692A00000-0x00007FF692DF6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023643-327.dat	xmrig
behavioral2/files/0x0007000000023645-316.dat	xmrig
behavioral2/files/0x000700000002363e-312.dat	xmrig
behavioral2/memory/4424-310-0x00007FF71D5B0000-0x00007FF71D9A6000-memory.dmp	xmrig
behavioral2/files/0x000700000002363a-300.dat	xmrig
behavioral2/memory/1416-283-0x00007FF6D59B0000-0x00007FF6D5DA6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023636-281.dat	xmrig
behavioral2/memory/5008-1291-0x00007FF6EBA10000-0x00007FF6EBE06000-memory.dmp	xmrig
behavioral2/memory/4424-2315-0x00007FF71D5B0000-0x00007FF71D9A6000-memory.dmp	xmrig
behavioral2/memory/4736-2316-0x00007FF64A790000-0x00007FF64AB86000-memory.dmp	xmrig
behavioral2/memory/3156-2318-0x00007FF789B80000-0x00007FF789F76000-memory.dmp	xmrig
behavioral2/memory/3852-2317-0x00007FF7E3960000-0x00007FF7E3D56000-memory.dmp	xmrig
behavioral2/memory/1112-2319-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
3	696	powershell.exe
5	696	powershell.exe
7	696	powershell.exe
8	696	powershell.exe
10	696	powershell.exe
15	696	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
696	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4736	dvDIWRw.exe
3852	qanZgur.exe
3156	lwQsUBp.exe
1112	hUsFKak.exe
2984	SbLUfAo.exe
1612	lbUmqhs.exe
1440	qjFKxUQ.exe
768	QtiQeGN.exe
540	XLSkDLj.exe
3828	aRPRBwy.exe
2312	ZymAWqd.exe
2408	bSTpRug.exe
4668	KWNohEy.exe
1268	apgFgTH.exe
2208	nyMTvxJ.exe
4816	rqylwJa.exe
2916	dwyYLJW.exe
3784	PrqJdLI.exe
2080	LWPsXCq.exe
3512	kQdgNVs.exe
1416	dFXWveA.exe
4988	pFfwvkw.exe
4424	tCTqrjz.exe
3300	jthYOAD.exe
1696	mrDAdgF.exe
4932	odVhKtR.exe
2376	WsXTBtU.exe
3236	bDQJpKU.exe
4380	EaNKAim.exe
2092	hUDsOox.exe
4612	PCLXABz.exe
1444	PfFnmLD.exe
4952	ebEJLSu.exe
3608	HlOUTDT.exe
2448	jUjJllD.exe
3720	MhbeeJj.exe
2480	wvAQWyg.exe
4676	sDrOFMz.exe
3528	CsqaAeB.exe
936	QHgIDdi.exe
1248	coWsPgY.exe
3452	rGswGFG.exe
4500	XgtVVRw.exe
5024	ksFMazL.exe
4084	qoWCXkD.exe
4520	DBQPgOQ.exe
4268	KOGnghL.exe
4764	VMIdZEW.exe
3044	KKrDDFQ.exe
4740	IVEtaYh.exe
524	ymfTyDx.exe
1244	toRPlIw.exe
3776	Mvqfpjh.exe
3396	oqpqRyn.exe
1064	Qdurwpe.exe
4708	qpqVRDt.exe
3180	pcDkQbS.exe
1264	ZSeOFWv.exe
4648	uBpHzTv.exe
3524	isXNaMH.exe
1932	EeREYWn.exe
3604	iTNQoyI.exe
4348	ucANEYZ.exe
3880	mzMgZSk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5008-0-0x00007FF6EBA10000-0x00007FF6EBE06000-memory.dmp	upx
behavioral2/files/0x00080000000235fb-9.dat	upx
behavioral2/files/0x00080000000235fe-21.dat	upx
behavioral2/files/0x00070000000235ff-25.dat	upx
behavioral2/files/0x0007000000023600-31.dat	upx
behavioral2/files/0x0007000000023603-38.dat	upx
behavioral2/files/0x0007000000023604-45.dat	upx
behavioral2/files/0x0007000000023602-62.dat	upx
behavioral2/files/0x000700000002360a-70.dat	upx
behavioral2/files/0x0007000000023605-79.dat	upx
behavioral2/files/0x0008000000023608-93.dat	upx
behavioral2/files/0x0008000000023609-106.dat	upx
behavioral2/files/0x000700000002360e-118.dat	upx
behavioral2/memory/768-122-0x00007FF618F40000-0x00007FF619336000-memory.dmp	upx
behavioral2/memory/2408-125-0x00007FF6E8C10000-0x00007FF6E9006000-memory.dmp	upx
behavioral2/memory/2916-129-0x00007FF6AAA40000-0x00007FF6AAE36000-memory.dmp	upx
behavioral2/memory/540-133-0x00007FF672AA0000-0x00007FF672E96000-memory.dmp	upx
behavioral2/memory/3784-135-0x00007FF6C8790000-0x00007FF6C8B86000-memory.dmp	upx
behavioral2/memory/2208-134-0x00007FF79D1A0000-0x00007FF79D596000-memory.dmp	upx
behavioral2/memory/3852-132-0x00007FF7E3960000-0x00007FF7E3D56000-memory.dmp	upx
behavioral2/memory/3512-131-0x00007FF7BC080000-0x00007FF7BC476000-memory.dmp	upx
behavioral2/memory/2080-130-0x00007FF7DA590000-0x00007FF7DA986000-memory.dmp	upx
behavioral2/memory/4816-128-0x00007FF61A8F0000-0x00007FF61ACE6000-memory.dmp	upx
behavioral2/memory/1268-127-0x00007FF733380000-0x00007FF733776000-memory.dmp	upx
behavioral2/memory/4668-126-0x00007FF60A250000-0x00007FF60A646000-memory.dmp	upx
behavioral2/memory/2312-124-0x00007FF73B140000-0x00007FF73B536000-memory.dmp	upx
behavioral2/memory/3828-123-0x00007FF625240000-0x00007FF625636000-memory.dmp	upx
behavioral2/memory/1440-121-0x00007FF710BA0000-0x00007FF710F96000-memory.dmp	upx
behavioral2/memory/1612-120-0x00007FF695360000-0x00007FF695756000-memory.dmp	upx
behavioral2/files/0x00080000000235fc-116.dat	upx
behavioral2/files/0x000700000002360d-114.dat	upx
behavioral2/memory/2984-113-0x00007FF78E560000-0x00007FF78E956000-memory.dmp	upx
behavioral2/memory/3156-112-0x00007FF789B80000-0x00007FF789F76000-memory.dmp	upx
behavioral2/files/0x000700000002360c-108.dat	upx
behavioral2/memory/1112-102-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp	upx
behavioral2/memory/4736-98-0x00007FF64A790000-0x00007FF64AB86000-memory.dmp	upx
behavioral2/files/0x000700000002360b-90.dat	upx
behavioral2/files/0x0007000000023606-76.dat	upx
behavioral2/files/0x0007000000023607-67.dat	upx
behavioral2/files/0x0007000000023601-41.dat	upx
behavioral2/files/0x0007000000023384-12.dat	upx
behavioral2/files/0x000700000002360f-250.dat	upx
behavioral2/memory/4988-290-0x00007FF628230000-0x00007FF628626000-memory.dmp	upx
behavioral2/files/0x0007000000023652-371.dat	upx
behavioral2/files/0x000700000002365b-391.dat	upx
behavioral2/files/0x0007000000023656-388.dat	upx
behavioral2/files/0x0007000000023650-367.dat	upx
behavioral2/files/0x000700000002364c-358.dat	upx
behavioral2/files/0x0007000000023649-348.dat	upx
behavioral2/files/0x0007000000023648-335.dat	upx
behavioral2/memory/3300-331-0x00007FF692A00000-0x00007FF692DF6000-memory.dmp	upx
behavioral2/files/0x0007000000023643-327.dat	upx
behavioral2/files/0x0007000000023645-316.dat	upx
behavioral2/files/0x000700000002363e-312.dat	upx
behavioral2/memory/4424-310-0x00007FF71D5B0000-0x00007FF71D9A6000-memory.dmp	upx
behavioral2/files/0x000700000002363a-300.dat	upx
behavioral2/memory/1416-283-0x00007FF6D59B0000-0x00007FF6D5DA6000-memory.dmp	upx
behavioral2/files/0x0007000000023636-281.dat	upx
behavioral2/memory/5008-1291-0x00007FF6EBA10000-0x00007FF6EBE06000-memory.dmp	upx
behavioral2/memory/4424-2315-0x00007FF71D5B0000-0x00007FF71D9A6000-memory.dmp	upx
behavioral2/memory/4736-2316-0x00007FF64A790000-0x00007FF64AB86000-memory.dmp	upx
behavioral2/memory/3156-2318-0x00007FF789B80000-0x00007FF789F76000-memory.dmp	upx
behavioral2/memory/3852-2317-0x00007FF7E3960000-0x00007FF7E3D56000-memory.dmp	upx
behavioral2/memory/1112-2319-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sZcFrkt.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\InhNroG.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\qCpgHvG.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\TMAioAK.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\ebEJLSu.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\JBiJLmc.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\tQoNChs.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\oBTEWNM.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\NFsHmTb.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\MhbeeJj.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\EOURXpZ.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\PMTzeel.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\iAaSVzs.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\gixCgWu.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\XifWKsm.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\BuLSpjK.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\midEIfp.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\bSTpRug.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\DBQPgOQ.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\ZXtLjnA.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\ezXSiJF.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\tCTqrjz.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\UkMBXxP.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\PyietGL.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\csKrAem.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\AFBKDMn.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\LBcECyA.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\IPyrexf.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\sPcgjjq.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\auuyYOV.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\wojLPBH.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\QGvAcTX.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\sSrpdtO.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\LzATzSp.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\iFqNKOQ.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\HzGZZhW.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\lbUmqhs.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\FLqxuDY.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\KMCxwjX.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\LqbauSo.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\CLrBpSx.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\TKMTBKl.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\VIvkVkL.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\SxNIAJm.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\CsqaAeB.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\yGbyriT.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\WwRUdxH.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\fBifmRM.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\QNaCTsO.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\LYOkYTG.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\FpvcVYO.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\QDIdaCs.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\QADtWth.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\FHPfeDB.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\sAeTRQR.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\bXrKsHW.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\rcpLrLB.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\SeWFkte.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\luqnqhW.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\QHiMiiT.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\TtjBWkp.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\aRPRBwy.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\XJopBJP.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
File created	C:\Windows\System\nLxvvcp.exe	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
696	powershell.exe
696	powershell.exe
696	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
Token: SeLockMemoryPrivilege	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
Token: SeDebugPrivilege	696	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 696	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	82
PID 5008 wrote to memory of 696	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	82
PID 5008 wrote to memory of 4736	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	83
PID 5008 wrote to memory of 4736	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	83
PID 5008 wrote to memory of 3852	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	84
PID 5008 wrote to memory of 3852	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	84
PID 5008 wrote to memory of 3156	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	85
PID 5008 wrote to memory of 3156	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	85
PID 5008 wrote to memory of 1112	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	86
PID 5008 wrote to memory of 1112	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	86
PID 5008 wrote to memory of 2984	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	87
PID 5008 wrote to memory of 2984	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	87
PID 5008 wrote to memory of 1612	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	88
PID 5008 wrote to memory of 1612	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	88
PID 5008 wrote to memory of 1440	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	89
PID 5008 wrote to memory of 1440	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	89
PID 5008 wrote to memory of 768	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	90
PID 5008 wrote to memory of 768	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	90
PID 5008 wrote to memory of 540	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	91
PID 5008 wrote to memory of 540	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	91
PID 5008 wrote to memory of 2312	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	92
PID 5008 wrote to memory of 2312	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	92
PID 5008 wrote to memory of 3828	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	93
PID 5008 wrote to memory of 3828	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	93
PID 5008 wrote to memory of 2408	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	94
PID 5008 wrote to memory of 2408	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	94
PID 5008 wrote to memory of 4668	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	95
PID 5008 wrote to memory of 4668	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	95
PID 5008 wrote to memory of 1268	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	96
PID 5008 wrote to memory of 1268	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	96
PID 5008 wrote to memory of 2208	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	97
PID 5008 wrote to memory of 2208	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	97
PID 5008 wrote to memory of 4816	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	98
PID 5008 wrote to memory of 4816	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	98
PID 5008 wrote to memory of 2916	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	99
PID 5008 wrote to memory of 2916	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	99
PID 5008 wrote to memory of 3784	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	100
PID 5008 wrote to memory of 3784	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	100
PID 5008 wrote to memory of 2080	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	101
PID 5008 wrote to memory of 2080	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	101
PID 5008 wrote to memory of 3512	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	102
PID 5008 wrote to memory of 3512	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	102
PID 5008 wrote to memory of 1416	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	103
PID 5008 wrote to memory of 1416	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	103
PID 5008 wrote to memory of 4988	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	105
PID 5008 wrote to memory of 4988	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	105
PID 5008 wrote to memory of 4424	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	106
PID 5008 wrote to memory of 4424	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	106
PID 5008 wrote to memory of 3300	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	107
PID 5008 wrote to memory of 3300	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	107
PID 5008 wrote to memory of 1696	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	108
PID 5008 wrote to memory of 1696	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	108
PID 5008 wrote to memory of 4932	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	109
PID 5008 wrote to memory of 4932	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	109
PID 5008 wrote to memory of 2376	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	110
PID 5008 wrote to memory of 2376	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	110
PID 5008 wrote to memory of 3236	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	111
PID 5008 wrote to memory of 3236	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	111
PID 5008 wrote to memory of 4380	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	112
PID 5008 wrote to memory of 4380	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	112
PID 5008 wrote to memory of 2092	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	113
PID 5008 wrote to memory of 2092	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	113
PID 5008 wrote to memory of 4612	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	114
PID 5008 wrote to memory of 4612	5008	3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe	114

C:\Users\Admin\AppData\Local\Temp\3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe
"C:\Users\Admin\AppData\Local\Temp\3487b92908f44a730c8a9be78382ddce7cc15eadafa8de06c5d7283ebec19a85.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:696
- C:\Windows\System\dvDIWRw.exe
  C:\Windows\System\dvDIWRw.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\qanZgur.exe
  C:\Windows\System\qanZgur.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\lwQsUBp.exe
  C:\Windows\System\lwQsUBp.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\hUsFKak.exe
  C:\Windows\System\hUsFKak.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\SbLUfAo.exe
  C:\Windows\System\SbLUfAo.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\lbUmqhs.exe
  C:\Windows\System\lbUmqhs.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\qjFKxUQ.exe
  C:\Windows\System\qjFKxUQ.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\QtiQeGN.exe
  C:\Windows\System\QtiQeGN.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\XLSkDLj.exe
  C:\Windows\System\XLSkDLj.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\ZymAWqd.exe
  C:\Windows\System\ZymAWqd.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\aRPRBwy.exe
  C:\Windows\System\aRPRBwy.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\bSTpRug.exe
  C:\Windows\System\bSTpRug.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\KWNohEy.exe
  C:\Windows\System\KWNohEy.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\apgFgTH.exe
  C:\Windows\System\apgFgTH.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\nyMTvxJ.exe
  C:\Windows\System\nyMTvxJ.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\rqylwJa.exe
  C:\Windows\System\rqylwJa.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\dwyYLJW.exe
  C:\Windows\System\dwyYLJW.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\PrqJdLI.exe
  C:\Windows\System\PrqJdLI.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\LWPsXCq.exe
  C:\Windows\System\LWPsXCq.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\kQdgNVs.exe
  C:\Windows\System\kQdgNVs.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\dFXWveA.exe
  C:\Windows\System\dFXWveA.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\pFfwvkw.exe
  C:\Windows\System\pFfwvkw.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\tCTqrjz.exe
  C:\Windows\System\tCTqrjz.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\jthYOAD.exe
  C:\Windows\System\jthYOAD.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\mrDAdgF.exe
  C:\Windows\System\mrDAdgF.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\odVhKtR.exe
  C:\Windows\System\odVhKtR.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\WsXTBtU.exe
  C:\Windows\System\WsXTBtU.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\bDQJpKU.exe
  C:\Windows\System\bDQJpKU.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\EaNKAim.exe
  C:\Windows\System\EaNKAim.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\hUDsOox.exe
  C:\Windows\System\hUDsOox.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\PCLXABz.exe
  C:\Windows\System\PCLXABz.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\PfFnmLD.exe
  C:\Windows\System\PfFnmLD.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\ebEJLSu.exe
  C:\Windows\System\ebEJLSu.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\HlOUTDT.exe
  C:\Windows\System\HlOUTDT.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\jUjJllD.exe
  C:\Windows\System\jUjJllD.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\MhbeeJj.exe
  C:\Windows\System\MhbeeJj.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\wvAQWyg.exe
  C:\Windows\System\wvAQWyg.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\sDrOFMz.exe
  C:\Windows\System\sDrOFMz.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\CsqaAeB.exe
  C:\Windows\System\CsqaAeB.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\QHgIDdi.exe
  C:\Windows\System\QHgIDdi.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\coWsPgY.exe
  C:\Windows\System\coWsPgY.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\rGswGFG.exe
  C:\Windows\System\rGswGFG.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\XgtVVRw.exe
  C:\Windows\System\XgtVVRw.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\ksFMazL.exe
  C:\Windows\System\ksFMazL.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\qoWCXkD.exe
  C:\Windows\System\qoWCXkD.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\DBQPgOQ.exe
  C:\Windows\System\DBQPgOQ.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\KOGnghL.exe
  C:\Windows\System\KOGnghL.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\VMIdZEW.exe
  C:\Windows\System\VMIdZEW.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\KKrDDFQ.exe
  C:\Windows\System\KKrDDFQ.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\IVEtaYh.exe
  C:\Windows\System\IVEtaYh.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\ymfTyDx.exe
  C:\Windows\System\ymfTyDx.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\toRPlIw.exe
  C:\Windows\System\toRPlIw.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\Mvqfpjh.exe
  C:\Windows\System\Mvqfpjh.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\oqpqRyn.exe
  C:\Windows\System\oqpqRyn.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\Qdurwpe.exe
  C:\Windows\System\Qdurwpe.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\qpqVRDt.exe
  C:\Windows\System\qpqVRDt.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\pcDkQbS.exe
  C:\Windows\System\pcDkQbS.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\ZSeOFWv.exe
  C:\Windows\System\ZSeOFWv.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\uBpHzTv.exe
  C:\Windows\System\uBpHzTv.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\isXNaMH.exe
  C:\Windows\System\isXNaMH.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\EeREYWn.exe
  C:\Windows\System\EeREYWn.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\iTNQoyI.exe
  C:\Windows\System\iTNQoyI.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\ucANEYZ.exe
  C:\Windows\System\ucANEYZ.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\mzMgZSk.exe
  C:\Windows\System\mzMgZSk.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\VPdSumA.exe
  C:\Windows\System\VPdSumA.exe
  2⤵
  PID:2988
- C:\Windows\System\QDIdaCs.exe
  C:\Windows\System\QDIdaCs.exe
  2⤵
  PID:3588
- C:\Windows\System\lDiBabl.exe
  C:\Windows\System\lDiBabl.exe
  2⤵
  PID:4116
- C:\Windows\System\RWPaBis.exe
  C:\Windows\System\RWPaBis.exe
  2⤵
  PID:4600
- C:\Windows\System\kcFyEkr.exe
  C:\Windows\System\kcFyEkr.exe
  2⤵
  PID:4068
- C:\Windows\System\KOSOztf.exe
  C:\Windows\System\KOSOztf.exe
  2⤵
  PID:4264
- C:\Windows\System\foecSZO.exe
  C:\Windows\System\foecSZO.exe
  2⤵
  PID:4392
- C:\Windows\System\BxbxGDb.exe
  C:\Windows\System\BxbxGDb.exe
  2⤵
  PID:4880
- C:\Windows\System\eTDtjRT.exe
  C:\Windows\System\eTDtjRT.exe
  2⤵
  PID:904
- C:\Windows\System\EtXNcdi.exe
  C:\Windows\System\EtXNcdi.exe
  2⤵
  PID:212
- C:\Windows\System\VNSbURv.exe
  C:\Windows\System\VNSbURv.exe
  2⤵
  PID:3480
- C:\Windows\System\PMTzeel.exe
  C:\Windows\System\PMTzeel.exe
  2⤵
  PID:4464
- C:\Windows\System\hYPXgZt.exe
  C:\Windows\System\hYPXgZt.exe
  2⤵
  PID:3124
- C:\Windows\System\QfVOBMC.exe
  C:\Windows\System\QfVOBMC.exe
  2⤵
  PID:4620
- C:\Windows\System\JBiJLmc.exe
  C:\Windows\System\JBiJLmc.exe
  2⤵
  PID:2860
- C:\Windows\System\UFWNWeU.exe
  C:\Windows\System\UFWNWeU.exe
  2⤵
  PID:1992
- C:\Windows\System\lthczFf.exe
  C:\Windows\System\lthczFf.exe
  2⤵
  PID:1484
- C:\Windows\System\hMdRsNg.exe
  C:\Windows\System\hMdRsNg.exe
  2⤵
  PID:3060
- C:\Windows\System\OeNbLge.exe
  C:\Windows\System\OeNbLge.exe
  2⤵
  PID:3984
- C:\Windows\System\itDQKGn.exe
  C:\Windows\System\itDQKGn.exe
  2⤵
  PID:2256
- C:\Windows\System\LpuDTvg.exe
  C:\Windows\System\LpuDTvg.exe
  2⤵
  PID:2568
- C:\Windows\System\NJqqgop.exe
  C:\Windows\System\NJqqgop.exe
  2⤵
  PID:2800
- C:\Windows\System\TRCahxb.exe
  C:\Windows\System\TRCahxb.exe
  2⤵
  PID:4056
- C:\Windows\System\YUDJnnw.exe
  C:\Windows\System\YUDJnnw.exe
  2⤵
  PID:396
- C:\Windows\System\Vdizurf.exe
  C:\Windows\System\Vdizurf.exe
  2⤵
  PID:1228
- C:\Windows\System\AwYHKzF.exe
  C:\Windows\System\AwYHKzF.exe
  2⤵
  PID:1884
- C:\Windows\System\eQFaKwd.exe
  C:\Windows\System\eQFaKwd.exe
  2⤵
  PID:1896
- C:\Windows\System\VeuSXOM.exe
  C:\Windows\System\VeuSXOM.exe
  2⤵
  PID:4812
- C:\Windows\System\MHIstFP.exe
  C:\Windows\System\MHIstFP.exe
  2⤵
  PID:1324
- C:\Windows\System\YoposFK.exe
  C:\Windows\System\YoposFK.exe
  2⤵
  PID:2772
- C:\Windows\System\lOGXENk.exe
  C:\Windows\System\lOGXENk.exe
  2⤵
  PID:5132
- C:\Windows\System\LhGSnJB.exe
  C:\Windows\System\LhGSnJB.exe
  2⤵
  PID:5156
- C:\Windows\System\TTaolom.exe
  C:\Windows\System\TTaolom.exe
  2⤵
  PID:5180
- C:\Windows\System\voEtFdC.exe
  C:\Windows\System\voEtFdC.exe
  2⤵
  PID:5204
- C:\Windows\System\aIqQrqV.exe
  C:\Windows\System\aIqQrqV.exe
  2⤵
  PID:5244
- C:\Windows\System\ZXrvzts.exe
  C:\Windows\System\ZXrvzts.exe
  2⤵
  PID:5272
- C:\Windows\System\XPlasKP.exe
  C:\Windows\System\XPlasKP.exe
  2⤵
  PID:5296
- C:\Windows\System\eFpDcJc.exe
  C:\Windows\System\eFpDcJc.exe
  2⤵
  PID:5324
- C:\Windows\System\aWBWtiC.exe
  C:\Windows\System\aWBWtiC.exe
  2⤵
  PID:5344
- C:\Windows\System\zctuycr.exe
  C:\Windows\System\zctuycr.exe
  2⤵
  PID:5384
- C:\Windows\System\GzVDIGq.exe
  C:\Windows\System\GzVDIGq.exe
  2⤵
  PID:5400
- C:\Windows\System\mQPhpPD.exe
  C:\Windows\System\mQPhpPD.exe
  2⤵
  PID:5436
- C:\Windows\System\enrntNG.exe
  C:\Windows\System\enrntNG.exe
  2⤵
  PID:5464
- C:\Windows\System\QTjCwyq.exe
  C:\Windows\System\QTjCwyq.exe
  2⤵
  PID:5492
- C:\Windows\System\gulqGHk.exe
  C:\Windows\System\gulqGHk.exe
  2⤵
  PID:5524
- C:\Windows\System\RNbTtit.exe
  C:\Windows\System\RNbTtit.exe
  2⤵
  PID:5548
- C:\Windows\System\hpwWSzv.exe
  C:\Windows\System\hpwWSzv.exe
  2⤵
  PID:5576
- C:\Windows\System\PiigkSH.exe
  C:\Windows\System\PiigkSH.exe
  2⤵
  PID:5596
- C:\Windows\System\bvFnBKy.exe
  C:\Windows\System\bvFnBKy.exe
  2⤵
  PID:5632
- C:\Windows\System\kbYegsq.exe
  C:\Windows\System\kbYegsq.exe
  2⤵
  PID:5660
- C:\Windows\System\nzmMmbH.exe
  C:\Windows\System\nzmMmbH.exe
  2⤵
  PID:5688
- C:\Windows\System\slncgVM.exe
  C:\Windows\System\slncgVM.exe
  2⤵
  PID:5720
- C:\Windows\System\mWjfmkM.exe
  C:\Windows\System\mWjfmkM.exe
  2⤵
  PID:5748
- C:\Windows\System\elxgxbh.exe
  C:\Windows\System\elxgxbh.exe
  2⤵
  PID:5776
- C:\Windows\System\JGHyqul.exe
  C:\Windows\System\JGHyqul.exe
  2⤵
  PID:5808
- C:\Windows\System\GiBPUtn.exe
  C:\Windows\System\GiBPUtn.exe
  2⤵
  PID:5832
- C:\Windows\System\DxsGLJL.exe
  C:\Windows\System\DxsGLJL.exe
  2⤵
  PID:5860
- C:\Windows\System\RgYjlgv.exe
  C:\Windows\System\RgYjlgv.exe
  2⤵
  PID:5892
- C:\Windows\System\iAaSVzs.exe
  C:\Windows\System\iAaSVzs.exe
  2⤵
  PID:5916
- C:\Windows\System\PmrBpMS.exe
  C:\Windows\System\PmrBpMS.exe
  2⤵
  PID:5940
- C:\Windows\System\yoxMkDF.exe
  C:\Windows\System\yoxMkDF.exe
  2⤵
  PID:5972
- C:\Windows\System\cUNLOiv.exe
  C:\Windows\System\cUNLOiv.exe
  2⤵
  PID:6000
- C:\Windows\System\pEXluVD.exe
  C:\Windows\System\pEXluVD.exe
  2⤵
  PID:6028
- C:\Windows\System\HEzuwoi.exe
  C:\Windows\System\HEzuwoi.exe
  2⤵
  PID:6056
- C:\Windows\System\krDCTdR.exe
  C:\Windows\System\krDCTdR.exe
  2⤵
  PID:6084
- C:\Windows\System\Kfnknah.exe
  C:\Windows\System\Kfnknah.exe
  2⤵
  PID:6116
- C:\Windows\System\fIqGLZt.exe
  C:\Windows\System\fIqGLZt.exe
  2⤵
  PID:6140
- C:\Windows\System\MYegEPl.exe
  C:\Windows\System\MYegEPl.exe
  2⤵
  PID:5168
- C:\Windows\System\bUZfGwe.exe
  C:\Windows\System\bUZfGwe.exe
  2⤵
  PID:2184
- C:\Windows\System\hgsDVMp.exe
  C:\Windows\System\hgsDVMp.exe
  2⤵
  PID:5268
- C:\Windows\System\DcLvTVB.exe
  C:\Windows\System\DcLvTVB.exe
  2⤵
  PID:5332
- C:\Windows\System\jsmMoUh.exe
  C:\Windows\System\jsmMoUh.exe
  2⤵
  PID:5368
- C:\Windows\System\vvgvtaz.exe
  C:\Windows\System\vvgvtaz.exe
  2⤵
  PID:5448
- C:\Windows\System\IuVRoYq.exe
  C:\Windows\System\IuVRoYq.exe
  2⤵
  PID:5504
- C:\Windows\System\VDXZBRI.exe
  C:\Windows\System\VDXZBRI.exe
  2⤵
  PID:5556
- C:\Windows\System\eyzzAoj.exe
  C:\Windows\System\eyzzAoj.exe
  2⤵
  PID:5624
- C:\Windows\System\SnHoHKg.exe
  C:\Windows\System\SnHoHKg.exe
  2⤵
  PID:5680
- C:\Windows\System\dIthiwl.exe
  C:\Windows\System\dIthiwl.exe
  2⤵
  PID:5756
- C:\Windows\System\xIjZjxl.exe
  C:\Windows\System\xIjZjxl.exe
  2⤵
  PID:5796
- C:\Windows\System\GrwcLfJ.exe
  C:\Windows\System\GrwcLfJ.exe
  2⤵
  PID:5844
- C:\Windows\System\znwwsce.exe
  C:\Windows\System\znwwsce.exe
  2⤵
  PID:5924
- C:\Windows\System\kHRjKLj.exe
  C:\Windows\System\kHRjKLj.exe
  2⤵
  PID:5980
- C:\Windows\System\aRQJHiO.exe
  C:\Windows\System\aRQJHiO.exe
  2⤵
  PID:6036
- C:\Windows\System\XSVlcBg.exe
  C:\Windows\System\XSVlcBg.exe
  2⤵
  PID:6096
- C:\Windows\System\hjGjigf.exe
  C:\Windows\System\hjGjigf.exe
  2⤵
  PID:5144
- C:\Windows\System\nIBEKiT.exe
  C:\Windows\System\nIBEKiT.exe
  2⤵
  PID:2012
- C:\Windows\System\LARrEax.exe
  C:\Windows\System\LARrEax.exe
  2⤵
  PID:5392
- C:\Windows\System\uSrsBPY.exe
  C:\Windows\System\uSrsBPY.exe
  2⤵
  PID:5532
- C:\Windows\System\nYBvVEm.exe
  C:\Windows\System\nYBvVEm.exe
  2⤵
  PID:5700
- C:\Windows\System\EOURXpZ.exe
  C:\Windows\System\EOURXpZ.exe
  2⤵
  PID:3304
- C:\Windows\System\XPMlJQk.exe
  C:\Windows\System\XPMlJQk.exe
  2⤵
  PID:5932
- C:\Windows\System\VCcFqNV.exe
  C:\Windows\System\VCcFqNV.exe
  2⤵
  PID:6076
- C:\Windows\System\dadhUkP.exe
  C:\Windows\System\dadhUkP.exe
  2⤵
  PID:5284
- C:\Windows\System\tQoNChs.exe
  C:\Windows\System\tQoNChs.exe
  2⤵
  PID:5608
- C:\Windows\System\lKEXcwK.exe
  C:\Windows\System\lKEXcwK.exe
  2⤵
  PID:5888
- C:\Windows\System\QdwkwYn.exe
  C:\Windows\System\QdwkwYn.exe
  2⤵
  PID:5356
- C:\Windows\System\rnrMwEU.exe
  C:\Windows\System\rnrMwEU.exe
  2⤵
  PID:6048
- C:\Windows\System\AsfFNDF.exe
  C:\Windows\System\AsfFNDF.exe
  2⤵
  PID:6148
- C:\Windows\System\yGbyriT.exe
  C:\Windows\System\yGbyriT.exe
  2⤵
  PID:6176
- C:\Windows\System\axyelDj.exe
  C:\Windows\System\axyelDj.exe
  2⤵
  PID:6204
- C:\Windows\System\CaIyMCp.exe
  C:\Windows\System\CaIyMCp.exe
  2⤵
  PID:6224
- C:\Windows\System\SQfUsBu.exe
  C:\Windows\System\SQfUsBu.exe
  2⤵
  PID:6252
- C:\Windows\System\JJXTXJc.exe
  C:\Windows\System\JJXTXJc.exe
  2⤵
  PID:6288
- C:\Windows\System\zDJnAzn.exe
  C:\Windows\System\zDJnAzn.exe
  2⤵
  PID:6308
- C:\Windows\System\TJIoWla.exe
  C:\Windows\System\TJIoWla.exe
  2⤵
  PID:6344
- C:\Windows\System\SAoxnOA.exe
  C:\Windows\System\SAoxnOA.exe
  2⤵
  PID:6372
- C:\Windows\System\uYztMRu.exe
  C:\Windows\System\uYztMRu.exe
  2⤵
  PID:6400
- C:\Windows\System\bDhQePs.exe
  C:\Windows\System\bDhQePs.exe
  2⤵
  PID:6428
- C:\Windows\System\nXhRPns.exe
  C:\Windows\System\nXhRPns.exe
  2⤵
  PID:6456
- C:\Windows\System\VRpkjRP.exe
  C:\Windows\System\VRpkjRP.exe
  2⤵
  PID:6484
- C:\Windows\System\TAlqxvl.exe
  C:\Windows\System\TAlqxvl.exe
  2⤵
  PID:6512
- C:\Windows\System\FHPfeDB.exe
  C:\Windows\System\FHPfeDB.exe
  2⤵
  PID:6540
- C:\Windows\System\LEEYAKx.exe
  C:\Windows\System\LEEYAKx.exe
  2⤵
  PID:6572
- C:\Windows\System\xbZOtsL.exe
  C:\Windows\System\xbZOtsL.exe
  2⤵
  PID:6600
- C:\Windows\System\prmgNcE.exe
  C:\Windows\System\prmgNcE.exe
  2⤵
  PID:6624
- C:\Windows\System\uaJNMty.exe
  C:\Windows\System\uaJNMty.exe
  2⤵
  PID:6652
- C:\Windows\System\IPyrexf.exe
  C:\Windows\System\IPyrexf.exe
  2⤵
  PID:6680
- C:\Windows\System\qBfXFWo.exe
  C:\Windows\System\qBfXFWo.exe
  2⤵
  PID:6708
- C:\Windows\System\NzXWhde.exe
  C:\Windows\System\NzXWhde.exe
  2⤵
  PID:6736
- C:\Windows\System\OhSUaSR.exe
  C:\Windows\System\OhSUaSR.exe
  2⤵
  PID:6764
- C:\Windows\System\ptJYpJF.exe
  C:\Windows\System\ptJYpJF.exe
  2⤵
  PID:6792
- C:\Windows\System\qhccwKe.exe
  C:\Windows\System\qhccwKe.exe
  2⤵
  PID:6820
- C:\Windows\System\nVcgVaL.exe
  C:\Windows\System\nVcgVaL.exe
  2⤵
  PID:6848
- C:\Windows\System\GsaukCV.exe
  C:\Windows\System\GsaukCV.exe
  2⤵
  PID:6876
- C:\Windows\System\hFHbqUM.exe
  C:\Windows\System\hFHbqUM.exe
  2⤵
  PID:6904
- C:\Windows\System\sqVGhJQ.exe
  C:\Windows\System\sqVGhJQ.exe
  2⤵
  PID:6932
- C:\Windows\System\bAWmtBW.exe
  C:\Windows\System\bAWmtBW.exe
  2⤵
  PID:6964
- C:\Windows\System\IzsLGPs.exe
  C:\Windows\System\IzsLGPs.exe
  2⤵
  PID:6984
- C:\Windows\System\VbMmISU.exe
  C:\Windows\System\VbMmISU.exe
  2⤵
  PID:7012
- C:\Windows\System\GYcOHym.exe
  C:\Windows\System\GYcOHym.exe
  2⤵
  PID:7040
- C:\Windows\System\cnUtWIZ.exe
  C:\Windows\System\cnUtWIZ.exe
  2⤵
  PID:7068
- C:\Windows\System\WORgYKQ.exe
  C:\Windows\System\WORgYKQ.exe
  2⤵
  PID:7096
- C:\Windows\System\PKygYEk.exe
  C:\Windows\System\PKygYEk.exe
  2⤵
  PID:7124
- C:\Windows\System\ezWSLVw.exe
  C:\Windows\System\ezWSLVw.exe
  2⤵
  PID:7152
- C:\Windows\System\CpPfBfi.exe
  C:\Windows\System\CpPfBfi.exe
  2⤵
  PID:6188
- C:\Windows\System\BwGPhdv.exe
  C:\Windows\System\BwGPhdv.exe
  2⤵
  PID:6248
- C:\Windows\System\fAdSDIm.exe
  C:\Windows\System\fAdSDIm.exe
  2⤵
  PID:6300
- C:\Windows\System\kZddjzz.exe
  C:\Windows\System\kZddjzz.exe
  2⤵
  PID:6380
- C:\Windows\System\NXKmtSJ.exe
  C:\Windows\System\NXKmtSJ.exe
  2⤵
  PID:6440
- C:\Windows\System\ccqAWMT.exe
  C:\Windows\System\ccqAWMT.exe
  2⤵
  PID:6520
- C:\Windows\System\vJQQQAi.exe
  C:\Windows\System\vJQQQAi.exe
  2⤵
  PID:6568
- C:\Windows\System\cmZlMxf.exe
  C:\Windows\System\cmZlMxf.exe
  2⤵
  PID:6616
- C:\Windows\System\prxlwqT.exe
  C:\Windows\System\prxlwqT.exe
  2⤵
  PID:5444
- C:\Windows\System\tyjSedy.exe
  C:\Windows\System\tyjSedy.exe
  2⤵
  PID:6748
- C:\Windows\System\QgSSFhK.exe
  C:\Windows\System\QgSSFhK.exe
  2⤵
  PID:6828
- C:\Windows\System\QADtWth.exe
  C:\Windows\System\QADtWth.exe
  2⤵
  PID:6884
- C:\Windows\System\CpdrxIZ.exe
  C:\Windows\System\CpdrxIZ.exe
  2⤵
  PID:6940
- C:\Windows\System\GEHcuOf.exe
  C:\Windows\System\GEHcuOf.exe
  2⤵
  PID:7004
- C:\Windows\System\vrIifJu.exe
  C:\Windows\System\vrIifJu.exe
  2⤵
  PID:7088
- C:\Windows\System\dUIsAjQ.exe
  C:\Windows\System\dUIsAjQ.exe
  2⤵
  PID:7144
- C:\Windows\System\GqjdHkA.exe
  C:\Windows\System\GqjdHkA.exe
  2⤵
  PID:6216
- C:\Windows\System\RatTLqX.exe
  C:\Windows\System\RatTLqX.exe
  2⤵
  PID:6356
- C:\Windows\System\QGvAcTX.exe
  C:\Windows\System\QGvAcTX.exe
  2⤵
  PID:6524
- C:\Windows\System\mtjNoPg.exe
  C:\Windows\System\mtjNoPg.exe
  2⤵
  PID:6664
- C:\Windows\System\wPhHenE.exe
  C:\Windows\System\wPhHenE.exe
  2⤵
  PID:6800
- C:\Windows\System\XyWoKWb.exe
  C:\Windows\System\XyWoKWb.exe
  2⤵
  PID:6972
- C:\Windows\System\yrMlOMr.exe
  C:\Windows\System\yrMlOMr.exe
  2⤵
  PID:7116
- C:\Windows\System\RgFzyHc.exe
  C:\Windows\System\RgFzyHc.exe
  2⤵
  PID:6352
- C:\Windows\System\sSrpdtO.exe
  C:\Windows\System\sSrpdtO.exe
  2⤵
  PID:6720
- C:\Windows\System\KDPETyd.exe
  C:\Windows\System\KDPETyd.exe
  2⤵
  PID:7060
- C:\Windows\System\KQEhHbc.exe
  C:\Windows\System\KQEhHbc.exe
  2⤵
  PID:6944
- C:\Windows\System\WjlhlKc.exe
  C:\Windows\System\WjlhlKc.exe
  2⤵
  PID:6492
- C:\Windows\System\uOpAOKo.exe
  C:\Windows\System\uOpAOKo.exe
  2⤵
  PID:7192
- C:\Windows\System\tDQmjor.exe
  C:\Windows\System\tDQmjor.exe
  2⤵
  PID:7224
- C:\Windows\System\aTEeziD.exe
  C:\Windows\System\aTEeziD.exe
  2⤵
  PID:7244
- C:\Windows\System\Rypbdvq.exe
  C:\Windows\System\Rypbdvq.exe
  2⤵
  PID:7272
- C:\Windows\System\HAJKmKQ.exe
  C:\Windows\System\HAJKmKQ.exe
  2⤵
  PID:7300
- C:\Windows\System\EROAsiC.exe
  C:\Windows\System\EROAsiC.exe
  2⤵
  PID:7328
- C:\Windows\System\KMCxwjX.exe
  C:\Windows\System\KMCxwjX.exe
  2⤵
  PID:7364
- C:\Windows\System\WCbETpM.exe
  C:\Windows\System\WCbETpM.exe
  2⤵
  PID:7384
- C:\Windows\System\KTcJFOz.exe
  C:\Windows\System\KTcJFOz.exe
  2⤵
  PID:7412
- C:\Windows\System\grmkcLD.exe
  C:\Windows\System\grmkcLD.exe
  2⤵
  PID:7444
- C:\Windows\System\KiPfQyI.exe
  C:\Windows\System\KiPfQyI.exe
  2⤵
  PID:7476
- C:\Windows\System\zRSnmds.exe
  C:\Windows\System\zRSnmds.exe
  2⤵
  PID:7500
- C:\Windows\System\TrqTNiE.exe
  C:\Windows\System\TrqTNiE.exe
  2⤵
  PID:7528
- C:\Windows\System\YpNRTRh.exe
  C:\Windows\System\YpNRTRh.exe
  2⤵
  PID:7552
- C:\Windows\System\OqCCMYi.exe
  C:\Windows\System\OqCCMYi.exe
  2⤵
  PID:7580
- C:\Windows\System\XJopBJP.exe
  C:\Windows\System\XJopBJP.exe
  2⤵
  PID:7596
- C:\Windows\System\vAovCAt.exe
  C:\Windows\System\vAovCAt.exe
  2⤵
  PID:7644
- C:\Windows\System\XDfYRLG.exe
  C:\Windows\System\XDfYRLG.exe
  2⤵
  PID:7668
- C:\Windows\System\bXrKsHW.exe
  C:\Windows\System\bXrKsHW.exe
  2⤵
  PID:7696
- C:\Windows\System\QpmLdAu.exe
  C:\Windows\System\QpmLdAu.exe
  2⤵
  PID:7724
- C:\Windows\System\wPLDdqg.exe
  C:\Windows\System\wPLDdqg.exe
  2⤵
  PID:7752
- C:\Windows\System\TGgAbfb.exe
  C:\Windows\System\TGgAbfb.exe
  2⤵
  PID:7780
- C:\Windows\System\JKFwZXc.exe
  C:\Windows\System\JKFwZXc.exe
  2⤵
  PID:7804
- C:\Windows\System\UUNsaoZ.exe
  C:\Windows\System\UUNsaoZ.exe
  2⤵
  PID:7836
- C:\Windows\System\tZAJQSj.exe
  C:\Windows\System\tZAJQSj.exe
  2⤵
  PID:7860
- C:\Windows\System\oeKIIuv.exe
  C:\Windows\System\oeKIIuv.exe
  2⤵
  PID:7892
- C:\Windows\System\kTfcrKi.exe
  C:\Windows\System\kTfcrKi.exe
  2⤵
  PID:7916
- C:\Windows\System\XEprsmH.exe
  C:\Windows\System\XEprsmH.exe
  2⤵
  PID:7952
- C:\Windows\System\vIogVLe.exe
  C:\Windows\System\vIogVLe.exe
  2⤵
  PID:7972
- C:\Windows\System\iUuICBy.exe
  C:\Windows\System\iUuICBy.exe
  2⤵
  PID:8000
- C:\Windows\System\tYJceJs.exe
  C:\Windows\System\tYJceJs.exe
  2⤵
  PID:8028
- C:\Windows\System\BUebOPO.exe
  C:\Windows\System\BUebOPO.exe
  2⤵
  PID:8056
- C:\Windows\System\rQfkoqc.exe
  C:\Windows\System\rQfkoqc.exe
  2⤵
  PID:8084
- C:\Windows\System\WMLgVwN.exe
  C:\Windows\System\WMLgVwN.exe
  2⤵
  PID:8116
- C:\Windows\System\TSZvsch.exe
  C:\Windows\System\TSZvsch.exe
  2⤵
  PID:8140
- C:\Windows\System\SOnFKMk.exe
  C:\Windows\System\SOnFKMk.exe
  2⤵
  PID:8168
- C:\Windows\System\rWXIEfx.exe
  C:\Windows\System\rWXIEfx.exe
  2⤵
  PID:3936
- C:\Windows\System\UfcpYCo.exe
  C:\Windows\System\UfcpYCo.exe
  2⤵
  PID:7236
- C:\Windows\System\BlFGBtO.exe
  C:\Windows\System\BlFGBtO.exe
  2⤵
  PID:7296
- C:\Windows\System\FfzYsCT.exe
  C:\Windows\System\FfzYsCT.exe
  2⤵
  PID:7372
- C:\Windows\System\edWSsvl.exe
  C:\Windows\System\edWSsvl.exe
  2⤵
  PID:7456
- C:\Windows\System\hOZXBjt.exe
  C:\Windows\System\hOZXBjt.exe
  2⤵
  PID:7508
- C:\Windows\System\YBrMDBo.exe
  C:\Windows\System\YBrMDBo.exe
  2⤵
  PID:7576
- C:\Windows\System\aEFSvNO.exe
  C:\Windows\System\aEFSvNO.exe
  2⤵
  PID:7632
- C:\Windows\System\euubyGc.exe
  C:\Windows\System\euubyGc.exe
  2⤵
  PID:7704
- C:\Windows\System\AsMDYWn.exe
  C:\Windows\System\AsMDYWn.exe
  2⤵
  PID:7768
- C:\Windows\System\ECsRHYc.exe
  C:\Windows\System\ECsRHYc.exe
  2⤵
  PID:7828
- C:\Windows\System\kbDqxIY.exe
  C:\Windows\System\kbDqxIY.exe
  2⤵
  PID:7936
- C:\Windows\System\WEMUFrM.exe
  C:\Windows\System\WEMUFrM.exe
  2⤵
  PID:7996
- C:\Windows\System\UxAfRZv.exe
  C:\Windows\System\UxAfRZv.exe
  2⤵
  PID:8068
- C:\Windows\System\LanBeut.exe
  C:\Windows\System\LanBeut.exe
  2⤵
  PID:8124
- C:\Windows\System\gkORvZS.exe
  C:\Windows\System\gkORvZS.exe
  2⤵
  PID:8188
- C:\Windows\System\sZcFrkt.exe
  C:\Windows\System\sZcFrkt.exe
  2⤵
  PID:7292
- C:\Windows\System\UkMBXxP.exe
  C:\Windows\System\UkMBXxP.exe
  2⤵
  PID:7464
- C:\Windows\System\XhxTMVJ.exe
  C:\Windows\System\XhxTMVJ.exe
  2⤵
  PID:7620
- C:\Windows\System\orbMXhz.exe
  C:\Windows\System\orbMXhz.exe
  2⤵
  PID:7760
- C:\Windows\System\SykDWbH.exe
  C:\Windows\System\SykDWbH.exe
  2⤵
  PID:7964
- C:\Windows\System\QPDoWZg.exe
  C:\Windows\System\QPDoWZg.exe
  2⤵
  PID:8104
- C:\Windows\System\DvwRWfP.exe
  C:\Windows\System\DvwRWfP.exe
  2⤵
  PID:7284
- C:\Windows\System\DcrqtPl.exe
  C:\Windows\System\DcrqtPl.exe
  2⤵
  PID:7684
- C:\Windows\System\dKYgDAj.exe
  C:\Windows\System\dKYgDAj.exe
  2⤵
  PID:8052
- C:\Windows\System\BzYIwxj.exe
  C:\Windows\System\BzYIwxj.exe
  2⤵
  PID:7592
- C:\Windows\System\rcpLrLB.exe
  C:\Windows\System\rcpLrLB.exe
  2⤵
  PID:8048
- C:\Windows\System\YwcDyAq.exe
  C:\Windows\System\YwcDyAq.exe
  2⤵
  PID:8212
- C:\Windows\System\LElorTx.exe
  C:\Windows\System\LElorTx.exe
  2⤵
  PID:8240
- C:\Windows\System\LqbauSo.exe
  C:\Windows\System\LqbauSo.exe
  2⤵
  PID:8268
- C:\Windows\System\zeuZUTY.exe
  C:\Windows\System\zeuZUTY.exe
  2⤵
  PID:8296
- C:\Windows\System\HReYyfD.exe
  C:\Windows\System\HReYyfD.exe
  2⤵
  PID:8324
- C:\Windows\System\MDnuNtF.exe
  C:\Windows\System\MDnuNtF.exe
  2⤵
  PID:8360
- C:\Windows\System\xZUMmuZ.exe
  C:\Windows\System\xZUMmuZ.exe
  2⤵
  PID:8380
- C:\Windows\System\sPcgjjq.exe
  C:\Windows\System\sPcgjjq.exe
  2⤵
  PID:8408
- C:\Windows\System\XWMLWxk.exe
  C:\Windows\System\XWMLWxk.exe
  2⤵
  PID:8436
- C:\Windows\System\EsrVNfr.exe
  C:\Windows\System\EsrVNfr.exe
  2⤵
  PID:8468
- C:\Windows\System\TszJwdP.exe
  C:\Windows\System\TszJwdP.exe
  2⤵
  PID:8496
- C:\Windows\System\qPfMHys.exe
  C:\Windows\System\qPfMHys.exe
  2⤵
  PID:8524
- C:\Windows\System\clQexMN.exe
  C:\Windows\System\clQexMN.exe
  2⤵
  PID:8548
- C:\Windows\System\CLrBpSx.exe
  C:\Windows\System\CLrBpSx.exe
  2⤵
  PID:8576
- C:\Windows\System\EiUtWaq.exe
  C:\Windows\System\EiUtWaq.exe
  2⤵
  PID:8612
- C:\Windows\System\XUMCYYB.exe
  C:\Windows\System\XUMCYYB.exe
  2⤵
  PID:8632
- C:\Windows\System\dCILbxf.exe
  C:\Windows\System\dCILbxf.exe
  2⤵
  PID:8660
- C:\Windows\System\qYnJyZy.exe
  C:\Windows\System\qYnJyZy.exe
  2⤵
  PID:8692
- C:\Windows\System\OhkdOnf.exe
  C:\Windows\System\OhkdOnf.exe
  2⤵
  PID:8720
- C:\Windows\System\fEJUZIh.exe
  C:\Windows\System\fEJUZIh.exe
  2⤵
  PID:8748
- C:\Windows\System\dYMpvng.exe
  C:\Windows\System\dYMpvng.exe
  2⤵
  PID:8780
- C:\Windows\System\RoiZRCA.exe
  C:\Windows\System\RoiZRCA.exe
  2⤵
  PID:8804
- C:\Windows\System\cJIwSlc.exe
  C:\Windows\System\cJIwSlc.exe
  2⤵
  PID:8832
- C:\Windows\System\LjRJlkp.exe
  C:\Windows\System\LjRJlkp.exe
  2⤵
  PID:8860
- C:\Windows\System\qlQbvaY.exe
  C:\Windows\System\qlQbvaY.exe
  2⤵
  PID:8876
- C:\Windows\System\bfdZWuu.exe
  C:\Windows\System\bfdZWuu.exe
  2⤵
  PID:8916
- C:\Windows\System\YMMrkQO.exe
  C:\Windows\System\YMMrkQO.exe
  2⤵
  PID:8944
- C:\Windows\System\QnolvLv.exe
  C:\Windows\System\QnolvLv.exe
  2⤵
  PID:8972
- C:\Windows\System\NuAdNxj.exe
  C:\Windows\System\NuAdNxj.exe
  2⤵
  PID:8996
- C:\Windows\System\CEZkNLF.exe
  C:\Windows\System\CEZkNLF.exe
  2⤵
  PID:9032
- C:\Windows\System\xrKbFsz.exe
  C:\Windows\System\xrKbFsz.exe
  2⤵
  PID:9060
- C:\Windows\System\sgtScfG.exe
  C:\Windows\System\sgtScfG.exe
  2⤵
  PID:9088
- C:\Windows\System\qKmvnfa.exe
  C:\Windows\System\qKmvnfa.exe
  2⤵
  PID:9116
- C:\Windows\System\iHoGtpz.exe
  C:\Windows\System\iHoGtpz.exe
  2⤵
  PID:9144
- C:\Windows\System\FLqxuDY.exe
  C:\Windows\System\FLqxuDY.exe
  2⤵
  PID:9172
- C:\Windows\System\UcWanND.exe
  C:\Windows\System\UcWanND.exe
  2⤵
  PID:9204
- C:\Windows\System\RooCBZi.exe
  C:\Windows\System\RooCBZi.exe
  2⤵
  PID:8224
- C:\Windows\System\rHajUhh.exe
  C:\Windows\System\rHajUhh.exe
  2⤵
  PID:8288
- C:\Windows\System\QvXbyIJ.exe
  C:\Windows\System\QvXbyIJ.exe
  2⤵
  PID:8352
- C:\Windows\System\XuVzIET.exe
  C:\Windows\System\XuVzIET.exe
  2⤵
  PID:8404
- C:\Windows\System\SeWFkte.exe
  C:\Windows\System\SeWFkte.exe
  2⤵
  PID:8460
- C:\Windows\System\zlgpNrx.exe
  C:\Windows\System\zlgpNrx.exe
  2⤵
  PID:8532
- C:\Windows\System\osMaEUh.exe
  C:\Windows\System\osMaEUh.exe
  2⤵
  PID:8596
- C:\Windows\System\GzAnCfZ.exe
  C:\Windows\System\GzAnCfZ.exe
  2⤵
  PID:8652
- C:\Windows\System\OCkkmGy.exe
  C:\Windows\System\OCkkmGy.exe
  2⤵
  PID:8716
- C:\Windows\System\ndiGMzV.exe
  C:\Windows\System\ndiGMzV.exe
  2⤵
  PID:8792
- C:\Windows\System\AYOHxMb.exe
  C:\Windows\System\AYOHxMb.exe
  2⤵
  PID:8852
- C:\Windows\System\GnVdClE.exe
  C:\Windows\System\GnVdClE.exe
  2⤵
  PID:8912
- C:\Windows\System\kFcmPOF.exe
  C:\Windows\System\kFcmPOF.exe
  2⤵
  PID:8988
- C:\Windows\System\TNMXNWH.exe
  C:\Windows\System\TNMXNWH.exe
  2⤵
  PID:9044
- C:\Windows\System\NHBQMiR.exe
  C:\Windows\System\NHBQMiR.exe
  2⤵
  PID:9108
- C:\Windows\System\LmsONgD.exe
  C:\Windows\System\LmsONgD.exe
  2⤵
  PID:9140
- C:\Windows\System\LzATzSp.exe
  C:\Windows\System\LzATzSp.exe
  2⤵
  PID:8252
- C:\Windows\System\xUqisrc.exe
  C:\Windows\System\xUqisrc.exe
  2⤵
  PID:7484
- C:\Windows\System\wcZSlpS.exe
  C:\Windows\System\wcZSlpS.exe
  2⤵
  PID:8456
- C:\Windows\System\JAjuskx.exe
  C:\Windows\System\JAjuskx.exe
  2⤵
  PID:8624
- C:\Windows\System\eboXFnN.exe
  C:\Windows\System\eboXFnN.exe
  2⤵
  PID:8772
- C:\Windows\System\RfcfBXG.exe
  C:\Windows\System\RfcfBXG.exe
  2⤵
  PID:4208
- C:\Windows\System\crbKOPB.exe
  C:\Windows\System\crbKOPB.exe
  2⤵
  PID:9048
- C:\Windows\System\OoSzJnj.exe
  C:\Windows\System\OoSzJnj.exe
  2⤵
  PID:8280
- C:\Windows\System\VgoDWRs.exe
  C:\Windows\System\VgoDWRs.exe
  2⤵
  PID:8516
- C:\Windows\System\FDmcCxv.exe
  C:\Windows\System\FDmcCxv.exe
  2⤵
  PID:8908
- C:\Windows\System\QdbgdQA.exe
  C:\Windows\System\QdbgdQA.exe
  2⤵
  PID:8560
- C:\Windows\System\fZSCEVY.exe
  C:\Windows\System\fZSCEVY.exe
  2⤵
  PID:8712
- C:\Windows\System\rvQlfvv.exe
  C:\Windows\System\rvQlfvv.exe
  2⤵
  PID:9232
- C:\Windows\System\AIjbLrV.exe
  C:\Windows\System\AIjbLrV.exe
  2⤵
  PID:9252
- C:\Windows\System\noUwBjs.exe
  C:\Windows\System\noUwBjs.exe
  2⤵
  PID:9288
- C:\Windows\System\ATpMoHB.exe
  C:\Windows\System\ATpMoHB.exe
  2⤵
  PID:9316
- C:\Windows\System\XgbZIBy.exe
  C:\Windows\System\XgbZIBy.exe
  2⤵
  PID:9344
- C:\Windows\System\TKMTBKl.exe
  C:\Windows\System\TKMTBKl.exe
  2⤵
  PID:9360
- C:\Windows\System\raFKYpA.exe
  C:\Windows\System\raFKYpA.exe
  2⤵
  PID:9376
- C:\Windows\System\luqnqhW.exe
  C:\Windows\System\luqnqhW.exe
  2⤵
  PID:9412
- C:\Windows\System\RZiIrET.exe
  C:\Windows\System\RZiIrET.exe
  2⤵
  PID:9456
- C:\Windows\System\lnYnYor.exe
  C:\Windows\System\lnYnYor.exe
  2⤵
  PID:9472
- C:\Windows\System\eAQKkMa.exe
  C:\Windows\System\eAQKkMa.exe
  2⤵
  PID:9512
- C:\Windows\System\aOFoIRP.exe
  C:\Windows\System\aOFoIRP.exe
  2⤵
  PID:9528
- C:\Windows\System\YBNvsMh.exe
  C:\Windows\System\YBNvsMh.exe
  2⤵
  PID:9564
- C:\Windows\System\MqoIVBg.exe
  C:\Windows\System\MqoIVBg.exe
  2⤵
  PID:9596
- C:\Windows\System\gtlFoMC.exe
  C:\Windows\System\gtlFoMC.exe
  2⤵
  PID:9624
- C:\Windows\System\itlGlWB.exe
  C:\Windows\System\itlGlWB.exe
  2⤵
  PID:9652
- C:\Windows\System\sEyRAiX.exe
  C:\Windows\System\sEyRAiX.exe
  2⤵
  PID:9672
- C:\Windows\System\uWkOVJP.exe
  C:\Windows\System\uWkOVJP.exe
  2⤵
  PID:9696
- C:\Windows\System\gixCgWu.exe
  C:\Windows\System\gixCgWu.exe
  2⤵
  PID:9736
- C:\Windows\System\jIFsxxr.exe
  C:\Windows\System\jIFsxxr.exe
  2⤵
  PID:9764
- C:\Windows\System\xolbVJN.exe
  C:\Windows\System\xolbVJN.exe
  2⤵
  PID:9792
- C:\Windows\System\caCAyku.exe
  C:\Windows\System\caCAyku.exe
  2⤵
  PID:9820
- C:\Windows\System\auuyYOV.exe
  C:\Windows\System\auuyYOV.exe
  2⤵
  PID:9848
- C:\Windows\System\EkcTxSY.exe
  C:\Windows\System\EkcTxSY.exe
  2⤵
  PID:9876
- C:\Windows\System\dMQJOgC.exe
  C:\Windows\System\dMQJOgC.exe
  2⤵
  PID:9900
- C:\Windows\System\OOklmyg.exe
  C:\Windows\System\OOklmyg.exe
  2⤵
  PID:9932
- C:\Windows\System\DvXTtEi.exe
  C:\Windows\System\DvXTtEi.exe
  2⤵
  PID:9960
- C:\Windows\System\lyzZpFJ.exe
  C:\Windows\System\lyzZpFJ.exe
  2⤵
  PID:9984
- C:\Windows\System\iQPsJiF.exe
  C:\Windows\System\iQPsJiF.exe
  2⤵
  PID:10016
- C:\Windows\System\XdzAStZ.exe
  C:\Windows\System\XdzAStZ.exe
  2⤵
  PID:10044
- C:\Windows\System\hkQuLfU.exe
  C:\Windows\System\hkQuLfU.exe
  2⤵
  PID:10076
- C:\Windows\System\NhSWHvi.exe
  C:\Windows\System\NhSWHvi.exe
  2⤵
  PID:10096
- C:\Windows\System\XifWKsm.exe
  C:\Windows\System\XifWKsm.exe
  2⤵
  PID:10120
- C:\Windows\System\yYyPAbh.exe
  C:\Windows\System\yYyPAbh.exe
  2⤵
  PID:10156
- C:\Windows\System\vljQEBg.exe
  C:\Windows\System\vljQEBg.exe
  2⤵
  PID:10188
- C:\Windows\System\iIgHcVc.exe
  C:\Windows\System\iIgHcVc.exe
  2⤵
  PID:10216
- C:\Windows\System\jDBwRIS.exe
  C:\Windows\System\jDBwRIS.exe
  2⤵
  PID:8204
- C:\Windows\System\JYhyEJb.exe
  C:\Windows\System\JYhyEJb.exe
  2⤵
  PID:9280
- C:\Windows\System\sGoHbJa.exe
  C:\Windows\System\sGoHbJa.exe
  2⤵
  PID:9352
- C:\Windows\System\aHQBABa.exe
  C:\Windows\System\aHQBABa.exe
  2⤵
  PID:9368
- C:\Windows\System\kkjqjtu.exe
  C:\Windows\System\kkjqjtu.exe
  2⤵
  PID:9448
- C:\Windows\System\pzzvBwg.exe
  C:\Windows\System\pzzvBwg.exe
  2⤵
  PID:9540
- C:\Windows\System\KnGGlvi.exe
  C:\Windows\System\KnGGlvi.exe
  2⤵
  PID:9608
- C:\Windows\System\xvWtLlS.exe
  C:\Windows\System\xvWtLlS.exe
  2⤵
  PID:9644
- C:\Windows\System\pJGbKeJ.exe
  C:\Windows\System\pJGbKeJ.exe
  2⤵
  PID:9732
- C:\Windows\System\ChfBPzl.exe
  C:\Windows\System\ChfBPzl.exe
  2⤵
  PID:9776
- C:\Windows\System\BxGzkqv.exe
  C:\Windows\System\BxGzkqv.exe
  2⤵
  PID:9168
- C:\Windows\System\fJWOhIp.exe
  C:\Windows\System\fJWOhIp.exe
  2⤵
  PID:9924
- C:\Windows\System\WsLhHFT.exe
  C:\Windows\System\WsLhHFT.exe
  2⤵
  PID:9992
- C:\Windows\System\Nkimzkd.exe
  C:\Windows\System\Nkimzkd.exe
  2⤵
  PID:10060
- C:\Windows\System\IMCCgOQ.exe
  C:\Windows\System\IMCCgOQ.exe
  2⤵
  PID:10112
- C:\Windows\System\HJrzehp.exe
  C:\Windows\System\HJrzehp.exe
  2⤵
  PID:10172
- C:\Windows\System\snFyvtH.exe
  C:\Windows\System\snFyvtH.exe
  2⤵
  PID:10208
- C:\Windows\System\sAeTRQR.exe
  C:\Windows\System\sAeTRQR.exe
  2⤵
  PID:9240
- C:\Windows\System\InXirwg.exe
  C:\Windows\System\InXirwg.exe
  2⤵
  PID:9356
- C:\Windows\System\pXILFib.exe
  C:\Windows\System\pXILFib.exe
  2⤵
  PID:9464
- C:\Windows\System\dZcxBuL.exe
  C:\Windows\System\dZcxBuL.exe
  2⤵
  PID:9572
- C:\Windows\System\QOWaLTk.exe
  C:\Windows\System\QOWaLTk.exe
  2⤵
  PID:9720
- C:\Windows\System\GvzxkKd.exe
  C:\Windows\System\GvzxkKd.exe
  2⤵
  PID:9892
- C:\Windows\System\pEupiry.exe
  C:\Windows\System\pEupiry.exe
  2⤵
  PID:10152
- C:\Windows\System\Ugggflx.exe
  C:\Windows\System\Ugggflx.exe
  2⤵
  PID:9248
- C:\Windows\System\oPPxFcU.exe
  C:\Windows\System\oPPxFcU.exe
  2⤵
  PID:9968
- C:\Windows\System\sRgCjrN.exe
  C:\Windows\System\sRgCjrN.exe
  2⤵
  PID:9680
- C:\Windows\System\yimuFyJ.exe
  C:\Windows\System\yimuFyJ.exe
  2⤵
  PID:10104
- C:\Windows\System\aMaGFuB.exe
  C:\Windows\System\aMaGFuB.exe
  2⤵
  PID:10256
- C:\Windows\System\SfeGhgJ.exe
  C:\Windows\System\SfeGhgJ.exe
  2⤵
  PID:10304
- C:\Windows\System\uTazmad.exe
  C:\Windows\System\uTazmad.exe
  2⤵
  PID:10320
- C:\Windows\System\ROypLAm.exe
  C:\Windows\System\ROypLAm.exe
  2⤵
  PID:10348
- C:\Windows\System\CrTDGlz.exe
  C:\Windows\System\CrTDGlz.exe
  2⤵
  PID:10384
- C:\Windows\System\FBVdxNd.exe
  C:\Windows\System\FBVdxNd.exe
  2⤵
  PID:10404
- C:\Windows\System\imbMkdX.exe
  C:\Windows\System\imbMkdX.exe
  2⤵
  PID:10432
- C:\Windows\System\oBTEWNM.exe
  C:\Windows\System\oBTEWNM.exe
  2⤵
  PID:10464
- C:\Windows\System\LGhtTom.exe
  C:\Windows\System\LGhtTom.exe
  2⤵
  PID:10496
- C:\Windows\System\sxelBNO.exe
  C:\Windows\System\sxelBNO.exe
  2⤵
  PID:10524
- C:\Windows\System\nsoZkOV.exe
  C:\Windows\System\nsoZkOV.exe
  2⤵
  PID:10552
- C:\Windows\System\vTYslpK.exe
  C:\Windows\System\vTYslpK.exe
  2⤵
  PID:10568
- C:\Windows\System\KRNNMDO.exe
  C:\Windows\System\KRNNMDO.exe
  2⤵
  PID:10608
- C:\Windows\System\AtwRKuk.exe
  C:\Windows\System\AtwRKuk.exe
  2⤵
  PID:10636
- C:\Windows\System\lOcodWC.exe
  C:\Windows\System\lOcodWC.exe
  2⤵
  PID:10660
- C:\Windows\System\QHiMiiT.exe
  C:\Windows\System\QHiMiiT.exe
  2⤵
  PID:10680
- C:\Windows\System\cRWioTC.exe
  C:\Windows\System\cRWioTC.exe
  2⤵
  PID:10696
- C:\Windows\System\imTveWz.exe
  C:\Windows\System\imTveWz.exe
  2⤵
  PID:10736
- C:\Windows\System\BcxIKaG.exe
  C:\Windows\System\BcxIKaG.exe
  2⤵
  PID:10764
- C:\Windows\System\gdGBnnM.exe
  C:\Windows\System\gdGBnnM.exe
  2⤵
  PID:10804
- C:\Windows\System\wojLPBH.exe
  C:\Windows\System\wojLPBH.exe
  2⤵
  PID:10832
- C:\Windows\System\PXEIovN.exe
  C:\Windows\System\PXEIovN.exe
  2⤵
  PID:10848
- C:\Windows\System\JSdEdwx.exe
  C:\Windows\System\JSdEdwx.exe
  2⤵
  PID:10876
- C:\Windows\System\ElLurjF.exe
  C:\Windows\System\ElLurjF.exe
  2⤵
  PID:10908
- C:\Windows\System\EtaqvTo.exe
  C:\Windows\System\EtaqvTo.exe
  2⤵
  PID:10944
- C:\Windows\System\KsNDFeP.exe
  C:\Windows\System\KsNDFeP.exe
  2⤵
  PID:10972
- C:\Windows\System\NdhYHnZ.exe
  C:\Windows\System\NdhYHnZ.exe
  2⤵
  PID:11000
- C:\Windows\System\qjPpGXd.exe
  C:\Windows\System\qjPpGXd.exe
  2⤵
  PID:11028
- C:\Windows\System\VjFkzGk.exe
  C:\Windows\System\VjFkzGk.exe
  2⤵
  PID:11056
- C:\Windows\System\ndwyzBr.exe
  C:\Windows\System\ndwyzBr.exe
  2⤵
  PID:11080
- C:\Windows\System\FUbwDGp.exe
  C:\Windows\System\FUbwDGp.exe
  2⤵
  PID:11112
- C:\Windows\System\pKabuYH.exe
  C:\Windows\System\pKabuYH.exe
  2⤵
  PID:11140
- C:\Windows\System\hUuIood.exe
  C:\Windows\System\hUuIood.exe
  2⤵
  PID:11168
- C:\Windows\System\qUaUieH.exe
  C:\Windows\System\qUaUieH.exe
  2⤵
  PID:11196
- C:\Windows\System\fYsbfxy.exe
  C:\Windows\System\fYsbfxy.exe
  2⤵
  PID:11224
- C:\Windows\System\sWEUgig.exe
  C:\Windows\System\sWEUgig.exe
  2⤵
  PID:11252
- C:\Windows\System\HDNbaxs.exe
  C:\Windows\System\HDNbaxs.exe
  2⤵
  PID:10248
- C:\Windows\System\GuAbtDn.exe
  C:\Windows\System\GuAbtDn.exe
  2⤵
  PID:10292
- C:\Windows\System\JzfyeHe.exe
  C:\Windows\System\JzfyeHe.exe
  2⤵
  PID:10356
- C:\Windows\System\VIvkVkL.exe
  C:\Windows\System\VIvkVkL.exe
  2⤵
  PID:10416
- C:\Windows\System\TLJWkAd.exe
  C:\Windows\System\TLJWkAd.exe
  2⤵
  PID:10520
- C:\Windows\System\IgIpPqQ.exe
  C:\Windows\System\IgIpPqQ.exe
  2⤵
  PID:10588
- C:\Windows\System\WloMyTQ.exe
  C:\Windows\System\WloMyTQ.exe
  2⤵
  PID:10644
- C:\Windows\System\pZKSyjL.exe
  C:\Windows\System\pZKSyjL.exe
  2⤵
  PID:10688
- C:\Windows\System\nLxvvcp.exe
  C:\Windows\System\nLxvvcp.exe
  2⤵
  PID:10756
- C:\Windows\System\ToiyXBi.exe
  C:\Windows\System\ToiyXBi.exe
  2⤵
  PID:10816
- C:\Windows\System\WtUlOsi.exe
  C:\Windows\System\WtUlOsi.exe
  2⤵
  PID:10888
- C:\Windows\System\GnHANZo.exe
  C:\Windows\System\GnHANZo.exe
  2⤵
  PID:10956
- C:\Windows\System\wGzDmgo.exe
  C:\Windows\System\wGzDmgo.exe
  2⤵
  PID:11044
- C:\Windows\System\gdqoHnP.exe
  C:\Windows\System\gdqoHnP.exe
  2⤵
  PID:11108
- C:\Windows\System\uyiJZjO.exe
  C:\Windows\System\uyiJZjO.exe
  2⤵
  PID:11152
- C:\Windows\System\BuLSpjK.exe
  C:\Windows\System\BuLSpjK.exe
  2⤵
  PID:11220
- C:\Windows\System\QsuWYti.exe
  C:\Windows\System\QsuWYti.exe
  2⤵
  PID:10284
- C:\Windows\System\yfvWbmD.exe
  C:\Windows\System\yfvWbmD.exe
  2⤵
  PID:10420
- C:\Windows\System\BPgBbAW.exe
  C:\Windows\System\BPgBbAW.exe
  2⤵
  PID:10548
- C:\Windows\System\NitMrqq.exe
  C:\Windows\System\NitMrqq.exe
  2⤵
  PID:10712
- C:\Windows\System\NmZSMcx.exe
  C:\Windows\System\NmZSMcx.exe
  2⤵
  PID:10820
- C:\Windows\System\QLJoHnH.exe
  C:\Windows\System\QLJoHnH.exe
  2⤵
  PID:11020
- C:\Windows\System\vEXFCvK.exe
  C:\Windows\System\vEXFCvK.exe
  2⤵
  PID:11132
- C:\Windows\System\MWzxjnE.exe
  C:\Windows\System\MWzxjnE.exe
  2⤵
  PID:11260
- C:\Windows\System\vkNXtgP.exe
  C:\Windows\System\vkNXtgP.exe
  2⤵
  PID:10620
- C:\Windows\System\ZkUvxJW.exe
  C:\Windows\System\ZkUvxJW.exe
  2⤵
  PID:11096
- C:\Windows\System\EcmjBGV.exe
  C:\Windows\System\EcmjBGV.exe
  2⤵
  PID:10392
- C:\Windows\System\TDpcvhj.exe
  C:\Windows\System\TDpcvhj.exe
  2⤵
  PID:10720
- C:\Windows\System\vrmCfwi.exe
  C:\Windows\System\vrmCfwi.exe
  2⤵
  PID:11288
- C:\Windows\System\tDjMLth.exe
  C:\Windows\System\tDjMLth.exe
  2⤵
  PID:11316
- C:\Windows\System\XKXMfbr.exe
  C:\Windows\System\XKXMfbr.exe
  2⤵
  PID:11344
- C:\Windows\System\IbldYou.exe
  C:\Windows\System\IbldYou.exe
  2⤵
  PID:11372
- C:\Windows\System\PybfpEF.exe
  C:\Windows\System\PybfpEF.exe
  2⤵
  PID:11388
- C:\Windows\System\BRRsmbA.exe
  C:\Windows\System\BRRsmbA.exe
  2⤵
  PID:11412
- C:\Windows\System\NkyxqZZ.exe
  C:\Windows\System\NkyxqZZ.exe
  2⤵
  PID:11444
- C:\Windows\System\Sosyfrc.exe
  C:\Windows\System\Sosyfrc.exe
  2⤵
  PID:11484
- C:\Windows\System\WMbwiPZ.exe
  C:\Windows\System\WMbwiPZ.exe
  2⤵
  PID:11516
- C:\Windows\System\TAiGVyF.exe
  C:\Windows\System\TAiGVyF.exe
  2⤵
  PID:11540
- C:\Windows\System\mRMudOD.exe
  C:\Windows\System\mRMudOD.exe
  2⤵
  PID:11560
- C:\Windows\System\tCIaDRt.exe
  C:\Windows\System\tCIaDRt.exe
  2⤵
  PID:11600
- C:\Windows\System\sOZEJcF.exe
  C:\Windows\System\sOZEJcF.exe
  2⤵
  PID:11628
- C:\Windows\System\vJHqsUK.exe
  C:\Windows\System\vJHqsUK.exe
  2⤵
  PID:11644
- C:\Windows\System\TVpmccp.exe
  C:\Windows\System\TVpmccp.exe
  2⤵
  PID:11672
- C:\Windows\System\FxWvgwz.exe
  C:\Windows\System\FxWvgwz.exe
  2⤵
  PID:11700
- C:\Windows\System\kcHlGId.exe
  C:\Windows\System\kcHlGId.exe
  2⤵
  PID:11724
- C:\Windows\System\bUXGmbi.exe
  C:\Windows\System\bUXGmbi.exe
  2⤵
  PID:11756
- C:\Windows\System\YOFQhgU.exe
  C:\Windows\System\YOFQhgU.exe
  2⤵
  PID:11788
- C:\Windows\System\SxNIAJm.exe
  C:\Windows\System\SxNIAJm.exe
  2⤵
  PID:11824
- C:\Windows\System\NFsHmTb.exe
  C:\Windows\System\NFsHmTb.exe
  2⤵
  PID:11844
- C:\Windows\System\YonKmpy.exe
  C:\Windows\System\YonKmpy.exe
  2⤵
  PID:11880
- C:\Windows\System\APChAGx.exe
  C:\Windows\System\APChAGx.exe
  2⤵
  PID:11896
- C:\Windows\System\PyietGL.exe
  C:\Windows\System\PyietGL.exe
  2⤵
  PID:11916
- C:\Windows\System\csKrAem.exe
  C:\Windows\System\csKrAem.exe
  2⤵
  PID:11940
- C:\Windows\System\awjJaaA.exe
  C:\Windows\System\awjJaaA.exe
  2⤵
  PID:11968
- C:\Windows\System\pILypfh.exe
  C:\Windows\System\pILypfh.exe
  2⤵
  PID:11984
- C:\Windows\System\gdxvtdK.exe
  C:\Windows\System\gdxvtdK.exe
  2⤵
  PID:12008
- C:\Windows\System\mpDNlDS.exe
  C:\Windows\System\mpDNlDS.exe
  2⤵
  PID:12024
- C:\Windows\System\iiAxFYi.exe
  C:\Windows\System\iiAxFYi.exe
  2⤵
  PID:12080
- C:\Windows\System\NFIUSFd.exe
  C:\Windows\System\NFIUSFd.exe
  2⤵
  PID:12100
- C:\Windows\System\InhNroG.exe
  C:\Windows\System\InhNroG.exe
  2⤵
  PID:12160
- C:\Windows\System\DYDmhxs.exe
  C:\Windows\System\DYDmhxs.exe
  2⤵
  PID:12176
- C:\Windows\System\jlIfrBI.exe
  C:\Windows\System\jlIfrBI.exe
  2⤵
  PID:12212
- C:\Windows\System\yTtYSvx.exe
  C:\Windows\System\yTtYSvx.exe
  2⤵
  PID:12232
- C:\Windows\System\mmVAHDA.exe
  C:\Windows\System\mmVAHDA.exe
  2⤵
  PID:12264
- C:\Windows\System\mKdDApT.exe
  C:\Windows\System\mKdDApT.exe
  2⤵
  PID:10508
- C:\Windows\System\abGomco.exe
  C:\Windows\System\abGomco.exe
  2⤵
  PID:11332
- C:\Windows\System\GWfVQJO.exe
  C:\Windows\System\GWfVQJO.exe
  2⤵
  PID:11368
- C:\Windows\System\edihqCm.exe
  C:\Windows\System\edihqCm.exe
  2⤵
  PID:11468
- C:\Windows\System\uRdCMoT.exe
  C:\Windows\System\uRdCMoT.exe
  2⤵
  PID:11532
- C:\Windows\System\LGvJcbW.exe
  C:\Windows\System\LGvJcbW.exe
  2⤵
  PID:11592
- C:\Windows\System\ZMeejvx.exe
  C:\Windows\System\ZMeejvx.exe
  2⤵
  PID:11660
- C:\Windows\System\JOjCwBk.exe
  C:\Windows\System\JOjCwBk.exe
  2⤵
  PID:11716
- C:\Windows\System\wJjxsgO.exe
  C:\Windows\System\wJjxsgO.exe
  2⤵
  PID:4000
- C:\Windows\System\UcmNDVZ.exe
  C:\Windows\System\UcmNDVZ.exe
  2⤵
  PID:11796
- C:\Windows\System\ADzfeCJ.exe
  C:\Windows\System\ADzfeCJ.exe
  2⤵
  PID:11864
- C:\Windows\System\ZlkkJAo.exe
  C:\Windows\System\ZlkkJAo.exe
  2⤵
  PID:11888
- C:\Windows\System\midEIfp.exe
  C:\Windows\System\midEIfp.exe
  2⤵
  PID:11976
- C:\Windows\System\bAvtKON.exe
  C:\Windows\System\bAvtKON.exe
  2⤵
  PID:12048
- C:\Windows\System\bEKpWbM.exe
  C:\Windows\System\bEKpWbM.exe
  2⤵
  PID:12124
- C:\Windows\System\zYJxAVL.exe
  C:\Windows\System\zYJxAVL.exe
  2⤵
  PID:12200
- C:\Windows\System\WYHjSoS.exe
  C:\Windows\System\WYHjSoS.exe
  2⤵
  PID:12248
- C:\Windows\System\WePexPW.exe
  C:\Windows\System\WePexPW.exe
  2⤵
  PID:11328
- C:\Windows\System\bKdfhIU.exe
  C:\Windows\System\bKdfhIU.exe
  2⤵
  PID:11436
- C:\Windows\System\WNaPhEj.exe
  C:\Windows\System\WNaPhEj.exe
  2⤵
  PID:11524
- C:\Windows\System\lATiufn.exe
  C:\Windows\System\lATiufn.exe
  2⤵
  PID:3432
- C:\Windows\System\YOeqKLw.exe
  C:\Windows\System\YOeqKLw.exe
  2⤵
  PID:11912
- C:\Windows\System\rpjFJTZ.exe
  C:\Windows\System\rpjFJTZ.exe
  2⤵
  PID:12060
- C:\Windows\System\IWyNFbj.exe
  C:\Windows\System\IWyNFbj.exe
  2⤵
  PID:12088
- C:\Windows\System\AFBKDMn.exe
  C:\Windows\System\AFBKDMn.exe
  2⤵
  PID:11356
- C:\Windows\System\NUkflJC.exe
  C:\Windows\System\NUkflJC.exe
  2⤵
  PID:11684
- C:\Windows\System\dUhsphp.exe
  C:\Windows\System\dUhsphp.exe
  2⤵
  PID:11936
- C:\Windows\System\vgxfKGD.exe
  C:\Windows\System\vgxfKGD.exe
  2⤵
  PID:12168
- C:\Windows\System\rEQxHrG.exe
  C:\Windows\System\rEQxHrG.exe
  2⤵
  PID:11852
- C:\Windows\System\geVpOKZ.exe
  C:\Windows\System\geVpOKZ.exe
  2⤵
  PID:11576
- C:\Windows\System\gYURsSr.exe
  C:\Windows\System\gYURsSr.exe
  2⤵
  PID:12320
- C:\Windows\System\XLhVsJm.exe
  C:\Windows\System\XLhVsJm.exe
  2⤵
  PID:12340
- C:\Windows\System\LpXPJkZ.exe
  C:\Windows\System\LpXPJkZ.exe
  2⤵
  PID:12384
- C:\Windows\System\cYqwQyY.exe
  C:\Windows\System\cYqwQyY.exe
  2⤵
  PID:12412
- C:\Windows\System\JUDRnMP.exe
  C:\Windows\System\JUDRnMP.exe
  2⤵
  PID:12432
- C:\Windows\System\KPdNkEJ.exe
  C:\Windows\System\KPdNkEJ.exe
  2⤵
  PID:12456
- C:\Windows\System\GliDPHD.exe
  C:\Windows\System\GliDPHD.exe
  2⤵
  PID:12484
- C:\Windows\System\SmTKnPQ.exe
  C:\Windows\System\SmTKnPQ.exe
  2⤵
  PID:12524
- C:\Windows\System\dyDLvga.exe
  C:\Windows\System\dyDLvga.exe
  2⤵
  PID:12552
- C:\Windows\System\PwaMZpv.exe
  C:\Windows\System\PwaMZpv.exe
  2⤵
  PID:12580
- C:\Windows\System\batszvV.exe
  C:\Windows\System\batszvV.exe
  2⤵
  PID:12608
- C:\Windows\System\ttOxHlO.exe
  C:\Windows\System\ttOxHlO.exe
  2⤵
  PID:12624
- C:\Windows\System\FGTIaKo.exe
  C:\Windows\System\FGTIaKo.exe
  2⤵
  PID:12664
- C:\Windows\System\BHPLbNQ.exe
  C:\Windows\System\BHPLbNQ.exe
  2⤵
  PID:12692
- C:\Windows\System\VZCADBv.exe
  C:\Windows\System\VZCADBv.exe
  2⤵
  PID:12708
- C:\Windows\System\cAlxwEK.exe
  C:\Windows\System\cAlxwEK.exe
  2⤵
  PID:12748
- C:\Windows\System\WwRUdxH.exe
  C:\Windows\System\WwRUdxH.exe
  2⤵
  PID:12772
- C:\Windows\System\YviiIzy.exe
  C:\Windows\System\YviiIzy.exe
  2⤵
  PID:12804
- C:\Windows\System\VVUNifQ.exe
  C:\Windows\System\VVUNifQ.exe
  2⤵
  PID:12824
- C:\Windows\System\gGhEBds.exe
  C:\Windows\System\gGhEBds.exe
  2⤵
  PID:12860
- C:\Windows\System\kbtMOQB.exe
  C:\Windows\System\kbtMOQB.exe
  2⤵
  PID:12888
- C:\Windows\System\wgMrXnO.exe
  C:\Windows\System\wgMrXnO.exe
  2⤵
  PID:12916
- C:\Windows\System\xlXiaMf.exe
  C:\Windows\System\xlXiaMf.exe
  2⤵
  PID:12932
- C:\Windows\System\PPDaabK.exe
  C:\Windows\System\PPDaabK.exe
  2⤵
  PID:12964
- C:\Windows\System\ASwewuy.exe
  C:\Windows\System\ASwewuy.exe
  2⤵
  PID:13000
- C:\Windows\System\qCpgHvG.exe
  C:\Windows\System\qCpgHvG.exe
  2⤵
  PID:13016
- C:\Windows\System\HEhPLTQ.exe
  C:\Windows\System\HEhPLTQ.exe
  2⤵
  PID:13056
- C:\Windows\System\PnIFsQD.exe
  C:\Windows\System\PnIFsQD.exe
  2⤵
  PID:13072
- C:\Windows\System\XFiQroF.exe
  C:\Windows\System\XFiQroF.exe
  2⤵
  PID:13104
- C:\Windows\System\ZAoEEuD.exe
  C:\Windows\System\ZAoEEuD.exe
  2⤵
  PID:13136
- C:\Windows\System\yfRHFCS.exe
  C:\Windows\System\yfRHFCS.exe
  2⤵
  PID:13160
- C:\Windows\System\ZZfdisC.exe
  C:\Windows\System\ZZfdisC.exe
  2⤵
  PID:13188
- C:\Windows\System\cGaalLm.exe
  C:\Windows\System\cGaalLm.exe
  2⤵
  PID:13228
- C:\Windows\System\itUDwEs.exe
  C:\Windows\System\itUDwEs.exe
  2⤵
  PID:13244
- C:\Windows\System\LBcECyA.exe
  C:\Windows\System\LBcECyA.exe
  2⤵
  PID:13284
- C:\Windows\System\TTBBRFQ.exe
  C:\Windows\System\TTBBRFQ.exe
  2⤵
  PID:13068
- C:\Windows\System\aKtwZoA.exe
  C:\Windows\System\aKtwZoA.exe
  2⤵
  PID:13116
- C:\Windows\System\ddAuFAr.exe
  C:\Windows\System\ddAuFAr.exe
  2⤵
  PID:13200
- C:\Windows\System\QMtdIRj.exe
  C:\Windows\System\QMtdIRj.exe
  2⤵
  PID:13276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hnkwuqef.0xt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EaNKAim.exe

Filesize
3.9MB

MD5
4972152552b3a4f2eac10a19ad1c7487

SHA1
edf3b2dba1351b6d7703a7b323c27c42a003db4f

SHA256
e2702216497cb770d28a95af3e56138df81a82d06acd8e059462cc528bbae007

SHA512
a4c0d94ea68086df1572fbaa329e719ca88fb371c843b3acc309896b2443351313442876040129c2467ee9870bff4fed021bdf4dd20ae597870e04c63d83ada2

Download Submit
C:\Windows\System\KWNohEy.exe

Filesize
3.9MB

MD5
fc3494844ce7bdcfc57661e322403d9e

SHA1
da648522b754a1f69cf218855645e5429c644002

SHA256
d3ff81a7fe75924b5e0b0fe0fb501f58802208e465b96b90d453cc7e44888c0f

SHA512
728463463df0f1150376cd4cdefa356596c8208112a5f78112fa49b7438a46de16c3e05ae514ce26b73ebd69eea58095645379ae187e6ee37a380d684210d4ba

Download Submit
C:\Windows\System\LWPsXCq.exe

Filesize
3.9MB

MD5
a79842f861f11b0aca7dac511f60c135

SHA1
13ac3956a30e261acc3ad31710f15c01c9f6882f

SHA256
c5207bb5b29b1aa539401fa145f05ae7f1e40d88f297fd722c95a8806b4d8014

SHA512
537a1b0b77b05d7bbdfce87e3c062fb6fa941fea5bd2083ef36bad214c0cd0d82cbb5de7c350972f1eda5a142c0f42d933a259887a582343eb8e9e44eb1279a4

Download Submit
C:\Windows\System\PCLXABz.exe

Filesize
3.9MB

MD5
653108676d3c15e059e75b7dfadffe9a

SHA1
d1a7991d15223eea6894bb0d9b16809369f0e06c

SHA256
c40e8a1a7edb838e1d61d2bad403ea84cc3e69eb15fddc0184e8a0b88539a586

SHA512
0b87e7432a056165e35205704c039a2b8e6871a227a69241495e1d649df8e6a13d99f026787d2d38133d81d0700dfa406f660bbbc66d3829d31607af4feba8fe

Download Submit
C:\Windows\System\PfFnmLD.exe

Filesize
3.9MB

MD5
cbda15af14ea65c66a4b7420e27c2bd9

SHA1
ddeb61f2e362aead2e26056a4ac1510557c5f054

SHA256
6f1621444eaaa7cd631082af81d44f8ba8f8db3780346498ae71e23b6ac9ec20

SHA512
a7c2ea89378b20377a371167ef95db97138208cd0bf55520d24870e8781715ba8c98947b86fae10ba28c50326582a52deb77c2715e468f1407a23534725f2e9e

Download Submit
C:\Windows\System\PrqJdLI.exe

Filesize
3.9MB

MD5
666d45ab9bce4483455f08920abac3aa

SHA1
02a7937836397cdb2eca4c42c1db7dcac3e097ee

SHA256
f0fc95979355f05fc06306bb412a6a5b7c2f6e2b45f4b615912fc6acb689d141

SHA512
93f4b4bd6bf8c664a0dcaf8b7cc0cebd7c9e80e30014f91fb9e7b069d8908ffd073af1dda60c6ed939361d53abb4bcd907a334c4ba2ef7a064826f51ca2be254

Download Submit
C:\Windows\System\QtiQeGN.exe

Filesize
3.9MB

MD5
79c0eda2ad325cd2429dc7139d7f53d4

SHA1
93b13ebe3400f624ca93d538d93e1f4f768a2f74

SHA256
cedae002a692744e65ea1cc362c2c7512c981cc2386cb03becf48f15ca0549c8

SHA512
dc75841e394c8ea233f011ea42128253fe4e436992dcbf3bb202231ece248ede30db568ef05cc3dbaeadef2730bd57965edbb8341b8086003fc40561aa1cacfa

Download Submit
C:\Windows\System\SbLUfAo.exe

Filesize
3.9MB

MD5
a7ed3c0dfb2277468b7bcb9a8dc148d0

SHA1
7de667e07920788a34625e2b18c2b60c3e4a68d7

SHA256
790db2ac12a037816ded4fc8b875f66c54d91cf750571472bc60a0f4d4ab7b20

SHA512
70810cfea8f82665aae10628b4fd6be0725b451d9a227b4213f1e70568a4fe19152842ace67512461817f279a74a534d27ab0d4c3795e1a701ee7a83abf65606

Download Submit
C:\Windows\System\WsXTBtU.exe

Filesize
3.9MB

MD5
f9b8641dd8395f7585a5b60b02581c9b

SHA1
44a362d9f5681dd0683f5b38a35760387b075b9c

SHA256
38721bd5439fddf68ef34fbe9bfdb0a9a455da489492941777687bebeba31116

SHA512
9a6382583649049819431b942a97d5fe182ea16598515afd4e7d9287f262701351c1434965d312de32b55f72960cad5cab8ef21e756f8b63fa8c78495fec13cf

Download Submit
C:\Windows\System\XLSkDLj.exe

Filesize
3.9MB

MD5
98f6f0c04d1456c4efecd837594d524f

SHA1
1495390ce9a3c799fd36a2bec2dae36f3724d878

SHA256
3cc664235836906ceae0718994f5b1ccab33301e549d29ceb6cb54f64bb4f1af

SHA512
e2f6a74379e297e29b925fd1108805d117a91ae8466a835bb0414fa0cc2477ad493cbcdc1f704594b43acc6b85abfde5e61f41bdcd3e519b23b1507a87d829b3

Download Submit
C:\Windows\System\ZymAWqd.exe

Filesize
3.9MB

MD5
e65e89b97b73d57bafb7da969f7ee040

SHA1
e7088670fff632e599deda8df634ab2a41cb5932

SHA256
6d88a1f1f5523c38b2c566e508295eb4fd687eac053391aca4805c7dc9f6bb4d

SHA512
38a1c0852b8f00cf0878cbec0aa5587476ef7facd7886addc75d112683a6756778841fc1960a2544829fea8281be76f3c2ad32116ad2f4a03444572855228d42

Download Submit
C:\Windows\System\aRPRBwy.exe

Filesize
3.9MB

MD5
b52921376fc90d2e0a4e339e1695928a

SHA1
5153166a9b9c6aa2318b847b87121c1af3b5c96b

SHA256
df6316a35e6156d351e3107265d3d0e6713022e9c45fec8f0e6a5cc76d26576d

SHA512
52d7addc4f88a475d78142632e35aad10b94395b21bb855c78b141e21711bea6b5d3b8109bfbb7a2f9ec6474ab933c39c19aaf61693e38cbfb1f7addd1ed2543

Download Submit
C:\Windows\System\apgFgTH.exe

Filesize
3.9MB

MD5
c4942fd4ae3ec2e241cf3103e1d760ed

SHA1
7d14d20e48de906c7f9ca562521e16f42a2e1e06

SHA256
098b02999279a17dd0c66c4897543146e262a8c8378fb7542009056da1e7ec3d

SHA512
22401e3ea9b32adaef04c110944ae89a992587d086338e5d60348cd2f94eff85e2e560aae8875cf2f4cb0f3e557cb26a500a4521d0d5429a54b0f58061e830c8

Download Submit
C:\Windows\System\bDQJpKU.exe

Filesize
3.9MB

MD5
742c153423fab756538d35ae96473d2b

SHA1
7da2829d67b3d456662bc4c626f982cc86cdac72

SHA256
1904af99c30155dbfb45705dfbf96d942fed3b3f19dfeff8b59810506317b4be

SHA512
7f7358fe8a96549991a5dfd898dd4a347f8b4af013f3a00e1249efcc8b05379f4f394e16f91870ae47439de7cac4c393499cee346be04388bba71e40b8242630

Download Submit
C:\Windows\System\bSTpRug.exe

Filesize
3.9MB

MD5
6669d99c6a868bc2fa3ce0d2e537ce35

SHA1
6404bad1a6a60c5b59a87d3eddbd7d11535851f3

SHA256
20fbf879d1b46f687a56f99fe7d445b4d68b88337543c8de2f703bbae8cfd40c

SHA512
c070139b7656d335f9e8a8055d532795b4fefd9c443b60782aaa74a2d74d625c8aae2ffd6d347e534fe4b4afd57510d82ad87ebf5d744d27e622aa2cb9042ed6

Download Submit
C:\Windows\System\dFXWveA.exe

Filesize
3.9MB

MD5
49688601ff785c48be28430854d33caa

SHA1
6b8e2e398c65c0b72244e5dbfb94a75fa1da976f

SHA256
85b22a552e25db260de8c7cbb3d964734fae607285adba62c6d5145679cdfbc7

SHA512
f6ae702a87321b0e61c59e807d8ed092f51fc1a7fcef9a31dff3d0940ab472be09256a5be45d1c7c563ebf0681d5ab4e75801b5d4bfd9efdd73bf31837a10cb4

Download Submit
C:\Windows\System\dvDIWRw.exe

Filesize
3.9MB

MD5
59197e9ef2e7212afe347546fb597c36

SHA1
9e392fbfc20dbab59143772fbd1be3d2c854f82c

SHA256
a8d598a5e2913ee091460b6042bd32b672f167295c89ca56102beadb1bf5557e

SHA512
7a1f9d1e890c126037939d17f2ea0fcaac1ce32184c9daecfec0cbf88c2cccecf4ca3aa2382508aad6c0d52e16c442a6762da1d1d30e53c4be189b63283b2f87

Download Submit
C:\Windows\System\dwyYLJW.exe

Filesize
3.9MB

MD5
7b15a8e1e0de1f3e060bec77d883ce1a

SHA1
f72648f41c4417bbb4e728558850a38e1f3a69da

SHA256
cb4744132e3ed245ac8fe9baf5c74acb06af1672c36e803da7d0036e2a5c28b5

SHA512
45f5761aeda93ff6b1b1ff3cb29b4183735184ac84504e7a6d42c3ac64efdf18850382bf109e747e42bfa0aefd4a1c0062dc7a86f8e32e47d29d2de8a67975e1

Download Submit
C:\Windows\System\ebEJLSu.exe

Filesize
3.9MB

MD5
ebbbb6ace7133e1d6de48fb352ad152f

SHA1
0c92779417612dd9739eadf528c863c619b4b37d

SHA256
556ed18388bb9d11c807ae44518f0ce15843be386ec72c2fb5382b9dee35bbc0

SHA512
21fbe81d107d9860f03a4a3c502e1c98c79421d581c8d0fdcc66a44e08d701960bb54cd923aeaf8e2672a31ff684de483f611a9f82839e8ee61a55945db12f76

Download Submit
C:\Windows\System\hUDsOox.exe

Filesize
3.9MB

MD5
ccbcfdc9b527333b73a9f0b5a8ee386b

SHA1
30c0ccc127e11c4eb24cf7a532e24d879ea46086

SHA256
b00dea71519e65d9ff3af0c00d79dee303e3e266a8b4929d647cbfbd18e9d095

SHA512
02616b75262ddfbd92722492f165a45b6acfb5911e153cf2567da6a975063c7bde6f974132598605277db80c0a1926b3799d2540af3414e17b95f23e65b2f917

Download Submit
C:\Windows\System\hUsFKak.exe

Filesize
3.9MB

MD5
0a228ddb6465c1d957832fd77b1d2e9d

SHA1
07ff6eb4c20f966b3720d12d65aa7999937c102f

SHA256
83748e98902953267856500fae077a8acd1c603f260d7c9fc5c9260087dc68a3

SHA512
98bf50176395b54199013d16eb6370eed14fee4d587df1d0d28db536fb1ff23580d0e2e5030985067b833d1a722d5e5b5dfcda8e3aa1dd7878430e123f789a71

Download Submit
C:\Windows\System\jthYOAD.exe

Filesize
3.9MB

MD5
00c111dc8c2d08a1f61a0257d4a1d27f

SHA1
c50927dc338919e43013f392cb958860cc157083

SHA256
960cc1cfa5b52d3a51bffff2be41eea358436f8c8b2bf5bf112260c8464f7a30

SHA512
dacf59450570c1998d88bf827e344157f96472d2db5eb4df4fa7ceb78bfc9c2377c062552a78d1a53dd26d742d8a165629f7c5e27efa928add5a7652b5f45481

Download Submit
C:\Windows\System\kQdgNVs.exe

Filesize
3.9MB

MD5
9de07dbdd75363bdd9cfc8dbacb2ef3b

SHA1
280316b966cc9553ea48dded9545b1bcc47ae101

SHA256
6b942166cf756f18e16d17fc756fd57e30c095f7eed3d40774d7e8923e6a8695

SHA512
773b1af4c935b615a45ac9c9c0f1060599c88ece3f6ef0016381681f0b48ec9ad6ca9edfb9a35f8ca99d170b2659e93ee0c0db90685f832b7189c47fd156b2e7

Download Submit
C:\Windows\System\lbUmqhs.exe

Filesize
3.9MB

MD5
fbaabeaad49bd427ea493815d89a3781

SHA1
8de3bea392bdc1dd6e150ee716cd0fe6bb5cbc81

SHA256
2d68d4246c274bbebc3b01e235ce6608ffb76110c2d2dbd19ed20b40eb13caf0

SHA512
cc1a58a73b8848863492f1092255c987816fa4293f15ebce33862370e23366c8e705c43fb2de5a70076984b9263d5dff0d166c0e9287f488ac56ce8f046d4948

Download Submit
C:\Windows\System\lwQsUBp.exe

Filesize
3.9MB

MD5
0b5c916a8281ca39b8d2f97f5dd2fc75

SHA1
981912a908610305596a2d1bac62aa6eab7489a8

SHA256
510e86133cf1126be8b41073b9a5b1e1a7a4031242bd631779403646b8e4ba42

SHA512
bd7c4ac35e0b63a3eac054f182a93b195a1d8cec0c493f21afc048eb56f74806b875e01fa8bf09b06a22bb8ba642608f680afdff72cb80ef8964eb3647df98b3

Download Submit
C:\Windows\System\mrDAdgF.exe

Filesize
3.9MB

MD5
a7405322d1e44fbd7ca71fc4c0905b63

SHA1
e003b7b8e070a747520037f7ac29f228ac8d2ea1

SHA256
e6a5a5a1114967e4b8759ff72d30833bbc29e782f4e4c1303713fdfe445773b2

SHA512
78fd98d5c32e0030097a329037f524e395e198586ee233cb2e75b7c9a87cb39be06b9c7a33a868c4fffaf36393fb3aa9901acaa929af30983a9f8a89253ae47a

Download Submit
C:\Windows\System\nyMTvxJ.exe

Filesize
3.9MB

MD5
a42f737bc500b12c89e271ed579a9b9d

SHA1
b77dd8cb827d585a4a6a1fdbc45cbc16ec704b38

SHA256
3fec928fa5fa4401b549eb8e0fee18c7098f1a51a760a8df86b80d707ee17ce0

SHA512
44520f6ac3de5588ccf412410f0f75764447c8b4d3bfc7388e2411e0f0ebd2860cc267626e2457cc9ab3f265b69a822d1e36146ee5d40fc74f4972b109a89a87

Download Submit
C:\Windows\System\odVhKtR.exe

Filesize
3.9MB

MD5
e8143ce2184d4a0abf3042b655a7fb04

SHA1
2992ba41d216af94713c411b649ffdb68e467f07

SHA256
af03d1939f38212353b61b82647c8f3486dfdb57c2184dd175a4ddefacd47ffd

SHA512
c9a453a48105fbe3046d8e561d0b05f10da85e2b9df4d1e469ef3311a9ef84d951d5befab9fc93e870678b83bf632a6976b3f3b89b9b369d2c66436d36d50c7a

Download Submit
C:\Windows\System\pFfwvkw.exe

Filesize
3.9MB

MD5
115bcec488231595894fbf64c7e76700

SHA1
b7472e4574e9773fd1b99d08d2e7da154beea32f

SHA256
e99ff2e65b685cb84a853778b08a98e416d2be12a50f9df9f6965c3c04d58785

SHA512
cec13a759a8e7cebc1a4b60900152250e2d9a1768a361f65d6f8f8a2d0bb13d9c96878246c6ae90a3519e1784c6ad1eccb7b39848aa9191e5cedd4d05a70247d

Download Submit
C:\Windows\System\qanZgur.exe

Filesize
3.9MB

MD5
590e52ed91c4cd86c5117ef81f628998

SHA1
aefa34f8ab51e68923966ad7a018ccab5928f13c

SHA256
f42e892efe88031f75a531cf71a84e2b22658de4d0e4bbaecd8bd3f210d83cbc

SHA512
0d2edfffa856a60fcb2cf85ec7f3a5da81b2bc904b33db2b16863959f3f683a63c7b9735d16ddb7011f227f5947c335b8c16274c9bf4583d2fcad402a3fa9334

Download Submit
C:\Windows\System\qjFKxUQ.exe

Filesize
3.9MB

MD5
5fe32ce03389273b9fbc2f0bbe3a9465

SHA1
07f401be1f78cf120fc8639f55214016b677b5c5

SHA256
9d92d811cd0da62689cbaf1547462f03d000449c583c9ee8a126b80ee1371bf1

SHA512
6362776e86a5238a97e1f742f7296d910ff5f494e21236c71687a665e064fdd915119abe54b82fc702b5290bc95eaf1623d56b5def08c67f041940178c0f42b9

Download Submit
C:\Windows\System\rqylwJa.exe

Filesize
3.9MB

MD5
876d898c1cc87f26edef7a3e844529a7

SHA1
e1b07aa6f7f5f68ee3c394ab4c541f78e8deefad

SHA256
38429e948b47d1a7ff77c47b04086e51202cdcd2e64f637119d6268e5fd1a4e6

SHA512
75f8c330ef5f2a2711cf01c7d8a5e32158a1a47daef1e7a7ebd0dce917abcf09f047172fd5794aacc930024351db14ddc3c18bdd108c437b7eb88797f4f18f9e

Download Submit
C:\Windows\System\tCTqrjz.exe

Filesize
3.9MB

MD5
9c3fbce61fd35b2bf2ac6e9ddda7f499

SHA1
83a5643c318d3b1c52d898c2ef30ab19684fe946

SHA256
5d03a97a598ad6e39232b9a291740b064382e92d8f18112b52c6551b813d6cbc

SHA512
dff0c467dd0b19158a3a9fb68d48777291509abfcd70f9bbdd2cedf38e5f671c8b7f75513316df5826ea6adb07d33654ea48f037c4da0aade46185027eaf8b66

Download Submit
memory/540-2325-0x00007FF672AA0000-0x00007FF672E96000-memory.dmp

Filesize
4.0MB

Download
memory/540-133-0x00007FF672AA0000-0x00007FF672E96000-memory.dmp

Filesize
4.0MB

Download
memory/696-35-0x00007FFA07260000-0x00007FFA07D21000-memory.dmp

Filesize
10.8MB

Download
memory/696-3-0x00007FFA07263000-0x00007FFA07265000-memory.dmp

Filesize
8KB

Download
memory/696-136-0x000001E37E130000-0x000001E37E8D6000-memory.dmp

Filesize
7.6MB

Download
memory/696-81-0x00007FFA07260000-0x00007FFA07D21000-memory.dmp

Filesize
10.8MB

Download
memory/696-1558-0x00007FFA07260000-0x00007FFA07D21000-memory.dmp

Filesize
10.8MB

Download
memory/696-58-0x000001E362E50000-0x000001E362E72000-memory.dmp

Filesize
136KB

Download
memory/696-1553-0x00007FFA07263000-0x00007FFA07265000-memory.dmp

Filesize
8KB

Download
memory/768-122-0x00007FF618F40000-0x00007FF619336000-memory.dmp

Filesize
4.0MB

Download
memory/768-2324-0x00007FF618F40000-0x00007FF619336000-memory.dmp

Filesize
4.0MB

Download
memory/1112-2319-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp

Filesize
4.0MB

Download
memory/1112-102-0x00007FF7E68B0000-0x00007FF7E6CA6000-memory.dmp

Filesize
4.0MB

Download
memory/1268-2329-0x00007FF733380000-0x00007FF733776000-memory.dmp

Filesize
4.0MB

Download
memory/1268-127-0x00007FF733380000-0x00007FF733776000-memory.dmp

Filesize
4.0MB

Download
memory/1416-2336-0x00007FF6D59B0000-0x00007FF6D5DA6000-memory.dmp

Filesize
4.0MB

Download
memory/1416-283-0x00007FF6D59B0000-0x00007FF6D5DA6000-memory.dmp

Filesize
4.0MB

Download
memory/1440-121-0x00007FF710BA0000-0x00007FF710F96000-memory.dmp

Filesize
4.0MB

Download
memory/1440-2323-0x00007FF710BA0000-0x00007FF710F96000-memory.dmp

Filesize
4.0MB

Download
memory/1612-2321-0x00007FF695360000-0x00007FF695756000-memory.dmp

Filesize
4.0MB

Download
memory/1612-120-0x00007FF695360000-0x00007FF695756000-memory.dmp

Filesize
4.0MB

Download
memory/2080-130-0x00007FF7DA590000-0x00007FF7DA986000-memory.dmp

Filesize
4.0MB

Download
memory/2080-2335-0x00007FF7DA590000-0x00007FF7DA986000-memory.dmp

Filesize
4.0MB

Download
memory/2208-2331-0x00007FF79D1A0000-0x00007FF79D596000-memory.dmp

Filesize
4.0MB

Download
memory/2208-134-0x00007FF79D1A0000-0x00007FF79D596000-memory.dmp

Filesize
4.0MB

Download
memory/2312-2326-0x00007FF73B140000-0x00007FF73B536000-memory.dmp

Filesize
4.0MB

Download
memory/2312-124-0x00007FF73B140000-0x00007FF73B536000-memory.dmp

Filesize
4.0MB

Download
memory/2408-125-0x00007FF6E8C10000-0x00007FF6E9006000-memory.dmp

Filesize
4.0MB

Download
memory/2408-2322-0x00007FF6E8C10000-0x00007FF6E9006000-memory.dmp

Filesize
4.0MB

Download
memory/2916-2330-0x00007FF6AAA40000-0x00007FF6AAE36000-memory.dmp

Filesize
4.0MB

Download
memory/2916-129-0x00007FF6AAA40000-0x00007FF6AAE36000-memory.dmp

Filesize
4.0MB

Download
memory/2984-113-0x00007FF78E560000-0x00007FF78E956000-memory.dmp

Filesize
4.0MB

Download
memory/2984-2320-0x00007FF78E560000-0x00007FF78E956000-memory.dmp

Filesize
4.0MB

Download
memory/3156-112-0x00007FF789B80000-0x00007FF789F76000-memory.dmp

Filesize
4.0MB

Download
memory/3156-2318-0x00007FF789B80000-0x00007FF789F76000-memory.dmp

Filesize
4.0MB

Download
memory/3300-2338-0x00007FF692A00000-0x00007FF692DF6000-memory.dmp

Filesize
4.0MB

Download
memory/3300-331-0x00007FF692A00000-0x00007FF692DF6000-memory.dmp

Filesize
4.0MB

Download
memory/3512-131-0x00007FF7BC080000-0x00007FF7BC476000-memory.dmp

Filesize
4.0MB

Download
memory/3512-2333-0x00007FF7BC080000-0x00007FF7BC476000-memory.dmp

Filesize
4.0MB

Download
memory/3784-2332-0x00007FF6C8790000-0x00007FF6C8B86000-memory.dmp

Filesize
4.0MB

Download
memory/3784-135-0x00007FF6C8790000-0x00007FF6C8B86000-memory.dmp

Filesize
4.0MB

Download
memory/3828-2327-0x00007FF625240000-0x00007FF625636000-memory.dmp

Filesize
4.0MB

Download
memory/3828-123-0x00007FF625240000-0x00007FF625636000-memory.dmp

Filesize
4.0MB

Download
memory/3852-132-0x00007FF7E3960000-0x00007FF7E3D56000-memory.dmp

Filesize
4.0MB

Download
memory/3852-2317-0x00007FF7E3960000-0x00007FF7E3D56000-memory.dmp

Filesize
4.0MB

Download
memory/4424-2315-0x00007FF71D5B0000-0x00007FF71D9A6000-memory.dmp

Filesize
4.0MB

Download
memory/4424-2339-0x00007FF71D5B0000-0x00007FF71D9A6000-memory.dmp

Filesize
4.0MB

Download
memory/4424-310-0x00007FF71D5B0000-0x00007FF71D9A6000-memory.dmp

Filesize
4.0MB

Download
memory/4668-126-0x00007FF60A250000-0x00007FF60A646000-memory.dmp

Filesize
4.0MB

Download
memory/4668-2328-0x00007FF60A250000-0x00007FF60A646000-memory.dmp

Filesize
4.0MB

Download
memory/4736-2316-0x00007FF64A790000-0x00007FF64AB86000-memory.dmp

Filesize
4.0MB

Download
memory/4736-98-0x00007FF64A790000-0x00007FF64AB86000-memory.dmp

Filesize
4.0MB

Download
memory/4816-128-0x00007FF61A8F0000-0x00007FF61ACE6000-memory.dmp

Filesize
4.0MB

Download
memory/4816-2334-0x00007FF61A8F0000-0x00007FF61ACE6000-memory.dmp

Filesize
4.0MB

Download
memory/4988-290-0x00007FF628230000-0x00007FF628626000-memory.dmp

Filesize
4.0MB

Download
memory/4988-2337-0x00007FF628230000-0x00007FF628626000-memory.dmp

Filesize
4.0MB

Download
memory/5008-0-0x00007FF6EBA10000-0x00007FF6EBE06000-memory.dmp

Filesize
4.0MB

Download
memory/5008-1291-0x00007FF6EBA10000-0x00007FF6EBE06000-memory.dmp

Filesize
4.0MB

Download
memory/5008-1-0x000001BFA20D0000-0x000001BFA20E0000-memory.dmp

Filesize
64KB

Download