xmrig | 248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04

Analysis

max time kernel
92s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
Size

2.4MB
MD5

04105be5560aefe4bdac0d9930767bff
SHA1

2be79c8817342f94eb3b2aa15902ace1ed464cb0
SHA256

248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04
SHA512

931c7f515fad45eb2d5fc5f1dcf730563c40fa948a6cc0fcc7b9913785509812fdc46cdb4df54f65ac8024a6dd9e05f3c3a8297fb7051d6b970cdbd8b8d1be5c
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkibTIA5ybH9R:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RO

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1980-0-0x00007FF6E6400000-0x00007FF6E67F6000-memory.dmp	xmrig
behavioral2/files/0x000800000002341f-5.dat	xmrig
behavioral2/files/0x0008000000023422-19.dat	xmrig
behavioral2/files/0x0007000000023423-15.dat	xmrig
behavioral2/memory/1564-10-0x00007FF6DD070000-0x00007FF6DD466000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-26.dat	xmrig
behavioral2/memory/4568-31-0x00007FF624660000-0x00007FF624A56000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-44.dat	xmrig
behavioral2/files/0x000700000002342e-84.dat	xmrig
behavioral2/files/0x0007000000023433-94.dat	xmrig
behavioral2/memory/3544-123-0x00007FF62B400000-0x00007FF62B7F6000-memory.dmp	xmrig
behavioral2/memory/968-127-0x00007FF6B7A10000-0x00007FF6B7E06000-memory.dmp	xmrig
behavioral2/memory/2700-137-0x00007FF642030000-0x00007FF642426000-memory.dmp	xmrig
behavioral2/memory/852-140-0x00007FF7CEE70000-0x00007FF7CF266000-memory.dmp	xmrig
behavioral2/memory/2804-144-0x00007FF65C8D0000-0x00007FF65CCC6000-memory.dmp	xmrig
behavioral2/memory/4760-147-0x00007FF65DAF0000-0x00007FF65DEE6000-memory.dmp	xmrig
behavioral2/memory/2596-151-0x00007FF7E0490000-0x00007FF7E0886000-memory.dmp	xmrig
behavioral2/files/0x0008000000023420-160.dat	xmrig
behavioral2/files/0x0007000000023442-193.dat	xmrig
behavioral2/files/0x000700000002343c-192.dat	xmrig
behavioral2/files/0x0007000000023441-191.dat	xmrig
behavioral2/files/0x000800000002342f-188.dat	xmrig
behavioral2/files/0x0007000000023440-185.dat	xmrig
behavioral2/files/0x000700000002343f-182.dat	xmrig
behavioral2/files/0x000700000002343e-176.dat	xmrig
behavioral2/files/0x000700000002343d-173.dat	xmrig
behavioral2/files/0x000700000002343b-157.dat	xmrig
behavioral2/memory/3548-153-0x00007FF70EE80000-0x00007FF70F276000-memory.dmp	xmrig
behavioral2/memory/4224-152-0x00007FF6F7E00000-0x00007FF6F81F6000-memory.dmp	xmrig
behavioral2/memory/3556-149-0x00007FF71A030000-0x00007FF71A426000-memory.dmp	xmrig
behavioral2/memory/4784-148-0x00007FF666250000-0x00007FF666646000-memory.dmp	xmrig
behavioral2/memory/3396-146-0x00007FF60DED0000-0x00007FF60E2C6000-memory.dmp	xmrig
behavioral2/memory/4976-145-0x00007FF763FF0000-0x00007FF7643E6000-memory.dmp	xmrig
behavioral2/memory/2580-143-0x00007FF6D19F0000-0x00007FF6D1DE6000-memory.dmp	xmrig
behavioral2/memory/4824-142-0x00007FF70DAE0000-0x00007FF70DED6000-memory.dmp	xmrig
behavioral2/memory/2680-141-0x00007FF652320000-0x00007FF652716000-memory.dmp	xmrig
behavioral2/memory/3836-139-0x00007FF65DD20000-0x00007FF65E116000-memory.dmp	xmrig
behavioral2/memory/2656-138-0x00007FF6B7080000-0x00007FF6B7476000-memory.dmp	xmrig
behavioral2/files/0x000700000002343a-136.dat	xmrig
behavioral2/memory/1684-135-0x00007FF726D60000-0x00007FF727156000-memory.dmp	xmrig
behavioral2/files/0x0007000000023439-134.dat	xmrig
behavioral2/files/0x0007000000023438-133.dat	xmrig
behavioral2/files/0x0007000000023437-132.dat	xmrig
behavioral2/files/0x0007000000023434-131.dat	xmrig
behavioral2/files/0x0007000000023436-130.dat	xmrig
behavioral2/files/0x0007000000023435-129.dat	xmrig
behavioral2/files/0x0008000000023430-128.dat	xmrig
behavioral2/memory/2684-126-0x00007FF7BAB40000-0x00007FF7BAF36000-memory.dmp	xmrig
behavioral2/files/0x0007000000023432-116.dat	xmrig
behavioral2/files/0x0007000000023431-113.dat	xmrig
behavioral2/memory/3220-104-0x00007FF643750000-0x00007FF643B46000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-92.dat	xmrig
behavioral2/files/0x000700000002342b-89.dat	xmrig
behavioral2/files/0x000700000002342d-86.dat	xmrig
behavioral2/files/0x000700000002342a-55.dat	xmrig
behavioral2/files/0x0007000000023429-50.dat	xmrig
behavioral2/files/0x0007000000023428-48.dat	xmrig
behavioral2/files/0x0007000000023424-40.dat	xmrig
behavioral2/files/0x0007000000023427-39.dat	xmrig
behavioral2/memory/1068-37-0x00007FF767DB0000-0x00007FF7681A6000-memory.dmp	xmrig
behavioral2/memory/1980-2267-0x00007FF6E6400000-0x00007FF6E67F6000-memory.dmp	xmrig
behavioral2/memory/852-2270-0x00007FF7CEE70000-0x00007FF7CF266000-memory.dmp	xmrig
behavioral2/memory/2680-2271-0x00007FF652320000-0x00007FF652716000-memory.dmp	xmrig
behavioral2/memory/4824-2272-0x00007FF70DAE0000-0x00007FF70DED6000-memory.dmp	xmrig

Blocklisted process makes network request 10 IoCs

flow	pid	Process
3	2052	powershell.exe
5	2052	powershell.exe
7	2052	powershell.exe
8	2052	powershell.exe
10	2052	powershell.exe
11	2052	powershell.exe
13	2052	powershell.exe
22	2052	powershell.exe
24	2052	powershell.exe
29	2052	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2052	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1564	lEiEIMS.exe
4568	HKunVMo.exe
1068	uGXHgtN.exe
3556	IBvYAtf.exe
3220	ZwMhLOR.exe
3544	dArLylI.exe
2596	nwZNhee.exe
2684	uPAWFXQ.exe
968	oVMOkPw.exe
1684	aFTaibm.exe
2700	awpyJZA.exe
2656	SBLFmNx.exe
4224	WlroBrE.exe
3836	ROocpgx.exe
852	xvycZwc.exe
2680	bOptzfh.exe
4824	TDlWpeH.exe
2580	xHNpiis.exe
3548	eqVqYsY.exe
2804	FeEOFsD.exe
4976	Uszrhwu.exe
3396	fvFPxWM.exe
4760	qGneaqe.exe
4784	SzDxrMn.exe
4892	edXbVmh.exe
2972	wXjbpyV.exe
1968	MBjGNAE.exe
4740	ZJYdtpd.exe
1748	YRCcHXt.exe
3044	Zrchxbg.exe
4508	JsKLzyb.exe
3532	ZGYotIw.exe
4168	NoTMrHm.exe
2768	gbresVq.exe
4024	CEYMFQs.exe
1572	uzKfhVx.exe
4156	BtkwiRD.exe
1832	UDMrAle.exe
2652	CfGjYRC.exe
4580	ngPDZjQ.exe
672	MOFRKSq.exe
1600	OvqfaVX.exe
708	VYkOUHY.exe
1744	CSnSvrM.exe
4452	jhdNBGN.exe
3444	xEPXliI.exe
3488	CpAuZBQ.exe
1632	oCCxXYo.exe
924	EqgvhKR.exe
1568	bZYRIdO.exe
4956	wWKaWTQ.exe
1192	CosDhet.exe
4636	QLUlsjK.exe
3928	gVuQJak.exe
2604	jRpXzXh.exe
4984	oYJQADL.exe
3120	XSXrCfQ.exe
2228	veudEfQ.exe
1196	TjLLThC.exe
1752	NuMfWls.exe
4040	qhHjoRi.exe
5124	rPVMvPq.exe
5140	YBRmMwe.exe
5156	fwzbNCG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1980-0-0x00007FF6E6400000-0x00007FF6E67F6000-memory.dmp	upx
behavioral2/files/0x000800000002341f-5.dat	upx
behavioral2/files/0x0008000000023422-19.dat	upx
behavioral2/files/0x0007000000023423-15.dat	upx
behavioral2/memory/1564-10-0x00007FF6DD070000-0x00007FF6DD466000-memory.dmp	upx
behavioral2/files/0x0007000000023425-26.dat	upx
behavioral2/memory/4568-31-0x00007FF624660000-0x00007FF624A56000-memory.dmp	upx
behavioral2/files/0x0007000000023426-44.dat	upx
behavioral2/files/0x000700000002342e-84.dat	upx
behavioral2/files/0x0007000000023433-94.dat	upx
behavioral2/memory/3544-123-0x00007FF62B400000-0x00007FF62B7F6000-memory.dmp	upx
behavioral2/memory/968-127-0x00007FF6B7A10000-0x00007FF6B7E06000-memory.dmp	upx
behavioral2/memory/2700-137-0x00007FF642030000-0x00007FF642426000-memory.dmp	upx
behavioral2/memory/852-140-0x00007FF7CEE70000-0x00007FF7CF266000-memory.dmp	upx
behavioral2/memory/2804-144-0x00007FF65C8D0000-0x00007FF65CCC6000-memory.dmp	upx
behavioral2/memory/4760-147-0x00007FF65DAF0000-0x00007FF65DEE6000-memory.dmp	upx
behavioral2/memory/2596-151-0x00007FF7E0490000-0x00007FF7E0886000-memory.dmp	upx
behavioral2/files/0x0008000000023420-160.dat	upx
behavioral2/files/0x0007000000023442-193.dat	upx
behavioral2/files/0x000700000002343c-192.dat	upx
behavioral2/files/0x0007000000023441-191.dat	upx
behavioral2/files/0x000800000002342f-188.dat	upx
behavioral2/files/0x0007000000023440-185.dat	upx
behavioral2/files/0x000700000002343f-182.dat	upx
behavioral2/files/0x000700000002343e-176.dat	upx
behavioral2/files/0x000700000002343d-173.dat	upx
behavioral2/files/0x000700000002343b-157.dat	upx
behavioral2/memory/3548-153-0x00007FF70EE80000-0x00007FF70F276000-memory.dmp	upx
behavioral2/memory/4224-152-0x00007FF6F7E00000-0x00007FF6F81F6000-memory.dmp	upx
behavioral2/memory/3556-149-0x00007FF71A030000-0x00007FF71A426000-memory.dmp	upx
behavioral2/memory/4784-148-0x00007FF666250000-0x00007FF666646000-memory.dmp	upx
behavioral2/memory/3396-146-0x00007FF60DED0000-0x00007FF60E2C6000-memory.dmp	upx
behavioral2/memory/4976-145-0x00007FF763FF0000-0x00007FF7643E6000-memory.dmp	upx
behavioral2/memory/2580-143-0x00007FF6D19F0000-0x00007FF6D1DE6000-memory.dmp	upx
behavioral2/memory/4824-142-0x00007FF70DAE0000-0x00007FF70DED6000-memory.dmp	upx
behavioral2/memory/2680-141-0x00007FF652320000-0x00007FF652716000-memory.dmp	upx
behavioral2/memory/3836-139-0x00007FF65DD20000-0x00007FF65E116000-memory.dmp	upx
behavioral2/memory/2656-138-0x00007FF6B7080000-0x00007FF6B7476000-memory.dmp	upx
behavioral2/files/0x000700000002343a-136.dat	upx
behavioral2/memory/1684-135-0x00007FF726D60000-0x00007FF727156000-memory.dmp	upx
behavioral2/files/0x0007000000023439-134.dat	upx
behavioral2/files/0x0007000000023438-133.dat	upx
behavioral2/files/0x0007000000023437-132.dat	upx
behavioral2/files/0x0007000000023434-131.dat	upx
behavioral2/files/0x0007000000023436-130.dat	upx
behavioral2/files/0x0007000000023435-129.dat	upx
behavioral2/files/0x0008000000023430-128.dat	upx
behavioral2/memory/2684-126-0x00007FF7BAB40000-0x00007FF7BAF36000-memory.dmp	upx
behavioral2/files/0x0007000000023432-116.dat	upx
behavioral2/files/0x0007000000023431-113.dat	upx
behavioral2/memory/3220-104-0x00007FF643750000-0x00007FF643B46000-memory.dmp	upx
behavioral2/files/0x000700000002342c-92.dat	upx
behavioral2/files/0x000700000002342b-89.dat	upx
behavioral2/files/0x000700000002342d-86.dat	upx
behavioral2/files/0x000700000002342a-55.dat	upx
behavioral2/files/0x0007000000023429-50.dat	upx
behavioral2/files/0x0007000000023428-48.dat	upx
behavioral2/files/0x0007000000023424-40.dat	upx
behavioral2/files/0x0007000000023427-39.dat	upx
behavioral2/memory/1068-37-0x00007FF767DB0000-0x00007FF7681A6000-memory.dmp	upx
behavioral2/memory/1980-2267-0x00007FF6E6400000-0x00007FF6E67F6000-memory.dmp	upx
behavioral2/memory/852-2270-0x00007FF7CEE70000-0x00007FF7CF266000-memory.dmp	upx
behavioral2/memory/2680-2271-0x00007FF652320000-0x00007FF652716000-memory.dmp	upx
behavioral2/memory/4824-2272-0x00007FF70DAE0000-0x00007FF70DED6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nTAiJYI.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\yPdagYu.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\ZARpNdv.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\fYFOQTL.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\HOAAgaH.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\KgQEHFl.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\vNyMtqU.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\Uszrhwu.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\VZiUKNl.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\kxSQlUB.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\LePrUqV.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\JiVrtTm.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\TDlWpeH.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\wXjbpyV.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\bEgXMIr.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\yrOuMsV.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\AKZuFVF.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\OcUWeFO.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\OOjZPSa.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\PRVHglQ.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\SgRHTFj.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\TiFLfKd.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\JofBenX.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\YeigNou.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\CxbHeWR.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\UrjLGkR.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\HYPKjaK.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\cDyncCs.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\DNRanSz.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\weBKpxE.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\cIEjtrJ.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\FaaGuKb.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\sHSnJna.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\SzDxrMn.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\wrwMOpc.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\awjIdev.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\FnWOMDF.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\dQgtIWB.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\JSOuJhv.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\ETGPKzH.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\sUWMupD.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\BCWDGmR.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\rUKrQkq.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\QXEgyZO.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\qRajArJ.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\wOEzTBd.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\MJzqvKc.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\GJKKDlB.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\GbZEffW.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\rKhIJvo.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\rnKdrsf.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\NnrOrFZ.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\rzNTWxd.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\oLsKtGa.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\UDMrAle.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\nQopjII.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\eFPWpnh.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\VuwGvbA.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\DrWsrTn.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\JPiUzCi.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\SOHlFPG.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\qtqynjw.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\RJPctSh.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
File created	C:\Windows\System\OdsUSIE.exe	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2052	powershell.exe
2052	powershell.exe
2052	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeLockMemoryPrivilege	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2052	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	84
PID 1980 wrote to memory of 2052	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	84
PID 1980 wrote to memory of 1564	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	85
PID 1980 wrote to memory of 1564	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	85
PID 1980 wrote to memory of 4568	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	86
PID 1980 wrote to memory of 4568	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	86
PID 1980 wrote to memory of 1068	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	87
PID 1980 wrote to memory of 1068	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	87
PID 1980 wrote to memory of 3556	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	88
PID 1980 wrote to memory of 3556	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	88
PID 1980 wrote to memory of 3220	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	89
PID 1980 wrote to memory of 3220	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	89
PID 1980 wrote to memory of 3544	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	90
PID 1980 wrote to memory of 3544	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	90
PID 1980 wrote to memory of 2596	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	91
PID 1980 wrote to memory of 2596	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	91
PID 1980 wrote to memory of 2684	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	92
PID 1980 wrote to memory of 2684	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	92
PID 1980 wrote to memory of 968	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	93
PID 1980 wrote to memory of 968	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	93
PID 1980 wrote to memory of 1684	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	94
PID 1980 wrote to memory of 1684	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	94
PID 1980 wrote to memory of 2700	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	95
PID 1980 wrote to memory of 2700	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	95
PID 1980 wrote to memory of 2656	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	96
PID 1980 wrote to memory of 2656	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	96
PID 1980 wrote to memory of 4224	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	97
PID 1980 wrote to memory of 4224	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	97
PID 1980 wrote to memory of 3836	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	98
PID 1980 wrote to memory of 3836	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	98
PID 1980 wrote to memory of 852	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	99
PID 1980 wrote to memory of 852	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	99
PID 1980 wrote to memory of 2680	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	100
PID 1980 wrote to memory of 2680	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	100
PID 1980 wrote to memory of 4824	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	101
PID 1980 wrote to memory of 4824	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	101
PID 1980 wrote to memory of 2580	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	102
PID 1980 wrote to memory of 2580	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	102
PID 1980 wrote to memory of 3548	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	103
PID 1980 wrote to memory of 3548	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	103
PID 1980 wrote to memory of 2804	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	104
PID 1980 wrote to memory of 2804	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	104
PID 1980 wrote to memory of 4976	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	105
PID 1980 wrote to memory of 4976	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	105
PID 1980 wrote to memory of 3396	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	106
PID 1980 wrote to memory of 3396	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	106
PID 1980 wrote to memory of 4760	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	107
PID 1980 wrote to memory of 4760	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	107
PID 1980 wrote to memory of 4784	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	108
PID 1980 wrote to memory of 4784	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	108
PID 1980 wrote to memory of 4892	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	109
PID 1980 wrote to memory of 4892	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	109
PID 1980 wrote to memory of 2972	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	110
PID 1980 wrote to memory of 2972	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	110
PID 1980 wrote to memory of 1968	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	111
PID 1980 wrote to memory of 1968	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	111
PID 1980 wrote to memory of 4740	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	112
PID 1980 wrote to memory of 4740	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	112
PID 1980 wrote to memory of 1748	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	113
PID 1980 wrote to memory of 1748	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	113
PID 1980 wrote to memory of 3044	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	114
PID 1980 wrote to memory of 3044	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	114
PID 1980 wrote to memory of 4508	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	115
PID 1980 wrote to memory of 4508	1980	248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe	115

C:\Users\Admin\AppData\Local\Temp\248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe
"C:\Users\Admin\AppData\Local\Temp\248f25051f2a38e549f796f29cebc3f6d33c330bbaef53f80d8a41b2a5761f04.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\System\lEiEIMS.exe
  C:\Windows\System\lEiEIMS.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\HKunVMo.exe
  C:\Windows\System\HKunVMo.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\uGXHgtN.exe
  C:\Windows\System\uGXHgtN.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\IBvYAtf.exe
  C:\Windows\System\IBvYAtf.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\ZwMhLOR.exe
  C:\Windows\System\ZwMhLOR.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\dArLylI.exe
  C:\Windows\System\dArLylI.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\nwZNhee.exe
  C:\Windows\System\nwZNhee.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\uPAWFXQ.exe
  C:\Windows\System\uPAWFXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\oVMOkPw.exe
  C:\Windows\System\oVMOkPw.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\aFTaibm.exe
  C:\Windows\System\aFTaibm.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\awpyJZA.exe
  C:\Windows\System\awpyJZA.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\SBLFmNx.exe
  C:\Windows\System\SBLFmNx.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\WlroBrE.exe
  C:\Windows\System\WlroBrE.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\ROocpgx.exe
  C:\Windows\System\ROocpgx.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\xvycZwc.exe
  C:\Windows\System\xvycZwc.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\bOptzfh.exe
  C:\Windows\System\bOptzfh.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\TDlWpeH.exe
  C:\Windows\System\TDlWpeH.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\xHNpiis.exe
  C:\Windows\System\xHNpiis.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\eqVqYsY.exe
  C:\Windows\System\eqVqYsY.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\FeEOFsD.exe
  C:\Windows\System\FeEOFsD.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\Uszrhwu.exe
  C:\Windows\System\Uszrhwu.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\fvFPxWM.exe
  C:\Windows\System\fvFPxWM.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\qGneaqe.exe
  C:\Windows\System\qGneaqe.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\SzDxrMn.exe
  C:\Windows\System\SzDxrMn.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\edXbVmh.exe
  C:\Windows\System\edXbVmh.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\wXjbpyV.exe
  C:\Windows\System\wXjbpyV.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\MBjGNAE.exe
  C:\Windows\System\MBjGNAE.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\ZJYdtpd.exe
  C:\Windows\System\ZJYdtpd.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\YRCcHXt.exe
  C:\Windows\System\YRCcHXt.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\Zrchxbg.exe
  C:\Windows\System\Zrchxbg.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\JsKLzyb.exe
  C:\Windows\System\JsKLzyb.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\ZGYotIw.exe
  C:\Windows\System\ZGYotIw.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\NoTMrHm.exe
  C:\Windows\System\NoTMrHm.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\gbresVq.exe
  C:\Windows\System\gbresVq.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\CEYMFQs.exe
  C:\Windows\System\CEYMFQs.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\uzKfhVx.exe
  C:\Windows\System\uzKfhVx.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\BtkwiRD.exe
  C:\Windows\System\BtkwiRD.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\UDMrAle.exe
  C:\Windows\System\UDMrAle.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\CfGjYRC.exe
  C:\Windows\System\CfGjYRC.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\ngPDZjQ.exe
  C:\Windows\System\ngPDZjQ.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\MOFRKSq.exe
  C:\Windows\System\MOFRKSq.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\OvqfaVX.exe
  C:\Windows\System\OvqfaVX.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\VYkOUHY.exe
  C:\Windows\System\VYkOUHY.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\CSnSvrM.exe
  C:\Windows\System\CSnSvrM.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\jhdNBGN.exe
  C:\Windows\System\jhdNBGN.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\xEPXliI.exe
  C:\Windows\System\xEPXliI.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\CpAuZBQ.exe
  C:\Windows\System\CpAuZBQ.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\oCCxXYo.exe
  C:\Windows\System\oCCxXYo.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\EqgvhKR.exe
  C:\Windows\System\EqgvhKR.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\bZYRIdO.exe
  C:\Windows\System\bZYRIdO.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\wWKaWTQ.exe
  C:\Windows\System\wWKaWTQ.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\CosDhet.exe
  C:\Windows\System\CosDhet.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\QLUlsjK.exe
  C:\Windows\System\QLUlsjK.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\gVuQJak.exe
  C:\Windows\System\gVuQJak.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\jRpXzXh.exe
  C:\Windows\System\jRpXzXh.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\oYJQADL.exe
  C:\Windows\System\oYJQADL.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\XSXrCfQ.exe
  C:\Windows\System\XSXrCfQ.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\veudEfQ.exe
  C:\Windows\System\veudEfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\TjLLThC.exe
  C:\Windows\System\TjLLThC.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\NuMfWls.exe
  C:\Windows\System\NuMfWls.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\qhHjoRi.exe
  C:\Windows\System\qhHjoRi.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\rPVMvPq.exe
  C:\Windows\System\rPVMvPq.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\YBRmMwe.exe
  C:\Windows\System\YBRmMwe.exe
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\System\fwzbNCG.exe
  C:\Windows\System\fwzbNCG.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\Wiswxdo.exe
  C:\Windows\System\Wiswxdo.exe
  2⤵
  PID:5172
- C:\Windows\System\Qilgnsc.exe
  C:\Windows\System\Qilgnsc.exe
  2⤵
  PID:5188
- C:\Windows\System\hEsaXWj.exe
  C:\Windows\System\hEsaXWj.exe
  2⤵
  PID:5204
- C:\Windows\System\NkDmqTd.exe
  C:\Windows\System\NkDmqTd.exe
  2⤵
  PID:5220
- C:\Windows\System\ezTeKCb.exe
  C:\Windows\System\ezTeKCb.exe
  2⤵
  PID:5236
- C:\Windows\System\pVHmaGZ.exe
  C:\Windows\System\pVHmaGZ.exe
  2⤵
  PID:3524
- C:\Windows\System\oiMvGQn.exe
  C:\Windows\System\oiMvGQn.exe
  2⤵
  PID:2924
- C:\Windows\System\aZCuxEn.exe
  C:\Windows\System\aZCuxEn.exe
  2⤵
  PID:4360
- C:\Windows\System\OXWrPhT.exe
  C:\Windows\System\OXWrPhT.exe
  2⤵
  PID:3564
- C:\Windows\System\VzvYlnN.exe
  C:\Windows\System\VzvYlnN.exe
  2⤵
  PID:5132
- C:\Windows\System\GKfcBIY.exe
  C:\Windows\System\GKfcBIY.exe
  2⤵
  PID:5212
- C:\Windows\System\pxKJqzD.exe
  C:\Windows\System\pxKJqzD.exe
  2⤵
  PID:5292
- C:\Windows\System\UnyaOUq.exe
  C:\Windows\System\UnyaOUq.exe
  2⤵
  PID:1488
- C:\Windows\System\iKDGiDt.exe
  C:\Windows\System\iKDGiDt.exe
  2⤵
  PID:2820
- C:\Windows\System\dDWBySU.exe
  C:\Windows\System\dDWBySU.exe
  2⤵
  PID:1324
- C:\Windows\System\WBBhuJI.exe
  C:\Windows\System\WBBhuJI.exe
  2⤵
  PID:3456
- C:\Windows\System\NIQpiKM.exe
  C:\Windows\System\NIQpiKM.exe
  2⤵
  PID:5576
- C:\Windows\System\aKDGaVd.exe
  C:\Windows\System\aKDGaVd.exe
  2⤵
  PID:2664
- C:\Windows\System\neuUcjq.exe
  C:\Windows\System\neuUcjq.exe
  2⤵
  PID:5596
- C:\Windows\System\qJKNSLF.exe
  C:\Windows\System\qJKNSLF.exe
  2⤵
  PID:4816
- C:\Windows\System\JdUDNyz.exe
  C:\Windows\System\JdUDNyz.exe
  2⤵
  PID:5648
- C:\Windows\System\JvxZiCn.exe
  C:\Windows\System\JvxZiCn.exe
  2⤵
  PID:64
- C:\Windows\System\tQnpNEv.exe
  C:\Windows\System\tQnpNEv.exe
  2⤵
  PID:5684
- C:\Windows\System\iQAyuxD.exe
  C:\Windows\System\iQAyuxD.exe
  2⤵
  PID:5724
- C:\Windows\System\vXmcNpY.exe
  C:\Windows\System\vXmcNpY.exe
  2⤵
  PID:5756
- C:\Windows\System\gOmWAvy.exe
  C:\Windows\System\gOmWAvy.exe
  2⤵
  PID:5796
- C:\Windows\System\SzghAXG.exe
  C:\Windows\System\SzghAXG.exe
  2⤵
  PID:5824
- C:\Windows\System\nZkCmXq.exe
  C:\Windows\System\nZkCmXq.exe
  2⤵
  PID:2840
- C:\Windows\System\uubrozc.exe
  C:\Windows\System\uubrozc.exe
  2⤵
  PID:1532
- C:\Windows\System\RnXAktk.exe
  C:\Windows\System\RnXAktk.exe
  2⤵
  PID:5916
- C:\Windows\System\QvGktkK.exe
  C:\Windows\System\QvGktkK.exe
  2⤵
  PID:5956
- C:\Windows\System\nkukmhb.exe
  C:\Windows\System\nkukmhb.exe
  2⤵
  PID:5996
- C:\Windows\System\zmEmKsQ.exe
  C:\Windows\System\zmEmKsQ.exe
  2⤵
  PID:6032
- C:\Windows\System\bLtRRqC.exe
  C:\Windows\System\bLtRRqC.exe
  2⤵
  PID:6068
- C:\Windows\System\rflaPSS.exe
  C:\Windows\System\rflaPSS.exe
  2⤵
  PID:6112
- C:\Windows\System\oxoXGfO.exe
  C:\Windows\System\oxoXGfO.exe
  2⤵
  PID:6136
- C:\Windows\System\ySQKqou.exe
  C:\Windows\System\ySQKqou.exe
  2⤵
  PID:552
- C:\Windows\System\OwmDrKR.exe
  C:\Windows\System\OwmDrKR.exe
  2⤵
  PID:3428
- C:\Windows\System\lGYVuNR.exe
  C:\Windows\System\lGYVuNR.exe
  2⤵
  PID:4468
- C:\Windows\System\KKkuwqD.exe
  C:\Windows\System\KKkuwqD.exe
  2⤵
  PID:896
- C:\Windows\System\WmztRkn.exe
  C:\Windows\System\WmztRkn.exe
  2⤵
  PID:4916
- C:\Windows\System\EHbJfFn.exe
  C:\Windows\System\EHbJfFn.exe
  2⤵
  PID:4772
- C:\Windows\System\ZVfYOtD.exe
  C:\Windows\System\ZVfYOtD.exe
  2⤵
  PID:3152
- C:\Windows\System\RszenYW.exe
  C:\Windows\System\RszenYW.exe
  2⤵
  PID:3640
- C:\Windows\System\HXrKWQf.exe
  C:\Windows\System\HXrKWQf.exe
  2⤵
  PID:2020
- C:\Windows\System\eOmhzLh.exe
  C:\Windows\System\eOmhzLh.exe
  2⤵
  PID:5476
- C:\Windows\System\EYSBNEo.exe
  C:\Windows\System\EYSBNEo.exe
  2⤵
  PID:4376
- C:\Windows\System\YQzmLxJ.exe
  C:\Windows\System\YQzmLxJ.exe
  2⤵
  PID:4256
- C:\Windows\System\QGkxUay.exe
  C:\Windows\System\QGkxUay.exe
  2⤵
  PID:5168
- C:\Windows\System\WAhUsGf.exe
  C:\Windows\System\WAhUsGf.exe
  2⤵
  PID:5196
- C:\Windows\System\QaKjxbR.exe
  C:\Windows\System\QaKjxbR.exe
  2⤵
  PID:5348
- C:\Windows\System\AqwwoJG.exe
  C:\Windows\System\AqwwoJG.exe
  2⤵
  PID:1136
- C:\Windows\System\VfeeSFi.exe
  C:\Windows\System\VfeeSFi.exe
  2⤵
  PID:1340
- C:\Windows\System\YkkEUvC.exe
  C:\Windows\System\YkkEUvC.exe
  2⤵
  PID:3288
- C:\Windows\System\tEljHsj.exe
  C:\Windows\System\tEljHsj.exe
  2⤵
  PID:5620
- C:\Windows\System\zdkfmqz.exe
  C:\Windows\System\zdkfmqz.exe
  2⤵
  PID:4960
- C:\Windows\System\ohWACEN.exe
  C:\Windows\System\ohWACEN.exe
  2⤵
  PID:5668
- C:\Windows\System\LffhVMO.exe
  C:\Windows\System\LffhVMO.exe
  2⤵
  PID:5740
- C:\Windows\System\ZLpPcUy.exe
  C:\Windows\System\ZLpPcUy.exe
  2⤵
  PID:5768
- C:\Windows\System\PDZIvpL.exe
  C:\Windows\System\PDZIvpL.exe
  2⤵
  PID:5840
- C:\Windows\System\jXTQITJ.exe
  C:\Windows\System\jXTQITJ.exe
  2⤵
  PID:3108
- C:\Windows\System\rgwCWYX.exe
  C:\Windows\System\rgwCWYX.exe
  2⤵
  PID:5912
- C:\Windows\System\MvHRUWQ.exe
  C:\Windows\System\MvHRUWQ.exe
  2⤵
  PID:5972
- C:\Windows\System\GNyLXlX.exe
  C:\Windows\System\GNyLXlX.exe
  2⤵
  PID:6024
- C:\Windows\System\xbGLyyt.exe
  C:\Windows\System\xbGLyyt.exe
  2⤵
  PID:6064
- C:\Windows\System\xHvSErY.exe
  C:\Windows\System\xHvSErY.exe
  2⤵
  PID:544
- C:\Windows\System\orjKtpq.exe
  C:\Windows\System\orjKtpq.exe
  2⤵
  PID:4688
- C:\Windows\System\hJrHOqg.exe
  C:\Windows\System\hJrHOqg.exe
  2⤵
  PID:516
- C:\Windows\System\JXxIvkw.exe
  C:\Windows\System\JXxIvkw.exe
  2⤵
  PID:644
- C:\Windows\System\MJbsDsX.exe
  C:\Windows\System\MJbsDsX.exe
  2⤵
  PID:1868
- C:\Windows\System\nCbhsDb.exe
  C:\Windows\System\nCbhsDb.exe
  2⤵
  PID:3240
- C:\Windows\System\rUKrQkq.exe
  C:\Windows\System\rUKrQkq.exe
  2⤵
  PID:4484
- C:\Windows\System\AYcPPxJ.exe
  C:\Windows\System\AYcPPxJ.exe
  2⤵
  PID:5276
- C:\Windows\System\oXqbrGT.exe
  C:\Windows\System\oXqbrGT.exe
  2⤵
  PID:1816
- C:\Windows\System\HlzrcxY.exe
  C:\Windows\System\HlzrcxY.exe
  2⤵
  PID:1500
- C:\Windows\System\YDFhrhT.exe
  C:\Windows\System\YDFhrhT.exe
  2⤵
  PID:5664
- C:\Windows\System\qtqynjw.exe
  C:\Windows\System\qtqynjw.exe
  2⤵
  PID:5748
- C:\Windows\System\TVJsEqc.exe
  C:\Windows\System\TVJsEqc.exe
  2⤵
  PID:5864
- C:\Windows\System\pNTRZBn.exe
  C:\Windows\System\pNTRZBn.exe
  2⤵
  PID:6012
- C:\Windows\System\uCgXrpT.exe
  C:\Windows\System\uCgXrpT.exe
  2⤵
  PID:2008
- C:\Windows\System\CjmNMqj.exe
  C:\Windows\System\CjmNMqj.exe
  2⤵
  PID:4664
- C:\Windows\System\ESiAiTm.exe
  C:\Windows\System\ESiAiTm.exe
  2⤵
  PID:2032
- C:\Windows\System\tWWvTkj.exe
  C:\Windows\System\tWWvTkj.exe
  2⤵
  PID:5228
- C:\Windows\System\WjkEwLx.exe
  C:\Windows\System\WjkEwLx.exe
  2⤵
  PID:3560
- C:\Windows\System\OvftFjd.exe
  C:\Windows\System\OvftFjd.exe
  2⤵
  PID:5808
- C:\Windows\System\SRtfHvE.exe
  C:\Windows\System\SRtfHvE.exe
  2⤵
  PID:5960
- C:\Windows\System\HwnQRHa.exe
  C:\Windows\System\HwnQRHa.exe
  2⤵
  PID:6056
- C:\Windows\System\rpqnohH.exe
  C:\Windows\System\rpqnohH.exe
  2⤵
  PID:4652
- C:\Windows\System\AcxeSpR.exe
  C:\Windows\System\AcxeSpR.exe
  2⤵
  PID:684
- C:\Windows\System\FFwOeWm.exe
  C:\Windows\System\FFwOeWm.exe
  2⤵
  PID:3160
- C:\Windows\System\ULYuntY.exe
  C:\Windows\System\ULYuntY.exe
  2⤵
  PID:1964
- C:\Windows\System\ovlaBye.exe
  C:\Windows\System\ovlaBye.exe
  2⤵
  PID:6100
- C:\Windows\System\RHrHkOI.exe
  C:\Windows\System\RHrHkOI.exe
  2⤵
  PID:6164
- C:\Windows\System\RaXvjQW.exe
  C:\Windows\System\RaXvjQW.exe
  2⤵
  PID:6192
- C:\Windows\System\RcTpPuD.exe
  C:\Windows\System\RcTpPuD.exe
  2⤵
  PID:6220
- C:\Windows\System\vuOxlfG.exe
  C:\Windows\System\vuOxlfG.exe
  2⤵
  PID:6236
- C:\Windows\System\YikUmWo.exe
  C:\Windows\System\YikUmWo.exe
  2⤵
  PID:6252
- C:\Windows\System\vdRquWW.exe
  C:\Windows\System\vdRquWW.exe
  2⤵
  PID:6276
- C:\Windows\System\lKjqNrh.exe
  C:\Windows\System\lKjqNrh.exe
  2⤵
  PID:6320
- C:\Windows\System\WuymNis.exe
  C:\Windows\System\WuymNis.exe
  2⤵
  PID:6348
- C:\Windows\System\JFGNJiO.exe
  C:\Windows\System\JFGNJiO.exe
  2⤵
  PID:6392
- C:\Windows\System\DbHDHkO.exe
  C:\Windows\System\DbHDHkO.exe
  2⤵
  PID:6416
- C:\Windows\System\sQHTVHi.exe
  C:\Windows\System\sQHTVHi.exe
  2⤵
  PID:6444
- C:\Windows\System\BRHGbfT.exe
  C:\Windows\System\BRHGbfT.exe
  2⤵
  PID:6480
- C:\Windows\System\soBNBFS.exe
  C:\Windows\System\soBNBFS.exe
  2⤵
  PID:6500
- C:\Windows\System\sRKFqzH.exe
  C:\Windows\System\sRKFqzH.exe
  2⤵
  PID:6528
- C:\Windows\System\vmDYCqd.exe
  C:\Windows\System\vmDYCqd.exe
  2⤵
  PID:6560
- C:\Windows\System\TQuhxQA.exe
  C:\Windows\System\TQuhxQA.exe
  2⤵
  PID:6584
- C:\Windows\System\BCjJbZu.exe
  C:\Windows\System\BCjJbZu.exe
  2⤵
  PID:6612
- C:\Windows\System\iuQbOoR.exe
  C:\Windows\System\iuQbOoR.exe
  2⤵
  PID:6640
- C:\Windows\System\deJnaLi.exe
  C:\Windows\System\deJnaLi.exe
  2⤵
  PID:6672
- C:\Windows\System\BPbNDhG.exe
  C:\Windows\System\BPbNDhG.exe
  2⤵
  PID:6696
- C:\Windows\System\rJNStfU.exe
  C:\Windows\System\rJNStfU.exe
  2⤵
  PID:6724
- C:\Windows\System\nwYmIBk.exe
  C:\Windows\System\nwYmIBk.exe
  2⤵
  PID:6760
- C:\Windows\System\QyxhMdv.exe
  C:\Windows\System\QyxhMdv.exe
  2⤵
  PID:6780
- C:\Windows\System\KDcNABp.exe
  C:\Windows\System\KDcNABp.exe
  2⤵
  PID:6808
- C:\Windows\System\jLWJqtd.exe
  C:\Windows\System\jLWJqtd.exe
  2⤵
  PID:6836
- C:\Windows\System\aCaoowx.exe
  C:\Windows\System\aCaoowx.exe
  2⤵
  PID:6852
- C:\Windows\System\DaRRnpv.exe
  C:\Windows\System\DaRRnpv.exe
  2⤵
  PID:6896
- C:\Windows\System\DrWsrTn.exe
  C:\Windows\System\DrWsrTn.exe
  2⤵
  PID:6924
- C:\Windows\System\EnxtgaT.exe
  C:\Windows\System\EnxtgaT.exe
  2⤵
  PID:6948
- C:\Windows\System\csCmorY.exe
  C:\Windows\System\csCmorY.exe
  2⤵
  PID:6980
- C:\Windows\System\wRFJVqm.exe
  C:\Windows\System\wRFJVqm.exe
  2⤵
  PID:7008
- C:\Windows\System\jeZgSCv.exe
  C:\Windows\System\jeZgSCv.exe
  2⤵
  PID:7044
- C:\Windows\System\ENijjTJ.exe
  C:\Windows\System\ENijjTJ.exe
  2⤵
  PID:7064
- C:\Windows\System\aswpiOi.exe
  C:\Windows\System\aswpiOi.exe
  2⤵
  PID:7100
- C:\Windows\System\rjqASxk.exe
  C:\Windows\System\rjqASxk.exe
  2⤵
  PID:7120
- C:\Windows\System\iFvykbI.exe
  C:\Windows\System\iFvykbI.exe
  2⤵
  PID:7148
- C:\Windows\System\naRXFkE.exe
  C:\Windows\System\naRXFkE.exe
  2⤵
  PID:4604
- C:\Windows\System\gsOiQME.exe
  C:\Windows\System\gsOiQME.exe
  2⤵
  PID:6204
- C:\Windows\System\xHsZrXI.exe
  C:\Windows\System\xHsZrXI.exe
  2⤵
  PID:6264
- C:\Windows\System\kcjkbRq.exe
  C:\Windows\System\kcjkbRq.exe
  2⤵
  PID:6336
- C:\Windows\System\cfkoDJi.exe
  C:\Windows\System\cfkoDJi.exe
  2⤵
  PID:6400
- C:\Windows\System\mjvJdyD.exe
  C:\Windows\System\mjvJdyD.exe
  2⤵
  PID:6488
- C:\Windows\System\ROGfUfp.exe
  C:\Windows\System\ROGfUfp.exe
  2⤵
  PID:6524
- C:\Windows\System\xnUjKPV.exe
  C:\Windows\System\xnUjKPV.exe
  2⤵
  PID:6596
- C:\Windows\System\xbuXjBZ.exe
  C:\Windows\System\xbuXjBZ.exe
  2⤵
  PID:6660
- C:\Windows\System\VqmYkYt.exe
  C:\Windows\System\VqmYkYt.exe
  2⤵
  PID:6720
- C:\Windows\System\RgZUqFs.exe
  C:\Windows\System\RgZUqFs.exe
  2⤵
  PID:6776
- C:\Windows\System\ZRNERhB.exe
  C:\Windows\System\ZRNERhB.exe
  2⤵
  PID:6828
- C:\Windows\System\aYVDsVT.exe
  C:\Windows\System\aYVDsVT.exe
  2⤵
  PID:6904
- C:\Windows\System\rroOfOE.exe
  C:\Windows\System\rroOfOE.exe
  2⤵
  PID:6972
- C:\Windows\System\szMqcNg.exe
  C:\Windows\System\szMqcNg.exe
  2⤵
  PID:7052
- C:\Windows\System\UnsrkkK.exe
  C:\Windows\System\UnsrkkK.exe
  2⤵
  PID:7112
- C:\Windows\System\KhAkfnJ.exe
  C:\Windows\System\KhAkfnJ.exe
  2⤵
  PID:5736
- C:\Windows\System\DHkRtYn.exe
  C:\Windows\System\DHkRtYn.exe
  2⤵
  PID:6308
- C:\Windows\System\QnQsZXt.exe
  C:\Windows\System\QnQsZXt.exe
  2⤵
  PID:6456
- C:\Windows\System\FTGXPXo.exe
  C:\Windows\System\FTGXPXo.exe
  2⤵
  PID:6628
- C:\Windows\System\BKAczDH.exe
  C:\Windows\System\BKAczDH.exe
  2⤵
  PID:6772
- C:\Windows\System\CjQlGdn.exe
  C:\Windows\System\CjQlGdn.exe
  2⤵
  PID:6876
- C:\Windows\System\xDrDirP.exe
  C:\Windows\System\xDrDirP.exe
  2⤵
  PID:7028
- C:\Windows\System\qofXtTX.exe
  C:\Windows\System\qofXtTX.exe
  2⤵
  PID:6184
- C:\Windows\System\MPgigpd.exe
  C:\Windows\System\MPgigpd.exe
  2⤵
  PID:6580
- C:\Windows\System\mxAQLdG.exe
  C:\Windows\System\mxAQLdG.exe
  2⤵
  PID:6944
- C:\Windows\System\IChYNGu.exe
  C:\Windows\System\IChYNGu.exe
  2⤵
  PID:6512
- C:\Windows\System\goJuQhL.exe
  C:\Windows\System\goJuQhL.exe
  2⤵
  PID:7144
- C:\Windows\System\lKwVzwH.exe
  C:\Windows\System\lKwVzwH.exe
  2⤵
  PID:7196
- C:\Windows\System\UDnpUIq.exe
  C:\Windows\System\UDnpUIq.exe
  2⤵
  PID:7228
- C:\Windows\System\esUlnhG.exe
  C:\Windows\System\esUlnhG.exe
  2⤵
  PID:7292
- C:\Windows\System\YucsYJp.exe
  C:\Windows\System\YucsYJp.exe
  2⤵
  PID:7320
- C:\Windows\System\UoUpAwe.exe
  C:\Windows\System\UoUpAwe.exe
  2⤵
  PID:7344
- C:\Windows\System\MmENNwe.exe
  C:\Windows\System\MmENNwe.exe
  2⤵
  PID:7364
- C:\Windows\System\xKfXeOX.exe
  C:\Windows\System\xKfXeOX.exe
  2⤵
  PID:7392
- C:\Windows\System\jNAFQCx.exe
  C:\Windows\System\jNAFQCx.exe
  2⤵
  PID:7432
- C:\Windows\System\hPLqHea.exe
  C:\Windows\System\hPLqHea.exe
  2⤵
  PID:7448
- C:\Windows\System\jZdXArO.exe
  C:\Windows\System\jZdXArO.exe
  2⤵
  PID:7476
- C:\Windows\System\KkmwFRM.exe
  C:\Windows\System\KkmwFRM.exe
  2⤵
  PID:7508
- C:\Windows\System\mpIMNQO.exe
  C:\Windows\System\mpIMNQO.exe
  2⤵
  PID:7536
- C:\Windows\System\ohLpSsD.exe
  C:\Windows\System\ohLpSsD.exe
  2⤵
  PID:7560
- C:\Windows\System\KvwfFYc.exe
  C:\Windows\System\KvwfFYc.exe
  2⤵
  PID:7588
- C:\Windows\System\qAmeeSH.exe
  C:\Windows\System\qAmeeSH.exe
  2⤵
  PID:7616
- C:\Windows\System\riSkLCb.exe
  C:\Windows\System\riSkLCb.exe
  2⤵
  PID:7644
- C:\Windows\System\fhdJOoI.exe
  C:\Windows\System\fhdJOoI.exe
  2⤵
  PID:7676
- C:\Windows\System\edjURuy.exe
  C:\Windows\System\edjURuy.exe
  2⤵
  PID:7704
- C:\Windows\System\qTkdoQN.exe
  C:\Windows\System\qTkdoQN.exe
  2⤵
  PID:7732
- C:\Windows\System\LaoBhDX.exe
  C:\Windows\System\LaoBhDX.exe
  2⤵
  PID:7764
- C:\Windows\System\YKFjzEt.exe
  C:\Windows\System\YKFjzEt.exe
  2⤵
  PID:7788
- C:\Windows\System\opsVSPR.exe
  C:\Windows\System\opsVSPR.exe
  2⤵
  PID:7816
- C:\Windows\System\ibKwKqQ.exe
  C:\Windows\System\ibKwKqQ.exe
  2⤵
  PID:7852
- C:\Windows\System\aDdqqCm.exe
  C:\Windows\System\aDdqqCm.exe
  2⤵
  PID:7872
- C:\Windows\System\TsApykV.exe
  C:\Windows\System\TsApykV.exe
  2⤵
  PID:7904
- C:\Windows\System\Ebcztar.exe
  C:\Windows\System\Ebcztar.exe
  2⤵
  PID:7928
- C:\Windows\System\cKFgloW.exe
  C:\Windows\System\cKFgloW.exe
  2⤵
  PID:7956
- C:\Windows\System\oeBqQfz.exe
  C:\Windows\System\oeBqQfz.exe
  2⤵
  PID:7988
- C:\Windows\System\vnpKfhY.exe
  C:\Windows\System\vnpKfhY.exe
  2⤵
  PID:8024
- C:\Windows\System\rnKdrsf.exe
  C:\Windows\System\rnKdrsf.exe
  2⤵
  PID:8048
- C:\Windows\System\YXAoQuz.exe
  C:\Windows\System\YXAoQuz.exe
  2⤵
  PID:8076
- C:\Windows\System\bhSwOsy.exe
  C:\Windows\System\bhSwOsy.exe
  2⤵
  PID:8104
- C:\Windows\System\jLmoKOM.exe
  C:\Windows\System\jLmoKOM.exe
  2⤵
  PID:8136
- C:\Windows\System\RqAzPAv.exe
  C:\Windows\System\RqAzPAv.exe
  2⤵
  PID:8160
- C:\Windows\System\iSFGkoW.exe
  C:\Windows\System\iSFGkoW.exe
  2⤵
  PID:8188
- C:\Windows\System\oXWdtMN.exe
  C:\Windows\System\oXWdtMN.exe
  2⤵
  PID:7216
- C:\Windows\System\ZULxlGN.exe
  C:\Windows\System\ZULxlGN.exe
  2⤵
  PID:7300
- C:\Windows\System\ECXHwkE.exe
  C:\Windows\System\ECXHwkE.exe
  2⤵
  PID:7376
- C:\Windows\System\zjoloID.exe
  C:\Windows\System\zjoloID.exe
  2⤵
  PID:7428
- C:\Windows\System\DLIoUVm.exe
  C:\Windows\System\DLIoUVm.exe
  2⤵
  PID:7496
- C:\Windows\System\IIWWXpE.exe
  C:\Windows\System\IIWWXpE.exe
  2⤵
  PID:7556
- C:\Windows\System\wAznVhu.exe
  C:\Windows\System\wAznVhu.exe
  2⤵
  PID:7628
- C:\Windows\System\vftolLl.exe
  C:\Windows\System\vftolLl.exe
  2⤵
  PID:7696
- C:\Windows\System\kDUDUtg.exe
  C:\Windows\System\kDUDUtg.exe
  2⤵
  PID:7752
- C:\Windows\System\VRtzRSn.exe
  C:\Windows\System\VRtzRSn.exe
  2⤵
  PID:7812
- C:\Windows\System\nTAiJYI.exe
  C:\Windows\System\nTAiJYI.exe
  2⤵
  PID:7884
- C:\Windows\System\VFpGHAF.exe
  C:\Windows\System\VFpGHAF.exe
  2⤵
  PID:7948
- C:\Windows\System\WRAjcgl.exe
  C:\Windows\System\WRAjcgl.exe
  2⤵
  PID:8012
- C:\Windows\System\HYPKjaK.exe
  C:\Windows\System\HYPKjaK.exe
  2⤵
  PID:8096
- C:\Windows\System\OfHfMWD.exe
  C:\Windows\System\OfHfMWD.exe
  2⤵
  PID:8152
- C:\Windows\System\PXkShmz.exe
  C:\Windows\System\PXkShmz.exe
  2⤵
  PID:7192
- C:\Windows\System\XQnIsNt.exe
  C:\Windows\System\XQnIsNt.exe
  2⤵
  PID:7388
- C:\Windows\System\RqXXkNg.exe
  C:\Windows\System\RqXXkNg.exe
  2⤵
  PID:7608
- C:\Windows\System\DUUijPR.exe
  C:\Windows\System\DUUijPR.exe
  2⤵
  PID:7716
- C:\Windows\System\tcwGjqe.exe
  C:\Windows\System\tcwGjqe.exe
  2⤵
  PID:7864
- C:\Windows\System\Tmgmvtg.exe
  C:\Windows\System\Tmgmvtg.exe
  2⤵
  PID:8068
- C:\Windows\System\pFrNkpF.exe
  C:\Windows\System\pFrNkpF.exe
  2⤵
  PID:8144
- C:\Windows\System\FWtGGPk.exe
  C:\Windows\System\FWtGGPk.exe
  2⤵
  PID:7460
- C:\Windows\System\BkHxQvz.exe
  C:\Windows\System\BkHxQvz.exe
  2⤵
  PID:7808
- C:\Windows\System\tCiIppX.exe
  C:\Windows\System\tCiIppX.exe
  2⤵
  PID:8128
- C:\Windows\System\PEbPrKr.exe
  C:\Windows\System\PEbPrKr.exe
  2⤵
  PID:7940
- C:\Windows\System\JNCkXer.exe
  C:\Windows\System\JNCkXer.exe
  2⤵
  PID:7744
- C:\Windows\System\EfxYilR.exe
  C:\Windows\System\EfxYilR.exe
  2⤵
  PID:8216
- C:\Windows\System\bceqFxP.exe
  C:\Windows\System\bceqFxP.exe
  2⤵
  PID:8244
- C:\Windows\System\CtUkxgj.exe
  C:\Windows\System\CtUkxgj.exe
  2⤵
  PID:8272
- C:\Windows\System\NjzjlJM.exe
  C:\Windows\System\NjzjlJM.exe
  2⤵
  PID:8304
- C:\Windows\System\izdVsRQ.exe
  C:\Windows\System\izdVsRQ.exe
  2⤵
  PID:8328
- C:\Windows\System\GZJNuhY.exe
  C:\Windows\System\GZJNuhY.exe
  2⤵
  PID:8356
- C:\Windows\System\PilFaLa.exe
  C:\Windows\System\PilFaLa.exe
  2⤵
  PID:8392
- C:\Windows\System\vtIhQJO.exe
  C:\Windows\System\vtIhQJO.exe
  2⤵
  PID:8412
- C:\Windows\System\xnKqfES.exe
  C:\Windows\System\xnKqfES.exe
  2⤵
  PID:8444
- C:\Windows\System\biurkCI.exe
  C:\Windows\System\biurkCI.exe
  2⤵
  PID:8468
- C:\Windows\System\eWCkcVl.exe
  C:\Windows\System\eWCkcVl.exe
  2⤵
  PID:8496
- C:\Windows\System\GtnKqOb.exe
  C:\Windows\System\GtnKqOb.exe
  2⤵
  PID:8524
- C:\Windows\System\rPptDHB.exe
  C:\Windows\System\rPptDHB.exe
  2⤵
  PID:8552
- C:\Windows\System\UlXQaSd.exe
  C:\Windows\System\UlXQaSd.exe
  2⤵
  PID:8580
- C:\Windows\System\EAKIxPO.exe
  C:\Windows\System\EAKIxPO.exe
  2⤵
  PID:8612
- C:\Windows\System\ECnSnUQ.exe
  C:\Windows\System\ECnSnUQ.exe
  2⤵
  PID:8640
- C:\Windows\System\Kqkthce.exe
  C:\Windows\System\Kqkthce.exe
  2⤵
  PID:8668
- C:\Windows\System\osFvnUA.exe
  C:\Windows\System\osFvnUA.exe
  2⤵
  PID:8696
- C:\Windows\System\OtNbZuL.exe
  C:\Windows\System\OtNbZuL.exe
  2⤵
  PID:8724
- C:\Windows\System\kbqlORm.exe
  C:\Windows\System\kbqlORm.exe
  2⤵
  PID:8752
- C:\Windows\System\eSSLrMz.exe
  C:\Windows\System\eSSLrMz.exe
  2⤵
  PID:8780
- C:\Windows\System\mWgnfjQ.exe
  C:\Windows\System\mWgnfjQ.exe
  2⤵
  PID:8808
- C:\Windows\System\ZmKzySs.exe
  C:\Windows\System\ZmKzySs.exe
  2⤵
  PID:8840
- C:\Windows\System\nXvmkQO.exe
  C:\Windows\System\nXvmkQO.exe
  2⤵
  PID:8880
- C:\Windows\System\JtBRXKm.exe
  C:\Windows\System\JtBRXKm.exe
  2⤵
  PID:8904
- C:\Windows\System\eZdGZPN.exe
  C:\Windows\System\eZdGZPN.exe
  2⤵
  PID:8936
- C:\Windows\System\PpUnxpR.exe
  C:\Windows\System\PpUnxpR.exe
  2⤵
  PID:8952
- C:\Windows\System\FyGirYI.exe
  C:\Windows\System\FyGirYI.exe
  2⤵
  PID:8980
- C:\Windows\System\EFRSXay.exe
  C:\Windows\System\EFRSXay.exe
  2⤵
  PID:9012
- C:\Windows\System\aRLeUlI.exe
  C:\Windows\System\aRLeUlI.exe
  2⤵
  PID:9036
- C:\Windows\System\yCMyioa.exe
  C:\Windows\System\yCMyioa.exe
  2⤵
  PID:9060
- C:\Windows\System\SRVmlJi.exe
  C:\Windows\System\SRVmlJi.exe
  2⤵
  PID:9092
- C:\Windows\System\FNQwLQn.exe
  C:\Windows\System\FNQwLQn.exe
  2⤵
  PID:9120
- C:\Windows\System\CyuLDKT.exe
  C:\Windows\System\CyuLDKT.exe
  2⤵
  PID:9148
- C:\Windows\System\rSxCzsk.exe
  C:\Windows\System\rSxCzsk.exe
  2⤵
  PID:9176
- C:\Windows\System\qsYliTS.exe
  C:\Windows\System\qsYliTS.exe
  2⤵
  PID:9204
- C:\Windows\System\bEgXMIr.exe
  C:\Windows\System\bEgXMIr.exe
  2⤵
  PID:8236
- C:\Windows\System\CBzrckW.exe
  C:\Windows\System\CBzrckW.exe
  2⤵
  PID:8292
- C:\Windows\System\VZiUKNl.exe
  C:\Windows\System\VZiUKNl.exe
  2⤵
  PID:8352
- C:\Windows\System\xpTueiZ.exe
  C:\Windows\System\xpTueiZ.exe
  2⤵
  PID:8432
- C:\Windows\System\PwOyjTy.exe
  C:\Windows\System\PwOyjTy.exe
  2⤵
  PID:8488
- C:\Windows\System\YIsRfaU.exe
  C:\Windows\System\YIsRfaU.exe
  2⤵
  PID:8548
- C:\Windows\System\uaeFWvW.exe
  C:\Windows\System\uaeFWvW.exe
  2⤵
  PID:8620
- C:\Windows\System\UczsyNz.exe
  C:\Windows\System\UczsyNz.exe
  2⤵
  PID:8684
- C:\Windows\System\cwItPcr.exe
  C:\Windows\System\cwItPcr.exe
  2⤵
  PID:8768
- C:\Windows\System\lHqSUZw.exe
  C:\Windows\System\lHqSUZw.exe
  2⤵
  PID:8828
- C:\Windows\System\VmfeEjA.exe
  C:\Windows\System\VmfeEjA.exe
  2⤵
  PID:1396
- C:\Windows\System\JQNWsbW.exe
  C:\Windows\System\JQNWsbW.exe
  2⤵
  PID:5484
- C:\Windows\System\lxTGndx.exe
  C:\Windows\System\lxTGndx.exe
  2⤵
  PID:4588
- C:\Windows\System\pXUxAJQ.exe
  C:\Windows\System\pXUxAJQ.exe
  2⤵
  PID:8888
- C:\Windows\System\RBinpVQ.exe
  C:\Windows\System\RBinpVQ.exe
  2⤵
  PID:8944
- C:\Windows\System\UayDNjT.exe
  C:\Windows\System\UayDNjT.exe
  2⤵
  PID:9004
- C:\Windows\System\wFJNDXo.exe
  C:\Windows\System\wFJNDXo.exe
  2⤵
  PID:9084
- C:\Windows\System\CqYfzhI.exe
  C:\Windows\System\CqYfzhI.exe
  2⤵
  PID:9140
- C:\Windows\System\opeJNze.exe
  C:\Windows\System\opeJNze.exe
  2⤵
  PID:9188
- C:\Windows\System\USGuIhu.exe
  C:\Windows\System\USGuIhu.exe
  2⤵
  PID:8268
- C:\Windows\System\qSSmDzs.exe
  C:\Windows\System\qSSmDzs.exe
  2⤵
  PID:8660
- C:\Windows\System\EsPUoqa.exe
  C:\Windows\System\EsPUoqa.exe
  2⤵
  PID:8536
- C:\Windows\System\KVAExyL.exe
  C:\Windows\System\KVAExyL.exe
  2⤵
  PID:8680
- C:\Windows\System\DxlnnSL.exe
  C:\Windows\System\DxlnnSL.exe
  2⤵
  PID:4756
- C:\Windows\System\QQjCboE.exe
  C:\Windows\System\QQjCboE.exe
  2⤵
  PID:4328
- C:\Windows\System\qeCDEcg.exe
  C:\Windows\System\qeCDEcg.exe
  2⤵
  PID:8932
- C:\Windows\System\tZvHwHP.exe
  C:\Windows\System\tZvHwHP.exe
  2⤵
  PID:9104
- C:\Windows\System\GLmqvRr.exe
  C:\Windows\System\GLmqvRr.exe
  2⤵
  PID:8228
- C:\Windows\System\CXmBKTH.exe
  C:\Windows\System\CXmBKTH.exe
  2⤵
  PID:8516
- C:\Windows\System\eyPNayJ.exe
  C:\Windows\System\eyPNayJ.exe
  2⤵
  PID:3620
- C:\Windows\System\MAWtSnT.exe
  C:\Windows\System\MAWtSnT.exe
  2⤵
  PID:9000
- C:\Windows\System\SRrJUCQ.exe
  C:\Windows\System\SRrJUCQ.exe
  2⤵
  PID:8380
- C:\Windows\System\hAywydD.exe
  C:\Windows\System\hAywydD.exe
  2⤵
  PID:9168
- C:\Windows\System\FGfDPsv.exe
  C:\Windows\System\FGfDPsv.exe
  2⤵
  PID:9076
- C:\Windows\System\NOiKaGV.exe
  C:\Windows\System\NOiKaGV.exe
  2⤵
  PID:9260
- C:\Windows\System\yATnmdn.exe
  C:\Windows\System\yATnmdn.exe
  2⤵
  PID:9288
- C:\Windows\System\vsXCaxl.exe
  C:\Windows\System\vsXCaxl.exe
  2⤵
  PID:9316
- C:\Windows\System\aDVROvN.exe
  C:\Windows\System\aDVROvN.exe
  2⤵
  PID:9344
- C:\Windows\System\IKCcYSN.exe
  C:\Windows\System\IKCcYSN.exe
  2⤵
  PID:9372
- C:\Windows\System\McmQVab.exe
  C:\Windows\System\McmQVab.exe
  2⤵
  PID:9400
- C:\Windows\System\oBVGxGY.exe
  C:\Windows\System\oBVGxGY.exe
  2⤵
  PID:9432
- C:\Windows\System\XZldOIB.exe
  C:\Windows\System\XZldOIB.exe
  2⤵
  PID:9460
- C:\Windows\System\DKgXkfs.exe
  C:\Windows\System\DKgXkfs.exe
  2⤵
  PID:9488
- C:\Windows\System\nllXsGB.exe
  C:\Windows\System\nllXsGB.exe
  2⤵
  PID:9516
- C:\Windows\System\jVHCbYY.exe
  C:\Windows\System\jVHCbYY.exe
  2⤵
  PID:9544
- C:\Windows\System\TclZsPw.exe
  C:\Windows\System\TclZsPw.exe
  2⤵
  PID:9572
- C:\Windows\System\nOEyjLi.exe
  C:\Windows\System\nOEyjLi.exe
  2⤵
  PID:9600
- C:\Windows\System\CvpZoYX.exe
  C:\Windows\System\CvpZoYX.exe
  2⤵
  PID:9632
- C:\Windows\System\xgtsQuP.exe
  C:\Windows\System\xgtsQuP.exe
  2⤵
  PID:9656
- C:\Windows\System\TCKnrbd.exe
  C:\Windows\System\TCKnrbd.exe
  2⤵
  PID:9684
- C:\Windows\System\NEjoOxM.exe
  C:\Windows\System\NEjoOxM.exe
  2⤵
  PID:9712
- C:\Windows\System\fFYoMnE.exe
  C:\Windows\System\fFYoMnE.exe
  2⤵
  PID:9740
- C:\Windows\System\hLHwjsM.exe
  C:\Windows\System\hLHwjsM.exe
  2⤵
  PID:9768
- C:\Windows\System\JSOuJhv.exe
  C:\Windows\System\JSOuJhv.exe
  2⤵
  PID:9796
- C:\Windows\System\NnrOrFZ.exe
  C:\Windows\System\NnrOrFZ.exe
  2⤵
  PID:9828
- C:\Windows\System\ZAEFzfu.exe
  C:\Windows\System\ZAEFzfu.exe
  2⤵
  PID:9856
- C:\Windows\System\TiFLfKd.exe
  C:\Windows\System\TiFLfKd.exe
  2⤵
  PID:9884
- C:\Windows\System\tdTTfaU.exe
  C:\Windows\System\tdTTfaU.exe
  2⤵
  PID:9912
- C:\Windows\System\gIwebAf.exe
  C:\Windows\System\gIwebAf.exe
  2⤵
  PID:9940
- C:\Windows\System\rtXoZoo.exe
  C:\Windows\System\rtXoZoo.exe
  2⤵
  PID:9968
- C:\Windows\System\EhrGFSg.exe
  C:\Windows\System\EhrGFSg.exe
  2⤵
  PID:9996
- C:\Windows\System\IhLKFNi.exe
  C:\Windows\System\IhLKFNi.exe
  2⤵
  PID:10024
- C:\Windows\System\juueYok.exe
  C:\Windows\System\juueYok.exe
  2⤵
  PID:10052
- C:\Windows\System\LfACRCb.exe
  C:\Windows\System\LfACRCb.exe
  2⤵
  PID:10080
- C:\Windows\System\gdvFYxR.exe
  C:\Windows\System\gdvFYxR.exe
  2⤵
  PID:10108
- C:\Windows\System\ucDKGer.exe
  C:\Windows\System\ucDKGer.exe
  2⤵
  PID:10136
- C:\Windows\System\BQNSpVi.exe
  C:\Windows\System\BQNSpVi.exe
  2⤵
  PID:10164
- C:\Windows\System\nsEbkDt.exe
  C:\Windows\System\nsEbkDt.exe
  2⤵
  PID:10192
- C:\Windows\System\feZhido.exe
  C:\Windows\System\feZhido.exe
  2⤵
  PID:10220
- C:\Windows\System\VjtAszM.exe
  C:\Windows\System\VjtAszM.exe
  2⤵
  PID:9248
- C:\Windows\System\twwWQgw.exe
  C:\Windows\System\twwWQgw.exe
  2⤵
  PID:9328
- C:\Windows\System\UnrYTRJ.exe
  C:\Windows\System\UnrYTRJ.exe
  2⤵
  PID:9392
- C:\Windows\System\TTvBCOD.exe
  C:\Windows\System\TTvBCOD.exe
  2⤵
  PID:9456
- C:\Windows\System\qMziAPT.exe
  C:\Windows\System\qMziAPT.exe
  2⤵
  PID:9528
- C:\Windows\System\vBCBRNa.exe
  C:\Windows\System\vBCBRNa.exe
  2⤵
  PID:9592
- C:\Windows\System\xdLQDtt.exe
  C:\Windows\System\xdLQDtt.exe
  2⤵
  PID:9652
- C:\Windows\System\TDbADBa.exe
  C:\Windows\System\TDbADBa.exe
  2⤵
  PID:9724
- C:\Windows\System\IUYzGCA.exe
  C:\Windows\System\IUYzGCA.exe
  2⤵
  PID:9788
- C:\Windows\System\gaDlDrL.exe
  C:\Windows\System\gaDlDrL.exe
  2⤵
  PID:9848
- C:\Windows\System\SDBwQca.exe
  C:\Windows\System\SDBwQca.exe
  2⤵
  PID:9900
- C:\Windows\System\ECzAupf.exe
  C:\Windows\System\ECzAupf.exe
  2⤵
  PID:9980
- C:\Windows\System\PJjfusr.exe
  C:\Windows\System\PJjfusr.exe
  2⤵
  PID:10048
- C:\Windows\System\prlHMSa.exe
  C:\Windows\System\prlHMSa.exe
  2⤵
  PID:10076
- C:\Windows\System\fkmXwqf.exe
  C:\Windows\System\fkmXwqf.exe
  2⤵
  PID:10120
- C:\Windows\System\VVXQTaK.exe
  C:\Windows\System\VVXQTaK.exe
  2⤵
  PID:10184
- C:\Windows\System\pEFVSBD.exe
  C:\Windows\System\pEFVSBD.exe
  2⤵
  PID:9228
- C:\Windows\System\QdYwQdB.exe
  C:\Windows\System\QdYwQdB.exe
  2⤵
  PID:9384
- C:\Windows\System\dGRvRJk.exe
  C:\Windows\System\dGRvRJk.exe
  2⤵
  PID:9564
- C:\Windows\System\bvUsXuU.exe
  C:\Windows\System\bvUsXuU.exe
  2⤵
  PID:9780
- C:\Windows\System\gypffTo.exe
  C:\Windows\System\gypffTo.exe
  2⤵
  PID:9936
- C:\Windows\System\CIDXJaY.exe
  C:\Windows\System\CIDXJaY.exe
  2⤵
  PID:10160
- C:\Windows\System\DoMRdsw.exe
  C:\Windows\System\DoMRdsw.exe
  2⤵
  PID:10216
- C:\Windows\System\pdmcyYu.exe
  C:\Windows\System\pdmcyYu.exe
  2⤵
  PID:9508
- C:\Windows\System\jXfQtTN.exe
  C:\Windows\System\jXfQtTN.exe
  2⤵
  PID:10156
- C:\Windows\System\sUWMupD.exe
  C:\Windows\System\sUWMupD.exe
  2⤵
  PID:9704
- C:\Windows\System\KyzGELb.exe
  C:\Windows\System\KyzGELb.exe
  2⤵
  PID:10148
- C:\Windows\System\ooDEZmx.exe
  C:\Windows\System\ooDEZmx.exe
  2⤵
  PID:10248
- C:\Windows\System\FDILfdL.exe
  C:\Windows\System\FDILfdL.exe
  2⤵
  PID:10276
- C:\Windows\System\qoXhLGJ.exe
  C:\Windows\System\qoXhLGJ.exe
  2⤵
  PID:10296
- C:\Windows\System\vDLWPnj.exe
  C:\Windows\System\vDLWPnj.exe
  2⤵
  PID:10324
- C:\Windows\System\KSSMUEA.exe
  C:\Windows\System\KSSMUEA.exe
  2⤵
  PID:10372
- C:\Windows\System\AyLLklU.exe
  C:\Windows\System\AyLLklU.exe
  2⤵
  PID:10404
- C:\Windows\System\QzlyYKG.exe
  C:\Windows\System\QzlyYKG.exe
  2⤵
  PID:10432
- C:\Windows\System\RWkzFvN.exe
  C:\Windows\System\RWkzFvN.exe
  2⤵
  PID:10460
- C:\Windows\System\rtsGZGp.exe
  C:\Windows\System\rtsGZGp.exe
  2⤵
  PID:10496
- C:\Windows\System\rDYchLM.exe
  C:\Windows\System\rDYchLM.exe
  2⤵
  PID:10524
- C:\Windows\System\NbHOFDr.exe
  C:\Windows\System\NbHOFDr.exe
  2⤵
  PID:10552
- C:\Windows\System\sFgVovi.exe
  C:\Windows\System\sFgVovi.exe
  2⤵
  PID:10572
- C:\Windows\System\BNwAEDL.exe
  C:\Windows\System\BNwAEDL.exe
  2⤵
  PID:10600
- C:\Windows\System\JWZviOp.exe
  C:\Windows\System\JWZviOp.exe
  2⤵
  PID:10624
- C:\Windows\System\FTIvYuV.exe
  C:\Windows\System\FTIvYuV.exe
  2⤵
  PID:10652
- C:\Windows\System\vyUucgD.exe
  C:\Windows\System\vyUucgD.exe
  2⤵
  PID:10684
- C:\Windows\System\PcpxFsh.exe
  C:\Windows\System\PcpxFsh.exe
  2⤵
  PID:10708
- C:\Windows\System\gvKozNf.exe
  C:\Windows\System\gvKozNf.exe
  2⤵
  PID:10748
- C:\Windows\System\seArjID.exe
  C:\Windows\System\seArjID.exe
  2⤵
  PID:10768
- C:\Windows\System\gIcUsBV.exe
  C:\Windows\System\gIcUsBV.exe
  2⤵
  PID:10796
- C:\Windows\System\CHSRONC.exe
  C:\Windows\System\CHSRONC.exe
  2⤵
  PID:10832
- C:\Windows\System\fWqelgi.exe
  C:\Windows\System\fWqelgi.exe
  2⤵
  PID:10860
- C:\Windows\System\nqvfoQl.exe
  C:\Windows\System\nqvfoQl.exe
  2⤵
  PID:10888
- C:\Windows\System\oIrnEPO.exe
  C:\Windows\System\oIrnEPO.exe
  2⤵
  PID:10916
- C:\Windows\System\hyawEtt.exe
  C:\Windows\System\hyawEtt.exe
  2⤵
  PID:10944
- C:\Windows\System\FtJLlil.exe
  C:\Windows\System\FtJLlil.exe
  2⤵
  PID:10972
- C:\Windows\System\EUjpdAO.exe
  C:\Windows\System\EUjpdAO.exe
  2⤵
  PID:11000
- C:\Windows\System\RFqQFRn.exe
  C:\Windows\System\RFqQFRn.exe
  2⤵
  PID:11028
- C:\Windows\System\XVICZad.exe
  C:\Windows\System\XVICZad.exe
  2⤵
  PID:11056
- C:\Windows\System\hDchJYH.exe
  C:\Windows\System\hDchJYH.exe
  2⤵
  PID:11084
- C:\Windows\System\hXdYEfU.exe
  C:\Windows\System\hXdYEfU.exe
  2⤵
  PID:11112
- C:\Windows\System\aWcLVeT.exe
  C:\Windows\System\aWcLVeT.exe
  2⤵
  PID:11140
- C:\Windows\System\cECiyuS.exe
  C:\Windows\System\cECiyuS.exe
  2⤵
  PID:11168
- C:\Windows\System\WLxCMSt.exe
  C:\Windows\System\WLxCMSt.exe
  2⤵
  PID:11196
- C:\Windows\System\YOMMctW.exe
  C:\Windows\System\YOMMctW.exe
  2⤵
  PID:11224
- C:\Windows\System\WIQFcDu.exe
  C:\Windows\System\WIQFcDu.exe
  2⤵
  PID:11252
- C:\Windows\System\ognSQmv.exe
  C:\Windows\System\ognSQmv.exe
  2⤵
  PID:10264
- C:\Windows\System\gGRsZUi.exe
  C:\Windows\System\gGRsZUi.exe
  2⤵
  PID:10320
- C:\Windows\System\pPYYZLS.exe
  C:\Windows\System\pPYYZLS.exe
  2⤵
  PID:10396
- C:\Windows\System\fIUQOqa.exe
  C:\Windows\System\fIUQOqa.exe
  2⤵
  PID:10456
- C:\Windows\System\eRzZuAl.exe
  C:\Windows\System\eRzZuAl.exe
  2⤵
  PID:10520
- C:\Windows\System\JiiLOQH.exe
  C:\Windows\System\JiiLOQH.exe
  2⤵
  PID:10588
- C:\Windows\System\ZrYXmgj.exe
  C:\Windows\System\ZrYXmgj.exe
  2⤵
  PID:10664
- C:\Windows\System\KMIPRBY.exe
  C:\Windows\System\KMIPRBY.exe
  2⤵
  PID:10732
- C:\Windows\System\CFKjSsH.exe
  C:\Windows\System\CFKjSsH.exe
  2⤵
  PID:10816
- C:\Windows\System\uAMFhjr.exe
  C:\Windows\System\uAMFhjr.exe
  2⤵
  PID:10844
- C:\Windows\System\RHndcAi.exe
  C:\Windows\System\RHndcAi.exe
  2⤵
  PID:10928
- C:\Windows\System\evovgzr.exe
  C:\Windows\System\evovgzr.exe
  2⤵
  PID:10992
- C:\Windows\System\cOMnanI.exe
  C:\Windows\System\cOMnanI.exe
  2⤵
  PID:11052
- C:\Windows\System\RVEFLhb.exe
  C:\Windows\System\RVEFLhb.exe
  2⤵
  PID:11124
- C:\Windows\System\egwpDyE.exe
  C:\Windows\System\egwpDyE.exe
  2⤵
  PID:11180
- C:\Windows\System\ebVesNl.exe
  C:\Windows\System\ebVesNl.exe
  2⤵
  PID:11244
- C:\Windows\System\tMJrSQU.exe
  C:\Windows\System\tMJrSQU.exe
  2⤵
  PID:10316
- C:\Windows\System\szITKoF.exe
  C:\Windows\System\szITKoF.exe
  2⤵
  PID:10488
- C:\Windows\System\PONSLfH.exe
  C:\Windows\System\PONSLfH.exe
  2⤵
  PID:10644
- C:\Windows\System\tOuEEVM.exe
  C:\Windows\System\tOuEEVM.exe
  2⤵
  PID:10804
- C:\Windows\System\RokFFYB.exe
  C:\Windows\System\RokFFYB.exe
  2⤵
  PID:10964
- C:\Windows\System\vDjtsbx.exe
  C:\Windows\System\vDjtsbx.exe
  2⤵
  PID:11104
- C:\Windows\System\SlKiMIU.exe
  C:\Windows\System\SlKiMIU.exe
  2⤵
  PID:11236
- C:\Windows\System\pjsJrgl.exe
  C:\Windows\System\pjsJrgl.exe
  2⤵
  PID:10568
- C:\Windows\System\pjwdETl.exe
  C:\Windows\System\pjwdETl.exe
  2⤵
  PID:10852
- C:\Windows\System\gageRdX.exe
  C:\Windows\System\gageRdX.exe
  2⤵
  PID:3696
- C:\Windows\System\gJgpSlv.exe
  C:\Windows\System\gJgpSlv.exe
  2⤵
  PID:10448
- C:\Windows\System\GWvbFeL.exe
  C:\Windows\System\GWvbFeL.exe
  2⤵
  PID:11208
- C:\Windows\System\BCcWOIZ.exe
  C:\Windows\System\BCcWOIZ.exe
  2⤵
  PID:11272
- C:\Windows\System\uYywili.exe
  C:\Windows\System\uYywili.exe
  2⤵
  PID:11300
- C:\Windows\System\vFgxlHU.exe
  C:\Windows\System\vFgxlHU.exe
  2⤵
  PID:11328
- C:\Windows\System\UjeIPsM.exe
  C:\Windows\System\UjeIPsM.exe
  2⤵
  PID:11356
- C:\Windows\System\eEzEemj.exe
  C:\Windows\System\eEzEemj.exe
  2⤵
  PID:11384
- C:\Windows\System\dDyoMPZ.exe
  C:\Windows\System\dDyoMPZ.exe
  2⤵
  PID:11412
- C:\Windows\System\sMaBOxG.exe
  C:\Windows\System\sMaBOxG.exe
  2⤵
  PID:11440
- C:\Windows\System\RTXlbgF.exe
  C:\Windows\System\RTXlbgF.exe
  2⤵
  PID:11468
- C:\Windows\System\hQQiFKN.exe
  C:\Windows\System\hQQiFKN.exe
  2⤵
  PID:11496
- C:\Windows\System\UlqcPuc.exe
  C:\Windows\System\UlqcPuc.exe
  2⤵
  PID:11524
- C:\Windows\System\SuqQfYF.exe
  C:\Windows\System\SuqQfYF.exe
  2⤵
  PID:11552
- C:\Windows\System\ZtGtcqz.exe
  C:\Windows\System\ZtGtcqz.exe
  2⤵
  PID:11580
- C:\Windows\System\pOMRMNa.exe
  C:\Windows\System\pOMRMNa.exe
  2⤵
  PID:11608
- C:\Windows\System\PrFIZax.exe
  C:\Windows\System\PrFIZax.exe
  2⤵
  PID:11636
- C:\Windows\System\QpreNwo.exe
  C:\Windows\System\QpreNwo.exe
  2⤵
  PID:11664
- C:\Windows\System\vjYlssl.exe
  C:\Windows\System\vjYlssl.exe
  2⤵
  PID:11692
- C:\Windows\System\gfUiETW.exe
  C:\Windows\System\gfUiETW.exe
  2⤵
  PID:11720
- C:\Windows\System\zhQfqaU.exe
  C:\Windows\System\zhQfqaU.exe
  2⤵
  PID:11752
- C:\Windows\System\axtHpAF.exe
  C:\Windows\System\axtHpAF.exe
  2⤵
  PID:11768
- C:\Windows\System\SjVZbSX.exe
  C:\Windows\System\SjVZbSX.exe
  2⤵
  PID:11796
- C:\Windows\System\EqHPtMU.exe
  C:\Windows\System\EqHPtMU.exe
  2⤵
  PID:11844
- C:\Windows\System\QYvBIrw.exe
  C:\Windows\System\QYvBIrw.exe
  2⤵
  PID:11860
- C:\Windows\System\XNmWVGK.exe
  C:\Windows\System\XNmWVGK.exe
  2⤵
  PID:11892
- C:\Windows\System\qLhFRPx.exe
  C:\Windows\System\qLhFRPx.exe
  2⤵
  PID:11920
- C:\Windows\System\KtaBOqU.exe
  C:\Windows\System\KtaBOqU.exe
  2⤵
  PID:11948
- C:\Windows\System\LbmDGcG.exe
  C:\Windows\System\LbmDGcG.exe
  2⤵
  PID:11976
- C:\Windows\System\gvzEYSz.exe
  C:\Windows\System\gvzEYSz.exe
  2⤵
  PID:12004
- C:\Windows\System\AyfVdVS.exe
  C:\Windows\System\AyfVdVS.exe
  2⤵
  PID:12032
- C:\Windows\System\EFbsZAe.exe
  C:\Windows\System\EFbsZAe.exe
  2⤵
  PID:12060
- C:\Windows\System\VEpHhwe.exe
  C:\Windows\System\VEpHhwe.exe
  2⤵
  PID:12088
- C:\Windows\System\VsOLfwo.exe
  C:\Windows\System\VsOLfwo.exe
  2⤵
  PID:12116
- C:\Windows\System\tbUAzbs.exe
  C:\Windows\System\tbUAzbs.exe
  2⤵
  PID:12144
- C:\Windows\System\TeZmBsp.exe
  C:\Windows\System\TeZmBsp.exe
  2⤵
  PID:12172
- C:\Windows\System\wrgFNSK.exe
  C:\Windows\System\wrgFNSK.exe
  2⤵
  PID:12200
- C:\Windows\System\mCLFlun.exe
  C:\Windows\System\mCLFlun.exe
  2⤵
  PID:12228
- C:\Windows\System\mZChIxm.exe
  C:\Windows\System\mZChIxm.exe
  2⤵
  PID:12256
- C:\Windows\System\bnzZhJv.exe
  C:\Windows\System\bnzZhJv.exe
  2⤵
  PID:12284
- C:\Windows\System\HraXvXG.exe
  C:\Windows\System\HraXvXG.exe
  2⤵
  PID:11312
- C:\Windows\System\qGqJhdg.exe
  C:\Windows\System\qGqJhdg.exe
  2⤵
  PID:11352
- C:\Windows\System\tfIMGUt.exe
  C:\Windows\System\tfIMGUt.exe
  2⤵
  PID:11408
- C:\Windows\System\wFCpTOR.exe
  C:\Windows\System\wFCpTOR.exe
  2⤵
  PID:11508
- C:\Windows\System\ZcqGkor.exe
  C:\Windows\System\ZcqGkor.exe
  2⤵
  PID:11520
- C:\Windows\System\xTTNcfx.exe
  C:\Windows\System\xTTNcfx.exe
  2⤵
  PID:4372
- C:\Windows\System\punYmwr.exe
  C:\Windows\System\punYmwr.exe
  2⤵
  PID:11620
- C:\Windows\System\WnmgPxk.exe
  C:\Windows\System\WnmgPxk.exe
  2⤵
  PID:11676
- C:\Windows\System\DDQioCT.exe
  C:\Windows\System\DDQioCT.exe
  2⤵
  PID:11740
- C:\Windows\System\qygDvTp.exe
  C:\Windows\System\qygDvTp.exe
  2⤵
  PID:11804
- C:\Windows\System\ueDHdZm.exe
  C:\Windows\System\ueDHdZm.exe
  2⤵
  PID:11872
- C:\Windows\System\LkBiXWb.exe
  C:\Windows\System\LkBiXWb.exe
  2⤵
  PID:11940
- C:\Windows\System\EBbtQhq.exe
  C:\Windows\System\EBbtQhq.exe
  2⤵
  PID:11996
- C:\Windows\System\GzTqUOQ.exe
  C:\Windows\System\GzTqUOQ.exe
  2⤵
  PID:12072
- C:\Windows\System\bDtmGHX.exe
  C:\Windows\System\bDtmGHX.exe
  2⤵
  PID:12136
- C:\Windows\System\JoBgPpu.exe
  C:\Windows\System\JoBgPpu.exe
  2⤵
  PID:12196
- C:\Windows\System\jdHkXLO.exe
  C:\Windows\System\jdHkXLO.exe
  2⤵
  PID:12268
- C:\Windows\System\votSxAR.exe
  C:\Windows\System\votSxAR.exe
  2⤵
  PID:11292
- C:\Windows\System\VIOLMCN.exe
  C:\Windows\System\VIOLMCN.exe
  2⤵
  PID:11488
- C:\Windows\System\uIZOLrN.exe
  C:\Windows\System\uIZOLrN.exe
  2⤵
  PID:11592
- C:\Windows\System\TMaNdLG.exe
  C:\Windows\System\TMaNdLG.exe
  2⤵
  PID:11716
- C:\Windows\System\maShTEH.exe
  C:\Windows\System\maShTEH.exe
  2⤵
  PID:11828
- C:\Windows\System\JuTUnUW.exe
  C:\Windows\System\JuTUnUW.exe
  2⤵
  PID:12028
- C:\Windows\System\LGoHOJw.exe
  C:\Windows\System\LGoHOJw.exe
  2⤵
  PID:12184
- C:\Windows\System\AJKVmzI.exe
  C:\Windows\System\AJKVmzI.exe
  2⤵
  PID:1520
- C:\Windows\System\yLEfMEv.exe
  C:\Windows\System\yLEfMEv.exe
  2⤵
  PID:11536
- C:\Windows\System\cQfDfNS.exe
  C:\Windows\System\cQfDfNS.exe
  2⤵
  PID:11852
- C:\Windows\System\NLhhnuH.exe
  C:\Windows\System\NLhhnuH.exe
  2⤵
  PID:4392
- C:\Windows\System\teTLEku.exe
  C:\Windows\System\teTLEku.exe
  2⤵
  PID:12168
- C:\Windows\System\WRNowEQ.exe
  C:\Windows\System\WRNowEQ.exe
  2⤵
  PID:11712
- C:\Windows\System\jYfWHMl.exe
  C:\Windows\System\jYfWHMl.exe
  2⤵
  PID:12312
- C:\Windows\System\DoGhfiS.exe
  C:\Windows\System\DoGhfiS.exe
  2⤵
  PID:12340
- C:\Windows\System\WkJdNpM.exe
  C:\Windows\System\WkJdNpM.exe
  2⤵
  PID:12364
- C:\Windows\System\WqeOgry.exe
  C:\Windows\System\WqeOgry.exe
  2⤵
  PID:12404
- C:\Windows\System\JpFTVur.exe
  C:\Windows\System\JpFTVur.exe
  2⤵
  PID:12432
- C:\Windows\System\rKjCnTy.exe
  C:\Windows\System\rKjCnTy.exe
  2⤵
  PID:12460
- C:\Windows\System\KryCBzc.exe
  C:\Windows\System\KryCBzc.exe
  2⤵
  PID:12488
- C:\Windows\System\KkNySuU.exe
  C:\Windows\System\KkNySuU.exe
  2⤵
  PID:12516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oawxrujo.xzv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CEYMFQs.exe

Filesize
2.4MB

MD5
d7c63d8cbf7ca3dcd9e249ad7f0731f0

SHA1
5b26a92f6a91880286fd3e995b8e152a6598df99

SHA256
759234e3b1813fda57d8cd9743dc39d463863f3667c30881be4b418274059e82

SHA512
c5c851623a551d2027f8b2a5826aaebb3612a60d613941126640a3a575105c45d52eafc38dcac03f090923b531b85a23496ff0243ef95ac3b5ab1cc35caf491a

Download Submit
C:\Windows\System\FeEOFsD.exe

Filesize
2.4MB

MD5
1785f0fbbd6d2d520175af59d2e9677a

SHA1
19617fb79fdabd788b007b8ebb4a2776c965b226

SHA256
6110d96806546739c2bd333eef910cc2d1a196c0c442e2dcd0ae69883c9e1f97

SHA512
43661e1c0d57aeba4396c2b20bb3c04b2d86326a6f7fe8aef7b28a4ab36976e9ec6ee7c679422001bae73b190d4f4856bbba9709e8116016e35ca1fca84b518e

Download Submit
C:\Windows\System\HKunVMo.exe

Filesize
2.4MB

MD5
2cf086e2d99091f1fa9f0ceb4a51ed07

SHA1
24825f672698e6352843748a79efc6bbdf33f2b1

SHA256
a676b533402935a6a5bfdd72715a035a70b1899a471f88671857f653191ef744

SHA512
4e76f701399d898b3f048483210346ad515023fda8ef9f83be3ce14fb2e671cbeb3e537563b4a5621a5919a8702a395de126449e27edb969bc9528aaf6fc6b18

Download Submit
C:\Windows\System\IBvYAtf.exe

Filesize
2.4MB

MD5
7883898a367fe58109447165bf9fdaf1

SHA1
5a9c349b24dd439f4267f2501e769c73a7077848

SHA256
c38709cfb91cd8a6cd05a8e5afd36d68be2ffb16631a45e5e2b4a03dc1dd6470

SHA512
7c70aa7d6e0bde49051852fb717b8c643036fbf4bda806d4b8cd374c78e3c768e4561687836e5a898ae954e61bcd55ea4a44fe5c8e95b6cdbd13e8315d6b03e0

Download Submit
C:\Windows\System\JsKLzyb.exe

Filesize
2.4MB

MD5
a87ac8821a794909d844ac2bf117d809

SHA1
df4a9e70e5dbc596b6db4d47c1aba6cbe292cdc0

SHA256
d27e00fb83ec8fe31cb4b942d966fc891517a1f77df510e9a5fd0b09470df56f

SHA512
bc32cc5c24726b4d4891863ce3796a378ea6dcfde5474e941eef86c01522aea42289f4f0187aba0597209e0b928676e35428f8f43f1f94e9b0ef53f5e5ba6f04

Download Submit
C:\Windows\System\MBjGNAE.exe

Filesize
2.4MB

MD5
f38a1b38164866d12dc322aef575746d

SHA1
d383f0027537f8200c439a5ed50a5fa526d099e0

SHA256
d819456ce8e73484ddf5ffdb76c06fffb3aaa25d7df146cccfd5c0ba3923de14

SHA512
3ecb0391fb1a4b8dae7387104c0dc4af50646e18c67f69b37103a6756067dfd2d8dfe8256b98a9097eff97a41dd67f6374101a91187b6820a2361989868332cc

Download Submit
C:\Windows\System\NoTMrHm.exe

Filesize
2.4MB

MD5
c6514c786740e46e4cce65ac4dc30c32

SHA1
05d6e67873ccd0c5d787edd6466f1c6189f921d2

SHA256
6494969434312d4224211c25a653a7283596fcd5959541081a32286714b3dd2e

SHA512
da529e42a784a50dbe3c9dbc0dfa2f70789dc3f61f50ceec61eb81df817160784bd23abd3fe4d086f851d952f1a1b30b200f0894b5ca70af8b83935112d026aa

Download Submit
C:\Windows\System\ROocpgx.exe

Filesize
2.4MB

MD5
2f4adb8abfcbe15bc218ae510ea2baa6

SHA1
605d33194a4b39a2f1072f737c1b182f3f852e14

SHA256
76d06db9a81fdbd2d101180b61ebf4caeec080c5e781e724bebb46e026cdd5ee

SHA512
98cf58e6aa38109e04fac248832672c100f7c6245a2d02e75cc10e7234baedaa4cd8fad2887b0a8d563aff27c9c9773e3365611649857d462731abd52ebefb90

Download Submit
C:\Windows\System\SBLFmNx.exe

Filesize
2.4MB

MD5
74334831fcb2b433ab161713f45c36bd

SHA1
0c03f4ae3f201adc2c3994828ace252ff3e44b51

SHA256
bb77cc04a1516abc03b48c82df9e09b90eb19660f319e02978cd35d20af5a1ee

SHA512
19191e177590f1d033c1bc5b7e86e18cb29bb26b8a4098b55fee5ec7cfae3dbc2251f78eb3aee22846a5d65da1109b84c9a89d2b564120e3e3e60f063f5010dc

Download Submit
C:\Windows\System\SzDxrMn.exe

Filesize
2.4MB

MD5
0feffa1342531f7cb44e8f8a2c70f5d9

SHA1
90af023910efdbf733541e571a116a703f1f4c1e

SHA256
e02236dbe8bc3aa967ccbcd45f694d1f8d592364de3d09c4fda8df3e6ee1cd7e

SHA512
050f01b3b8cb482d397fc9ca087b89b56a4092b90ad3d7f2447c00ecd156089999837666fd766decfa8f97fc664bc7d4a1030e82a07ae2868aad9866cf1962b0

Download Submit
C:\Windows\System\TDlWpeH.exe

Filesize
2.4MB

MD5
0d6fcc5fecd16fceafa6c93387e83781

SHA1
d83c60fa42e9de7d51c2c8d043084078ee6a935e

SHA256
0230e97d2d40cdd97d11cee7b0dc55b26a5cc742766429f431c83a69f77b6d93

SHA512
0a8e1dab5815ab7cfacbf49907d680ac17e3e4087d6b6fb8a13e0d44789ed81597635bed0dbb8ad4f40a995869d27dcbec984ce377be89fd748b04e1fd5f4575

Download Submit
C:\Windows\System\Uszrhwu.exe

Filesize
2.4MB

MD5
f18559230e71ee3940f8abe1df59a404

SHA1
5d258f710d6fadcd2151c8f578fdae0f59f66290

SHA256
e306817bdaebf68a8482c1311b7ae4da30d44b5007b21d92abe7b5e729bbeb1b

SHA512
e74f5ee3237fa72f6c184b2050a7f10eb931ef66c283929a1e5ddf8248394a9f6288c2406d73e9a0995c04036b5d177e6ac9c6fa0df1a97142c13f5ec2beb6e0

Download Submit
C:\Windows\System\WlroBrE.exe

Filesize
2.4MB

MD5
f7720ac8a01022a59b4ab0b939e14ccb

SHA1
17327b2eac77a3ed74710a80892ad1503192adcd

SHA256
dacbcf20747dec5b1d40ff9c1cddc81f82a5e0ef6bd103a399c10398ec7deaf6

SHA512
eeda0d43c20d0b850bdb03a9a96cbfc647ea0be585ce462f675b3eb84e9da1dd4eae6931042e5eafbf374b3c555a4740f39bb7b72fe42c1c44e51c328a8bbcca

Download Submit
C:\Windows\System\YRCcHXt.exe

Filesize
2.4MB

MD5
ceea901d75019e93c8951b78a2dfe549

SHA1
68028d285fa5e46b4c9d4c8792b47c1ae4c3395f

SHA256
2238e75dd279839f4fbb611be03fcfde7113e02cee34acbff1a55856ee287199

SHA512
b5e7df0544601ca09cf9c73ea857bf2cbf4d3e22607d994e9a90273876cd501d10ab22e59020426c6e0ca2fb0ef3e9c9b7dd984c616b72c99f028cc13b055182

Download Submit
C:\Windows\System\ZGYotIw.exe

Filesize
2.4MB

MD5
264e947c382d833cee4bca03aa482440

SHA1
16ef8a1ad91ff7b80f8cb210162322ab8f45457c

SHA256
a108c99cae0de75cdcda9a48e970328fefc68c9194b67b4c06f2e8e7259d8a88

SHA512
0970d89299ea0d67d5632f2c4e9b4a7e382698894d1540b7f584e1f20735f6b5b64218c15ac09b5e5c77f8742f0a79345f6fd386e24f20a88afe6d6b67ce39ec

Download Submit
C:\Windows\System\ZJYdtpd.exe

Filesize
2.4MB

MD5
85714b4ee2dee36d575b7e5d90dc3283

SHA1
9e29d50a8d880dce104e7a55d370b7ebb9a5e3e2

SHA256
414a59cfb714e02340fb660e2c6526a252db845b0dfe000f32410ea8324fadf3

SHA512
c5df77a4582743824a2ddbf256790baeb647f58ec21efa65fddd4314839441fb74bec2cc713b2e019bb688baf2d9454476bdc684fb71c62b8feeed486a71f5dc

Download Submit
C:\Windows\System\Zrchxbg.exe

Filesize
2.4MB

MD5
e3c5db6ec9b569275df95edfa9a19d04

SHA1
41db488cade847bce924cd37db834d48f47532aa

SHA256
a4157767c86048335a0e8a5411c772b66d0115c3f7ac7fbb0cdd34015b3f8260

SHA512
76da20fe209b5e41aface146b86fbc490a2b125d7bb4c1b759eec721eb297291ad8b78ad2c03e13c51c5eb45b361314dcb369273194b53a757232b41de59883c

Download Submit
C:\Windows\System\ZwMhLOR.exe

Filesize
2.4MB

MD5
535f7ef4736845b01ddcf19b3f603f9f

SHA1
9f8a43048fc1aa564c22e0c647d9dba92195db5d

SHA256
87a9bd0a620a7764599527d262a2ab27ae190a9fc4ce4b1f470760b9a0694a1d

SHA512
d48ce3a25e3a886e17d22d761db38f48a2271a345f97950a014f6a8bd6fd5cbceac39831e630d77653e9381d9cbe3ca6436264a40b4406217507ad2fca5e650d

Download Submit
C:\Windows\System\aFTaibm.exe

Filesize
2.4MB

MD5
847a049105ee94f8acb446da3f9d391f

SHA1
90b4453f64a394bf7d0ff71787f89d2098690f53

SHA256
b0bc0ee54d44b8c083a15048c6441876e3a691754758e34357f4b5fa6a1c1592

SHA512
e09d2e05ccc7b61cd54bf51590172d8ae2d6f7ca59b6b7898351fe9ec368acec47a7dc85eb7fd0ac5a6a9fb4ecc0d71ac6b978a41038a62fb223c269d4558393

Download Submit
C:\Windows\System\awpyJZA.exe

Filesize
2.4MB

MD5
228ff05e50189ce75f2422bac8a0b690

SHA1
c28757b6e7a7335d3d80fdf4c31f2abadf16e33c

SHA256
e8a01420093ce5fe943b78b5d5e52a6e3c9ca77b62fac98beace387e6cff41c1

SHA512
ef5a5d7b20c3462ea2e2f05f01622a7170afbcc732a9c4de1fb8023a1ec1eaaa97c11e327fd3230c3eba975a960d4dafe96072326ee60761facb4edfdde23084

Download Submit
C:\Windows\System\bOptzfh.exe

Filesize
2.4MB

MD5
7f09db917c1c356fdb44350a94cb2348

SHA1
7e9f142f6577ed3aacb6f252ed25b4344639cd12

SHA256
ca5168be7177607a8e3d8d6e66b310da44b0737a3e1d1c4d98ff4d3c0c8f3697

SHA512
73151fa047b4fd146ee3427454371da3ed241a8fab6ea0f4ad70e76cefbbeffc4cf7e139f8cf420be23e60aa119a77ac1f973e73af97803afc1dee5948f748f6

Download Submit
C:\Windows\System\dArLylI.exe

Filesize
2.4MB

MD5
91ae3f393fc4d9b1cc2ac6ef1887fa39

SHA1
fbbb6504529b988bdb978641d6f74143437a2785

SHA256
829cc5fa46d4aa1aa297689de2e35d67e505979a29e11ea381a4bf9d5c8fe055

SHA512
77dfc87f0b8ae688f78cb0d8d6d6b9ee042084399b34f833db9ef22a300750b78f8349322abeb13d2c687eb8a487c1b22db44ab6aa4a92ebc1f9817da8ca8d46

Download Submit
C:\Windows\System\edXbVmh.exe

Filesize
2.4MB

MD5
aae52b66599a533c218e8a8c7fc41d4a

SHA1
fb55e27902162b645153ed64886d2fd599456499

SHA256
4fa1c3a84e93b4ae231b5e9b1e5a862128d156f7067ae638ab2fb3e1a03d824f

SHA512
1e6bd6fe95a6ceb551d266d8cf7ff0560361424c2077f83fadbe7d08c83fd3e4864bb12fae69d8482767e04d1150f02ac30af99628dcbaed6a3ddd57fca73479

Download Submit
C:\Windows\System\eqVqYsY.exe

Filesize
2.4MB

MD5
f27405d6ce41d184cc18e4e4060ebb06

SHA1
02393bdacb5290f5d90e807d82914909f479f20f

SHA256
530c85e873d6879b33c2b2d0e75723894d8c9322240c1d36c173b63a5639838a

SHA512
acb8f711cd95121513699d1bf4d4e179d3bba64010e39d533337d3089680e5b9377661aa2fddf4ab8e3f924f52acd5bfef4242e2acad99ed32be15a0b6d8010f

Download Submit
C:\Windows\System\fvFPxWM.exe

Filesize
2.4MB

MD5
d6b1c3885a77a842e63b34b2d6a9c76f

SHA1
aa0ecc4a55a045c0d8760d45cfc263777f4499d2

SHA256
da9abd7a13ef7afcaaa307e65d1dd5435fc3aebce1d36799d9f5d0b511caf1bd

SHA512
aff560f50484bc8432dd00738aeca8b7ecb1f233cba963c56fcfb65049f89950ba7a4dd23d8f413125a666ca80fb70dab9d95bea27deaebbf02fdb2cfbffecbb

Download Submit
C:\Windows\System\gbresVq.exe

Filesize
2.4MB

MD5
b0ea5dcd95686ad4998459d78e0a0fcc

SHA1
55e93f7fd9266d047cf2a08b2c8db916fd4266b0

SHA256
52fbef216840290a9906951d58d58096d968722493f991230ee8058e81fcf09c

SHA512
f1e1eb239fcc6210a83a3979956db3020d0bf46c7463f6922e0ab9471dd077e2d129211f1705c611e6d0bc302594934c32c17736a60107babdaf22b3a401e7c0

Download Submit
C:\Windows\System\iIKykuh.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\System\lEiEIMS.exe

Filesize
2.4MB

MD5
80d090507d1dcf53b7f891f9d40bd593

SHA1
05408d0ef66e6e9bc8151b6f514eea543cd27f1b

SHA256
b9adc0a016a406a2959ef7d27bd1dfa4a3ed060dc1d2c181de447c1cdd637f6a

SHA512
b6bf55b4505828696e34daa82662eef6f15cf2b526f1f3ef9a89d2f15a66e4496d44634312e9919b1772c511ee5582e5679f5c292b74c982fec36e746009d263

Download Submit
C:\Windows\System\nwZNhee.exe

Filesize
2.4MB

MD5
b47e0e11e10d8256042d526bcd21bf40

SHA1
1f303b9952297516d964d81b1fd38bee6e5c5af8

SHA256
092efc80f98e04150dae565c866cbb3ce70b0d66cb596276adb2d7a22b46c0e2

SHA512
d552ce23da4342df8346581cf77fa5453eba3dbdebd3cf859a8c735281706c384b5f839ec93bebd66cb68edc93d4c9acdfecdcfab9bd8697da0d6fad963185a5

Download Submit
C:\Windows\System\oVMOkPw.exe

Filesize
2.4MB

MD5
b4baca034f68fbf94cc6aeb1131122e7

SHA1
1175010f319426a26b75a76fc7d486ea1bd21e68

SHA256
a48528ef4e7a021c6242cda95e56e03bdf2a9a1dcb99f26975db2573ae65488c

SHA512
fe6f2e3e775ef78d9b9ee620846bf2919a3de3cc92c21264edc1230a059e59b35a04bcc5289cf915e1e336d31123db8a314842f6742e9a993487ee23b625c1bb

Download Submit
C:\Windows\System\qGneaqe.exe

Filesize
2.4MB

MD5
5ae0f10a7f4421664734150987d08650

SHA1
23fa2f0fbf31f498cc5515ab987c5c7f2d08b1af

SHA256
722374981554f00564b87c16abc5950181b8ae4cc4eb677ce5321f10aaa8ef87

SHA512
62fb8e454d66a7b95714250b316c0e58029aab2c429562d5d9e92ddc9f499f40d0cfb5720c49f2031efa809b2b85b5d0c5f58ef8f802669e9c9d4e4393aa3d8d

Download Submit
C:\Windows\System\uGXHgtN.exe

Filesize
2.4MB

MD5
4e7b1d0971d5688ccfc04f57b554a0fd

SHA1
31217cd8c24d971f362eef0d4f59cc84be959df5

SHA256
57feb9dc117b6e0c9f91d5c837a45980d89bd56f5fd82175921d00bd8a250195

SHA512
f16450bf1f00419ec4aa2f11baabd21b7d5ea9ec7ef3ab49e8b54a08939a850254526fb9bce0c189bd66d80030df94e1e87779576bb254dbc24cdbd5fdfd793a

Download Submit
C:\Windows\System\uPAWFXQ.exe

Filesize
2.4MB

MD5
16fa15abc329873f3ae7da6649490728

SHA1
7578d831d4b354aea3b41dc33e74983e7cb2f897

SHA256
bef222048a7934a4a975f60a4584e3fe1eec8c9e68364b01618a7768c0932c60

SHA512
91a20a35873ee225f1c00d7bf0add45df1c27365a5bdd69208a4df7914c8d35e50a916d372f0b53c61e59ca244456911f781dd9eb1b13de538044f4263e76e7e

Download Submit
C:\Windows\System\wXjbpyV.exe

Filesize
2.4MB

MD5
8439a5cf6abeb14316af7664793810c2

SHA1
85025f01fb6397b6ce186afe8c5fcca2a18d94f0

SHA256
c058f2519c9011d6b758ec5c2e272e2248d1e3e8c7912287e950753589ae759a

SHA512
e3c951ee4a56d9c81591480c4d8812081d81955adaef987b0331d16c8144a5354d5b45a71843e5192f9c65552f70dc2ca04a72efc79622ee9f14e1e74ff7770f

Download Submit
C:\Windows\System\xHNpiis.exe

Filesize
2.4MB

MD5
6a7ffc7d97e1080f373ab083f3192323

SHA1
7de71de7acfba3a2496d8b1daac7735f7621ca4e

SHA256
c2b2b371e90d7b2df1c41dfeda28ecea1282ab4f2ccbef679797a775f495d0a8

SHA512
9495d6ea6ce1f668b7ab4ff70612d69984c019c067d2edf037a96a2d0ee7a2fa9d2ea95561344d76d8f899f4523240bd7335a44eba44602ce66ee7bba3f374fc

Download Submit
C:\Windows\System\xvycZwc.exe

Filesize
2.4MB

MD5
f03cb8b923aa0ff58b7533d0298cb1c8

SHA1
7cc5e571801904fdcf2b0614ff87d1470217efda

SHA256
438a35c18734e58bf637451ccad7ee8fd0cdf0ed2ed7929b391306bb5ce3cb03

SHA512
f0022d18056a8c1adc0a333749763fcd5d596b8ec41236ac718363fb09ee39162af02fb8afd6aa7f59d912d1eb4c65fb964f95bb9d3dcecb51d889522cdfd8c6

Download Submit
memory/852-140-0x00007FF7CEE70000-0x00007FF7CF266000-memory.dmp

Filesize
4.0MB

Download
memory/852-2295-0x00007FF7CEE70000-0x00007FF7CF266000-memory.dmp

Filesize
4.0MB

Download
memory/852-2270-0x00007FF7CEE70000-0x00007FF7CF266000-memory.dmp

Filesize
4.0MB

Download
memory/968-2285-0x00007FF6B7A10000-0x00007FF6B7E06000-memory.dmp

Filesize
4.0MB

Download
memory/968-127-0x00007FF6B7A10000-0x00007FF6B7E06000-memory.dmp

Filesize
4.0MB

Download
memory/1068-37-0x00007FF767DB0000-0x00007FF7681A6000-memory.dmp

Filesize
4.0MB

Download
memory/1068-2282-0x00007FF767DB0000-0x00007FF7681A6000-memory.dmp

Filesize
4.0MB

Download
memory/1564-10-0x00007FF6DD070000-0x00007FF6DD466000-memory.dmp

Filesize
4.0MB

Download
memory/1564-2281-0x00007FF6DD070000-0x00007FF6DD466000-memory.dmp

Filesize
4.0MB

Download
memory/1684-2291-0x00007FF726D60000-0x00007FF727156000-memory.dmp

Filesize
4.0MB

Download
memory/1684-135-0x00007FF726D60000-0x00007FF727156000-memory.dmp

Filesize
4.0MB

Download
memory/1980-0-0x00007FF6E6400000-0x00007FF6E67F6000-memory.dmp

Filesize
4.0MB

Download
memory/1980-2267-0x00007FF6E6400000-0x00007FF6E67F6000-memory.dmp

Filesize
4.0MB

Download
memory/1980-1-0x000001BC49FB0000-0x000001BC49FC0000-memory.dmp

Filesize
64KB

Download
memory/2052-124-0x000002983D680000-0x000002983D6A2000-memory.dmp

Filesize
136KB

Download
memory/2052-61-0x00007FFAF2C70000-0x00007FFAF3731000-memory.dmp

Filesize
10.8MB

Download
memory/2052-307-0x00000298584F0000-0x0000029858C96000-memory.dmp

Filesize
7.6MB

Download
memory/2052-2269-0x00007FFAF2C73000-0x00007FFAF2C75000-memory.dmp

Filesize
8KB

Download
memory/2052-38-0x00007FFAF2C73000-0x00007FFAF2C75000-memory.dmp

Filesize
8KB

Download
memory/2052-2279-0x00007FFAF2C70000-0x00007FFAF3731000-memory.dmp

Filesize
10.8MB

Download
memory/2052-2268-0x00007FFAF2C70000-0x00007FFAF3731000-memory.dmp

Filesize
10.8MB

Download
memory/2052-150-0x00007FFAF2C70000-0x00007FFAF3731000-memory.dmp

Filesize
10.8MB

Download
memory/2580-2299-0x00007FF6D19F0000-0x00007FF6D1DE6000-memory.dmp

Filesize
4.0MB

Download
memory/2580-2273-0x00007FF6D19F0000-0x00007FF6D1DE6000-memory.dmp

Filesize
4.0MB

Download
memory/2580-143-0x00007FF6D19F0000-0x00007FF6D1DE6000-memory.dmp

Filesize
4.0MB

Download
memory/2596-2284-0x00007FF7E0490000-0x00007FF7E0886000-memory.dmp

Filesize
4.0MB

Download
memory/2596-151-0x00007FF7E0490000-0x00007FF7E0886000-memory.dmp

Filesize
4.0MB

Download
memory/2656-2294-0x00007FF6B7080000-0x00007FF6B7476000-memory.dmp

Filesize
4.0MB

Download
memory/2656-138-0x00007FF6B7080000-0x00007FF6B7476000-memory.dmp

Filesize
4.0MB

Download
memory/2680-2271-0x00007FF652320000-0x00007FF652716000-memory.dmp

Filesize
4.0MB

Download
memory/2680-141-0x00007FF652320000-0x00007FF652716000-memory.dmp

Filesize
4.0MB

Download
memory/2680-2302-0x00007FF652320000-0x00007FF652716000-memory.dmp

Filesize
4.0MB

Download
memory/2684-126-0x00007FF7BAB40000-0x00007FF7BAF36000-memory.dmp

Filesize
4.0MB

Download
memory/2684-2287-0x00007FF7BAB40000-0x00007FF7BAF36000-memory.dmp

Filesize
4.0MB

Download
memory/2700-137-0x00007FF642030000-0x00007FF642426000-memory.dmp

Filesize
4.0MB

Download
memory/2700-2292-0x00007FF642030000-0x00007FF642426000-memory.dmp

Filesize
4.0MB

Download
memory/2804-2274-0x00007FF65C8D0000-0x00007FF65CCC6000-memory.dmp

Filesize
4.0MB

Download
memory/2804-2301-0x00007FF65C8D0000-0x00007FF65CCC6000-memory.dmp

Filesize
4.0MB

Download
memory/2804-144-0x00007FF65C8D0000-0x00007FF65CCC6000-memory.dmp

Filesize
4.0MB

Download
memory/3220-2289-0x00007FF643750000-0x00007FF643B46000-memory.dmp

Filesize
4.0MB

Download
memory/3220-104-0x00007FF643750000-0x00007FF643B46000-memory.dmp

Filesize
4.0MB

Download
memory/3396-146-0x00007FF60DED0000-0x00007FF60E2C6000-memory.dmp

Filesize
4.0MB

Download
memory/3396-2298-0x00007FF60DED0000-0x00007FF60E2C6000-memory.dmp

Filesize
4.0MB

Download
memory/3396-2276-0x00007FF60DED0000-0x00007FF60E2C6000-memory.dmp

Filesize
4.0MB

Download
memory/3544-123-0x00007FF62B400000-0x00007FF62B7F6000-memory.dmp

Filesize
4.0MB

Download
memory/3544-2286-0x00007FF62B400000-0x00007FF62B7F6000-memory.dmp

Filesize
4.0MB

Download
memory/3548-153-0x00007FF70EE80000-0x00007FF70F276000-memory.dmp

Filesize
4.0MB

Download
memory/3548-2280-0x00007FF70EE80000-0x00007FF70F276000-memory.dmp

Filesize
4.0MB

Download
memory/3548-2296-0x00007FF70EE80000-0x00007FF70F276000-memory.dmp

Filesize
4.0MB

Download
memory/3556-2288-0x00007FF71A030000-0x00007FF71A426000-memory.dmp

Filesize
4.0MB

Download
memory/3556-149-0x00007FF71A030000-0x00007FF71A426000-memory.dmp

Filesize
4.0MB

Download
memory/3836-2293-0x00007FF65DD20000-0x00007FF65E116000-memory.dmp

Filesize
4.0MB

Download
memory/3836-139-0x00007FF65DD20000-0x00007FF65E116000-memory.dmp

Filesize
4.0MB

Download
memory/4224-2290-0x00007FF6F7E00000-0x00007FF6F81F6000-memory.dmp

Filesize
4.0MB

Download
memory/4224-152-0x00007FF6F7E00000-0x00007FF6F81F6000-memory.dmp

Filesize
4.0MB

Download
memory/4568-2283-0x00007FF624660000-0x00007FF624A56000-memory.dmp

Filesize
4.0MB

Download
memory/4568-31-0x00007FF624660000-0x00007FF624A56000-memory.dmp

Filesize
4.0MB

Download
memory/4760-2304-0x00007FF65DAF0000-0x00007FF65DEE6000-memory.dmp

Filesize
4.0MB

Download
memory/4760-147-0x00007FF65DAF0000-0x00007FF65DEE6000-memory.dmp

Filesize
4.0MB

Download
memory/4760-2277-0x00007FF65DAF0000-0x00007FF65DEE6000-memory.dmp

Filesize
4.0MB

Download
memory/4784-2278-0x00007FF666250000-0x00007FF666646000-memory.dmp

Filesize
4.0MB

Download
memory/4784-2303-0x00007FF666250000-0x00007FF666646000-memory.dmp

Filesize
4.0MB

Download
memory/4784-148-0x00007FF666250000-0x00007FF666646000-memory.dmp

Filesize
4.0MB

Download
memory/4824-2272-0x00007FF70DAE0000-0x00007FF70DED6000-memory.dmp

Filesize
4.0MB

Download
memory/4824-2297-0x00007FF70DAE0000-0x00007FF70DED6000-memory.dmp

Filesize
4.0MB

Download
memory/4824-142-0x00007FF70DAE0000-0x00007FF70DED6000-memory.dmp

Filesize
4.0MB

Download
memory/4976-2275-0x00007FF763FF0000-0x00007FF7643E6000-memory.dmp

Filesize
4.0MB

Download
memory/4976-2300-0x00007FF763FF0000-0x00007FF7643E6000-memory.dmp

Filesize
4.0MB

Download
memory/4976-145-0x00007FF763FF0000-0x00007FF7643E6000-memory.dmp

Filesize
4.0MB

Download