xmrig | 472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666

Analysis

max time kernel
134s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
Size

3.1MB
MD5

262ae7119f7a565b827edbe4f538ba84
SHA1

c9c85bc8b8113fd335335f495bd630c38f81f471
SHA256

472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666
SHA512

676a9f22ba4a8a3faa9366be1045eb842adaac28240a11b35460153463fc72d72635d5056f4416c896406ef3dd91ca63de302d7c00b81d9843766ae7bca329b5
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWT:7bBeSFk/

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5088-0-0x00007FF6372B0000-0x00007FF6376A6000-memory.dmp	xmrig
behavioral2/files/0x00080000000234d8-4.dat	xmrig
behavioral2/files/0x00070000000234df-7.dat	xmrig
behavioral2/files/0x00080000000234de-10.dat	xmrig
behavioral2/files/0x00070000000234e1-51.dat	xmrig
behavioral2/memory/3608-56-0x00007FF6CA960000-0x00007FF6CAD56000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e5-67.dat	xmrig
behavioral2/files/0x00070000000234eb-81.dat	xmrig
behavioral2/files/0x00070000000234ed-98.dat	xmrig
behavioral2/files/0x00070000000234f2-115.dat	xmrig
behavioral2/memory/3908-120-0x00007FF7E8730000-0x00007FF7E8B26000-memory.dmp	xmrig
behavioral2/files/0x00070000000234ef-128.dat	xmrig
behavioral2/files/0x00070000000234fa-159.dat	xmrig
behavioral2/memory/2996-167-0x00007FF79F840000-0x00007FF79FC36000-memory.dmp	xmrig
behavioral2/memory/3224-185-0x00007FF62AF00000-0x00007FF62B2F6000-memory.dmp	xmrig
behavioral2/memory/3172-189-0x00007FF6A1E40000-0x00007FF6A2236000-memory.dmp	xmrig
behavioral2/memory/1152-224-0x00007FF7BB720000-0x00007FF7BBB16000-memory.dmp	xmrig
behavioral2/memory/4836-241-0x00007FF75B440000-0x00007FF75B836000-memory.dmp	xmrig
behavioral2/memory/4488-240-0x00007FF6DBD20000-0x00007FF6DC116000-memory.dmp	xmrig
behavioral2/memory/5060-238-0x00007FF6F5750000-0x00007FF6F5B46000-memory.dmp	xmrig
behavioral2/memory/4788-225-0x00007FF66B4F0000-0x00007FF66B8E6000-memory.dmp	xmrig
behavioral2/memory/2660-215-0x00007FF798740000-0x00007FF798B36000-memory.dmp	xmrig
behavioral2/memory/2392-208-0x00007FF6A34D0000-0x00007FF6A38C6000-memory.dmp	xmrig
behavioral2/memory/2792-184-0x00007FF6B0240000-0x00007FF6B0636000-memory.dmp	xmrig
behavioral2/memory/2900-180-0x00007FF6B98E0000-0x00007FF6B9CD6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234f9-175.dat	xmrig
behavioral2/files/0x00070000000234f8-173.dat	xmrig
behavioral2/files/0x00070000000234f7-171.dat	xmrig
behavioral2/files/0x00080000000234dc-169.dat	xmrig
behavioral2/memory/2488-168-0x00007FF6134F0000-0x00007FF6138E6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234fd-166.dat	xmrig
behavioral2/memory/5092-165-0x00007FF742B50000-0x00007FF742F46000-memory.dmp	xmrig
behavioral2/files/0x00070000000234fc-164.dat	xmrig
behavioral2/files/0x00070000000234fb-160.dat	xmrig
behavioral2/files/0x00070000000234f6-147.dat	xmrig
behavioral2/files/0x00070000000234f5-145.dat	xmrig
behavioral2/files/0x00070000000234f4-144.dat	xmrig
behavioral2/files/0x00070000000234f3-143.dat	xmrig
behavioral2/files/0x00070000000234f1-132.dat	xmrig
behavioral2/files/0x00070000000234ee-131.dat	xmrig
behavioral2/files/0x00070000000234f0-127.dat	xmrig
behavioral2/files/0x00070000000234ec-109.dat	xmrig
behavioral2/memory/1580-103-0x00007FF60C030000-0x00007FF60C426000-memory.dmp	xmrig
behavioral2/files/0x00070000000234ea-92.dat	xmrig
behavioral2/memory/1384-90-0x00007FF605400000-0x00007FF6057F6000-memory.dmp	xmrig
behavioral2/memory/4816-86-0x00007FF6C3800000-0x00007FF6C3BF6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e9-82.dat	xmrig
behavioral2/files/0x00070000000234e8-76.dat	xmrig
behavioral2/files/0x00070000000234e3-75.dat	xmrig
behavioral2/files/0x00070000000234e7-71.dat	xmrig
behavioral2/files/0x00070000000234e4-63.dat	xmrig
behavioral2/memory/4928-60-0x00007FF667A10000-0x00007FF667E06000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e2-59.dat	xmrig
behavioral2/memory/4340-48-0x00007FF7B1470000-0x00007FF7B1866000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e6-44.dat	xmrig
behavioral2/memory/1992-35-0x00007FF7251D0000-0x00007FF7255C6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e0-39.dat	xmrig
behavioral2/memory/1588-21-0x00007FF6B32E0000-0x00007FF6B36D6000-memory.dmp	xmrig
behavioral2/memory/464-19-0x00007FF6B9A60000-0x00007FF6B9E56000-memory.dmp	xmrig
behavioral2/memory/464-2208-0x00007FF6B9A60000-0x00007FF6B9E56000-memory.dmp	xmrig
behavioral2/memory/1992-2209-0x00007FF7251D0000-0x00007FF7255C6000-memory.dmp	xmrig
behavioral2/memory/3608-2211-0x00007FF6CA960000-0x00007FF6CAD56000-memory.dmp	xmrig
behavioral2/memory/4340-2210-0x00007FF7B1470000-0x00007FF7B1866000-memory.dmp	xmrig
behavioral2/memory/4928-2212-0x00007FF667A10000-0x00007FF667E06000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	3128	powershell.exe
5	3128	powershell.exe
7	3128	powershell.exe
8	3128	powershell.exe
10	3128	powershell.exe
11	3128	powershell.exe
13	3128	powershell.exe
24	3128	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3128	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
464	zUlYUNX.exe
3172	EqtNXOF.exe
1588	KZUzVuc.exe
1992	XmDVlje.exe
2392	Ogkbjbm.exe
4340	QtcGmIS.exe
2660	QCIEwuj.exe
3608	RrsSslT.exe
4928	bgiuIuw.exe
4816	PfCVrYM.exe
1152	IWgVMMR.exe
1384	IkvRdFP.exe
4788	GMlBrxW.exe
1580	WMLWNOw.exe
5060	YIbcKgp.exe
3908	hewFWkR.exe
4488	RTNagbh.exe
5092	WdUypfV.exe
4836	LiLhWJF.exe
2996	qlsJuAa.exe
2488	MUTkTMI.exe
2900	MjyjXBA.exe
2792	BkOLtkF.exe
3224	TpHaqWN.exe
536	bMeHVZn.exe
2744	ZTjkyjW.exe
4696	LfnIOkT.exe
2496	TvZTaIj.exe
2720	YLvQBcq.exe
2788	ineTURz.exe
3244	ENkRlvw.exe
3132	GctMpcU.exe
4100	WzhETPI.exe
3376	iXBxVHR.exe
4500	BXCbqsq.exe
4776	CtzIKYM.exe
4076	WgzaggR.exe
2648	uVBjuwD.exe
2352	uEioacv.exe
532	FcKTizZ.exe
1204	BcVwwQG.exe
1280	Csgeeuu.exe
228	EVaKKRC.exe
3904	MaAKIYB.exe
1944	WhHRcZg.exe
4088	IlrlKja.exe
2872	MFKXffs.exe
1044	wlaQSZo.exe
3452	XHsdKXm.exe
4544	vVYdimg.exe
988	pjkLivZ.exe
1244	buzcwaT.exe
2780	mMLDKgY.exe
2096	SHfbJfN.exe
372	oVnUeKu.exe
3096	KZeShoA.exe
3856	kNWQrhM.exe
816	qnfZqeg.exe
456	yefVVON.exe
1488	GuEXryf.exe
2236	AjxishO.exe
2540	ULBoBzl.exe
3692	JOeHxBj.exe
4384	rgjgnfo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5088-0-0x00007FF6372B0000-0x00007FF6376A6000-memory.dmp	upx
behavioral2/files/0x00080000000234d8-4.dat	upx
behavioral2/files/0x00070000000234df-7.dat	upx
behavioral2/files/0x00080000000234de-10.dat	upx
behavioral2/files/0x00070000000234e1-51.dat	upx
behavioral2/memory/3608-56-0x00007FF6CA960000-0x00007FF6CAD56000-memory.dmp	upx
behavioral2/files/0x00070000000234e5-67.dat	upx
behavioral2/files/0x00070000000234eb-81.dat	upx
behavioral2/files/0x00070000000234ed-98.dat	upx
behavioral2/files/0x00070000000234f2-115.dat	upx
behavioral2/memory/3908-120-0x00007FF7E8730000-0x00007FF7E8B26000-memory.dmp	upx
behavioral2/files/0x00070000000234ef-128.dat	upx
behavioral2/files/0x00070000000234fa-159.dat	upx
behavioral2/memory/2996-167-0x00007FF79F840000-0x00007FF79FC36000-memory.dmp	upx
behavioral2/memory/3224-185-0x00007FF62AF00000-0x00007FF62B2F6000-memory.dmp	upx
behavioral2/memory/3172-189-0x00007FF6A1E40000-0x00007FF6A2236000-memory.dmp	upx
behavioral2/memory/1152-224-0x00007FF7BB720000-0x00007FF7BBB16000-memory.dmp	upx
behavioral2/memory/4836-241-0x00007FF75B440000-0x00007FF75B836000-memory.dmp	upx
behavioral2/memory/4488-240-0x00007FF6DBD20000-0x00007FF6DC116000-memory.dmp	upx
behavioral2/memory/5060-238-0x00007FF6F5750000-0x00007FF6F5B46000-memory.dmp	upx
behavioral2/memory/4788-225-0x00007FF66B4F0000-0x00007FF66B8E6000-memory.dmp	upx
behavioral2/memory/2660-215-0x00007FF798740000-0x00007FF798B36000-memory.dmp	upx
behavioral2/memory/2392-208-0x00007FF6A34D0000-0x00007FF6A38C6000-memory.dmp	upx
behavioral2/memory/2792-184-0x00007FF6B0240000-0x00007FF6B0636000-memory.dmp	upx
behavioral2/memory/2900-180-0x00007FF6B98E0000-0x00007FF6B9CD6000-memory.dmp	upx
behavioral2/files/0x00070000000234f9-175.dat	upx
behavioral2/files/0x00070000000234f8-173.dat	upx
behavioral2/files/0x00070000000234f7-171.dat	upx
behavioral2/files/0x00080000000234dc-169.dat	upx
behavioral2/memory/2488-168-0x00007FF6134F0000-0x00007FF6138E6000-memory.dmp	upx
behavioral2/files/0x00070000000234fd-166.dat	upx
behavioral2/memory/5092-165-0x00007FF742B50000-0x00007FF742F46000-memory.dmp	upx
behavioral2/files/0x00070000000234fc-164.dat	upx
behavioral2/files/0x00070000000234fb-160.dat	upx
behavioral2/files/0x00070000000234f6-147.dat	upx
behavioral2/files/0x00070000000234f5-145.dat	upx
behavioral2/files/0x00070000000234f4-144.dat	upx
behavioral2/files/0x00070000000234f3-143.dat	upx
behavioral2/files/0x00070000000234f1-132.dat	upx
behavioral2/files/0x00070000000234ee-131.dat	upx
behavioral2/files/0x00070000000234f0-127.dat	upx
behavioral2/files/0x00070000000234ec-109.dat	upx
behavioral2/memory/1580-103-0x00007FF60C030000-0x00007FF60C426000-memory.dmp	upx
behavioral2/files/0x00070000000234ea-92.dat	upx
behavioral2/memory/1384-90-0x00007FF605400000-0x00007FF6057F6000-memory.dmp	upx
behavioral2/memory/4816-86-0x00007FF6C3800000-0x00007FF6C3BF6000-memory.dmp	upx
behavioral2/files/0x00070000000234e9-82.dat	upx
behavioral2/files/0x00070000000234e8-76.dat	upx
behavioral2/files/0x00070000000234e3-75.dat	upx
behavioral2/files/0x00070000000234e7-71.dat	upx
behavioral2/files/0x00070000000234e4-63.dat	upx
behavioral2/memory/4928-60-0x00007FF667A10000-0x00007FF667E06000-memory.dmp	upx
behavioral2/files/0x00070000000234e2-59.dat	upx
behavioral2/memory/4340-48-0x00007FF7B1470000-0x00007FF7B1866000-memory.dmp	upx
behavioral2/files/0x00070000000234e6-44.dat	upx
behavioral2/memory/1992-35-0x00007FF7251D0000-0x00007FF7255C6000-memory.dmp	upx
behavioral2/files/0x00070000000234e0-39.dat	upx
behavioral2/memory/1588-21-0x00007FF6B32E0000-0x00007FF6B36D6000-memory.dmp	upx
behavioral2/memory/464-19-0x00007FF6B9A60000-0x00007FF6B9E56000-memory.dmp	upx
behavioral2/memory/464-2208-0x00007FF6B9A60000-0x00007FF6B9E56000-memory.dmp	upx
behavioral2/memory/1992-2209-0x00007FF7251D0000-0x00007FF7255C6000-memory.dmp	upx
behavioral2/memory/3608-2211-0x00007FF6CA960000-0x00007FF6CAD56000-memory.dmp	upx
behavioral2/memory/4340-2210-0x00007FF7B1470000-0x00007FF7B1866000-memory.dmp	upx
behavioral2/memory/4928-2212-0x00007FF667A10000-0x00007FF667E06000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BPqWmca.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\BcVwwQG.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\PGKHYUK.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\ZLvamnk.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\eODtQSW.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\dqKztIl.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\ciMHvaD.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\ozrFJAm.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\IcRuPvO.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\dPZnmLA.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\Yauvhew.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\UiCpRcS.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\jYXirbe.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\YBqAqIv.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\BsdxUVA.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\xEhyNpA.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\kYEuRtw.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\LqrPduh.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\wMWZHXe.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\LaAbllf.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\Zqbuuzz.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\yefRajG.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\AAueDPD.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\KkBWrpY.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\pjkLivZ.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\zuFvPxD.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\QyedJYZ.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\oLNaaWA.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\iMGfzEA.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\jZXroSB.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\gEuSjbM.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\qpSnNbS.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\ylIDdjp.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\PjWQlGp.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\NKWEvot.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\WkqcMaH.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\mcvYBuO.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\lvfRwhO.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\ssoLSpZ.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\uGgzeEM.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\yHCiyuj.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\UXQDLAg.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\smrBKoX.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\mxniHFE.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\ETrXrCg.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\XAHOdKD.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\zCpyYfH.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\GEmTEvg.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\hJYEZiu.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\ZDsxBRA.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\AenQbcl.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\qucgJHx.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\aJTHpCI.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\EFXMQsR.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\GuPVCDH.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\ohboSbL.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\jSzvTpN.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\OrLZenb.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\sGdIZeu.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\reMiFwl.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\npRLpae.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\tCFlHuU.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\prqFClz.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
File created	C:\Windows\System\ylWNtxF.exe	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
Token: SeLockMemoryPrivilege	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
Token: SeDebugPrivilege	3128	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3128	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	86
PID 5088 wrote to memory of 3128	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	86
PID 5088 wrote to memory of 464	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	87
PID 5088 wrote to memory of 464	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	87
PID 5088 wrote to memory of 3172	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	88
PID 5088 wrote to memory of 3172	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	88
PID 5088 wrote to memory of 1588	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	89
PID 5088 wrote to memory of 1588	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	89
PID 5088 wrote to memory of 1992	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	90
PID 5088 wrote to memory of 1992	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	90
PID 5088 wrote to memory of 2392	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	91
PID 5088 wrote to memory of 2392	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	91
PID 5088 wrote to memory of 4340	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	92
PID 5088 wrote to memory of 4340	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	92
PID 5088 wrote to memory of 2660	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	93
PID 5088 wrote to memory of 2660	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	93
PID 5088 wrote to memory of 3608	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	94
PID 5088 wrote to memory of 3608	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	94
PID 5088 wrote to memory of 4928	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	95
PID 5088 wrote to memory of 4928	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	95
PID 5088 wrote to memory of 4816	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	96
PID 5088 wrote to memory of 4816	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	96
PID 5088 wrote to memory of 1152	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	97
PID 5088 wrote to memory of 1152	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	97
PID 5088 wrote to memory of 1384	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	98
PID 5088 wrote to memory of 1384	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	98
PID 5088 wrote to memory of 4788	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	99
PID 5088 wrote to memory of 4788	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	99
PID 5088 wrote to memory of 1580	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	100
PID 5088 wrote to memory of 1580	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	100
PID 5088 wrote to memory of 5060	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	101
PID 5088 wrote to memory of 5060	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	101
PID 5088 wrote to memory of 3908	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	102
PID 5088 wrote to memory of 3908	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	102
PID 5088 wrote to memory of 4488	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	103
PID 5088 wrote to memory of 4488	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	103
PID 5088 wrote to memory of 2996	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	104
PID 5088 wrote to memory of 2996	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	104
PID 5088 wrote to memory of 5092	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	105
PID 5088 wrote to memory of 5092	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	105
PID 5088 wrote to memory of 4836	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	106
PID 5088 wrote to memory of 4836	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	106
PID 5088 wrote to memory of 2488	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	107
PID 5088 wrote to memory of 2488	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	107
PID 5088 wrote to memory of 2900	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	108
PID 5088 wrote to memory of 2900	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	108
PID 5088 wrote to memory of 2792	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	109
PID 5088 wrote to memory of 2792	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	109
PID 5088 wrote to memory of 3224	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	110
PID 5088 wrote to memory of 3224	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	110
PID 5088 wrote to memory of 536	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	111
PID 5088 wrote to memory of 536	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	111
PID 5088 wrote to memory of 2744	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	112
PID 5088 wrote to memory of 2744	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	112
PID 5088 wrote to memory of 4696	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	113
PID 5088 wrote to memory of 4696	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	113
PID 5088 wrote to memory of 2496	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	114
PID 5088 wrote to memory of 2496	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	114
PID 5088 wrote to memory of 2720	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	115
PID 5088 wrote to memory of 2720	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	115
PID 5088 wrote to memory of 2788	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	116
PID 5088 wrote to memory of 2788	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	116
PID 5088 wrote to memory of 3244	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	117
PID 5088 wrote to memory of 3244	5088	472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe	117

C:\Users\Admin\AppData\Local\Temp\472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe
"C:\Users\Admin\AppData\Local\Temp\472e93c2f9b9cfc56824772f741776c93f198c91bb0cb007f0eac7c7ab6bf666.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3128
- C:\Windows\System\zUlYUNX.exe
  C:\Windows\System\zUlYUNX.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\EqtNXOF.exe
  C:\Windows\System\EqtNXOF.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\KZUzVuc.exe
  C:\Windows\System\KZUzVuc.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\XmDVlje.exe
  C:\Windows\System\XmDVlje.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\Ogkbjbm.exe
  C:\Windows\System\Ogkbjbm.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\QtcGmIS.exe
  C:\Windows\System\QtcGmIS.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\QCIEwuj.exe
  C:\Windows\System\QCIEwuj.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\RrsSslT.exe
  C:\Windows\System\RrsSslT.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\bgiuIuw.exe
  C:\Windows\System\bgiuIuw.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\PfCVrYM.exe
  C:\Windows\System\PfCVrYM.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\IWgVMMR.exe
  C:\Windows\System\IWgVMMR.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\IkvRdFP.exe
  C:\Windows\System\IkvRdFP.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\GMlBrxW.exe
  C:\Windows\System\GMlBrxW.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\WMLWNOw.exe
  C:\Windows\System\WMLWNOw.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\YIbcKgp.exe
  C:\Windows\System\YIbcKgp.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\hewFWkR.exe
  C:\Windows\System\hewFWkR.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\RTNagbh.exe
  C:\Windows\System\RTNagbh.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\qlsJuAa.exe
  C:\Windows\System\qlsJuAa.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\WdUypfV.exe
  C:\Windows\System\WdUypfV.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\LiLhWJF.exe
  C:\Windows\System\LiLhWJF.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\MUTkTMI.exe
  C:\Windows\System\MUTkTMI.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\MjyjXBA.exe
  C:\Windows\System\MjyjXBA.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\BkOLtkF.exe
  C:\Windows\System\BkOLtkF.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\TpHaqWN.exe
  C:\Windows\System\TpHaqWN.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\bMeHVZn.exe
  C:\Windows\System\bMeHVZn.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\ZTjkyjW.exe
  C:\Windows\System\ZTjkyjW.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\LfnIOkT.exe
  C:\Windows\System\LfnIOkT.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\TvZTaIj.exe
  C:\Windows\System\TvZTaIj.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\YLvQBcq.exe
  C:\Windows\System\YLvQBcq.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ineTURz.exe
  C:\Windows\System\ineTURz.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ENkRlvw.exe
  C:\Windows\System\ENkRlvw.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\GctMpcU.exe
  C:\Windows\System\GctMpcU.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\WzhETPI.exe
  C:\Windows\System\WzhETPI.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\iXBxVHR.exe
  C:\Windows\System\iXBxVHR.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\BXCbqsq.exe
  C:\Windows\System\BXCbqsq.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\CtzIKYM.exe
  C:\Windows\System\CtzIKYM.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\WgzaggR.exe
  C:\Windows\System\WgzaggR.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\uVBjuwD.exe
  C:\Windows\System\uVBjuwD.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\uEioacv.exe
  C:\Windows\System\uEioacv.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\FcKTizZ.exe
  C:\Windows\System\FcKTizZ.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\BcVwwQG.exe
  C:\Windows\System\BcVwwQG.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\Csgeeuu.exe
  C:\Windows\System\Csgeeuu.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\EVaKKRC.exe
  C:\Windows\System\EVaKKRC.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\MaAKIYB.exe
  C:\Windows\System\MaAKIYB.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\WhHRcZg.exe
  C:\Windows\System\WhHRcZg.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\IlrlKja.exe
  C:\Windows\System\IlrlKja.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\MFKXffs.exe
  C:\Windows\System\MFKXffs.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\wlaQSZo.exe
  C:\Windows\System\wlaQSZo.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\XHsdKXm.exe
  C:\Windows\System\XHsdKXm.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\vVYdimg.exe
  C:\Windows\System\vVYdimg.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\pjkLivZ.exe
  C:\Windows\System\pjkLivZ.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\buzcwaT.exe
  C:\Windows\System\buzcwaT.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\mMLDKgY.exe
  C:\Windows\System\mMLDKgY.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\SHfbJfN.exe
  C:\Windows\System\SHfbJfN.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\oVnUeKu.exe
  C:\Windows\System\oVnUeKu.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\KZeShoA.exe
  C:\Windows\System\KZeShoA.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\kNWQrhM.exe
  C:\Windows\System\kNWQrhM.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\qnfZqeg.exe
  C:\Windows\System\qnfZqeg.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\yefVVON.exe
  C:\Windows\System\yefVVON.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\GuEXryf.exe
  C:\Windows\System\GuEXryf.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\AjxishO.exe
  C:\Windows\System\AjxishO.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ULBoBzl.exe
  C:\Windows\System\ULBoBzl.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\JOeHxBj.exe
  C:\Windows\System\JOeHxBj.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\rgjgnfo.exe
  C:\Windows\System\rgjgnfo.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\xQFfejj.exe
  C:\Windows\System\xQFfejj.exe
  2⤵
  PID:1428
- C:\Windows\System\feDQxXA.exe
  C:\Windows\System\feDQxXA.exe
  2⤵
  PID:4032
- C:\Windows\System\OHCbclj.exe
  C:\Windows\System\OHCbclj.exe
  2⤵
  PID:1452
- C:\Windows\System\iSuDHcj.exe
  C:\Windows\System\iSuDHcj.exe
  2⤵
  PID:2636
- C:\Windows\System\woMLCHP.exe
  C:\Windows\System\woMLCHP.exe
  2⤵
  PID:3568
- C:\Windows\System\WmJONVV.exe
  C:\Windows\System\WmJONVV.exe
  2⤵
  PID:3652
- C:\Windows\System\gXjOFKo.exe
  C:\Windows\System\gXjOFKo.exe
  2⤵
  PID:4896
- C:\Windows\System\KmQhKJx.exe
  C:\Windows\System\KmQhKJx.exe
  2⤵
  PID:4820
- C:\Windows\System\yKXtBIK.exe
  C:\Windows\System\yKXtBIK.exe
  2⤵
  PID:2132
- C:\Windows\System\aYrsPnp.exe
  C:\Windows\System\aYrsPnp.exe
  2⤵
  PID:4952
- C:\Windows\System\DidFarv.exe
  C:\Windows\System\DidFarv.exe
  2⤵
  PID:4368
- C:\Windows\System\XknoOMP.exe
  C:\Windows\System\XknoOMP.exe
  2⤵
  PID:3772
- C:\Windows\System\qxDAnAm.exe
  C:\Windows\System\qxDAnAm.exe
  2⤵
  PID:5068
- C:\Windows\System\gxioTfu.exe
  C:\Windows\System\gxioTfu.exe
  2⤵
  PID:4048
- C:\Windows\System\npRLpae.exe
  C:\Windows\System\npRLpae.exe
  2⤵
  PID:2840
- C:\Windows\System\jwAjsWo.exe
  C:\Windows\System\jwAjsWo.exe
  2⤵
  PID:3956
- C:\Windows\System\tqEFiAb.exe
  C:\Windows\System\tqEFiAb.exe
  2⤵
  PID:1892
- C:\Windows\System\VRAtWBj.exe
  C:\Windows\System\VRAtWBj.exe
  2⤵
  PID:1156
- C:\Windows\System\RILRyEK.exe
  C:\Windows\System\RILRyEK.exe
  2⤵
  PID:2932
- C:\Windows\System\CHwVCnq.exe
  C:\Windows\System\CHwVCnq.exe
  2⤵
  PID:2988
- C:\Windows\System\hWBXnvt.exe
  C:\Windows\System\hWBXnvt.exe
  2⤵
  PID:5048
- C:\Windows\System\nmsbaSS.exe
  C:\Windows\System\nmsbaSS.exe
  2⤵
  PID:4868
- C:\Windows\System\hlxaEcN.exe
  C:\Windows\System\hlxaEcN.exe
  2⤵
  PID:4512
- C:\Windows\System\cPJdTlo.exe
  C:\Windows\System\cPJdTlo.exe
  2⤵
  PID:1824
- C:\Windows\System\kKwSszB.exe
  C:\Windows\System\kKwSszB.exe
  2⤵
  PID:5144
- C:\Windows\System\ZgQwWXM.exe
  C:\Windows\System\ZgQwWXM.exe
  2⤵
  PID:5176
- C:\Windows\System\AjnqIIj.exe
  C:\Windows\System\AjnqIIj.exe
  2⤵
  PID:5212
- C:\Windows\System\NPyeobq.exe
  C:\Windows\System\NPyeobq.exe
  2⤵
  PID:5256
- C:\Windows\System\hXbTLOD.exe
  C:\Windows\System\hXbTLOD.exe
  2⤵
  PID:5276
- C:\Windows\System\KMtePmk.exe
  C:\Windows\System\KMtePmk.exe
  2⤵
  PID:5308
- C:\Windows\System\VZqQshA.exe
  C:\Windows\System\VZqQshA.exe
  2⤵
  PID:5340
- C:\Windows\System\vBeBJYE.exe
  C:\Windows\System\vBeBJYE.exe
  2⤵
  PID:5360
- C:\Windows\System\ajHZwlC.exe
  C:\Windows\System\ajHZwlC.exe
  2⤵
  PID:5408
- C:\Windows\System\MkqTWuR.exe
  C:\Windows\System\MkqTWuR.exe
  2⤵
  PID:5440
- C:\Windows\System\bVHWVNo.exe
  C:\Windows\System\bVHWVNo.exe
  2⤵
  PID:5468
- C:\Windows\System\GpAwqto.exe
  C:\Windows\System\GpAwqto.exe
  2⤵
  PID:5504
- C:\Windows\System\wyAioHY.exe
  C:\Windows\System\wyAioHY.exe
  2⤵
  PID:5520
- C:\Windows\System\KppdHZR.exe
  C:\Windows\System\KppdHZR.exe
  2⤵
  PID:5556
- C:\Windows\System\CeJDDGZ.exe
  C:\Windows\System\CeJDDGZ.exe
  2⤵
  PID:5604
- C:\Windows\System\RjJRfHH.exe
  C:\Windows\System\RjJRfHH.exe
  2⤵
  PID:5652
- C:\Windows\System\sDmiCMx.exe
  C:\Windows\System\sDmiCMx.exe
  2⤵
  PID:5700
- C:\Windows\System\OXKdEpM.exe
  C:\Windows\System\OXKdEpM.exe
  2⤵
  PID:5728
- C:\Windows\System\sfovOrq.exe
  C:\Windows\System\sfovOrq.exe
  2⤵
  PID:5772
- C:\Windows\System\jPsgeRl.exe
  C:\Windows\System\jPsgeRl.exe
  2⤵
  PID:5800
- C:\Windows\System\FDfXwdc.exe
  C:\Windows\System\FDfXwdc.exe
  2⤵
  PID:5848
- C:\Windows\System\xslLsWc.exe
  C:\Windows\System\xslLsWc.exe
  2⤵
  PID:5888
- C:\Windows\System\RNeAEtU.exe
  C:\Windows\System\RNeAEtU.exe
  2⤵
  PID:5908
- C:\Windows\System\eWTOGmd.exe
  C:\Windows\System\eWTOGmd.exe
  2⤵
  PID:5940
- C:\Windows\System\FpGODAH.exe
  C:\Windows\System\FpGODAH.exe
  2⤵
  PID:5976
- C:\Windows\System\ZhAnusp.exe
  C:\Windows\System\ZhAnusp.exe
  2⤵
  PID:6012
- C:\Windows\System\aamsGqC.exe
  C:\Windows\System\aamsGqC.exe
  2⤵
  PID:6036
- C:\Windows\System\DXxWSYI.exe
  C:\Windows\System\DXxWSYI.exe
  2⤵
  PID:6068
- C:\Windows\System\MwxzzdD.exe
  C:\Windows\System\MwxzzdD.exe
  2⤵
  PID:6108
- C:\Windows\System\nFSZnoy.exe
  C:\Windows\System\nFSZnoy.exe
  2⤵
  PID:6124
- C:\Windows\System\XrXwxJD.exe
  C:\Windows\System\XrXwxJD.exe
  2⤵
  PID:6140
- C:\Windows\System\aDzIqIn.exe
  C:\Windows\System\aDzIqIn.exe
  2⤵
  PID:5164
- C:\Windows\System\hEdvaqT.exe
  C:\Windows\System\hEdvaqT.exe
  2⤵
  PID:5300
- C:\Windows\System\HnNSYyw.exe
  C:\Windows\System\HnNSYyw.exe
  2⤵
  PID:5384
- C:\Windows\System\bMVzdiX.exe
  C:\Windows\System\bMVzdiX.exe
  2⤵
  PID:5452
- C:\Windows\System\PXFOyTg.exe
  C:\Windows\System\PXFOyTg.exe
  2⤵
  PID:5488
- C:\Windows\System\LokleVC.exe
  C:\Windows\System\LokleVC.exe
  2⤵
  PID:5516
- C:\Windows\System\gmkeMWX.exe
  C:\Windows\System\gmkeMWX.exe
  2⤵
  PID:5540
- C:\Windows\System\nNOofXS.exe
  C:\Windows\System\nNOofXS.exe
  2⤵
  PID:5624
- C:\Windows\System\iPuBdju.exe
  C:\Windows\System\iPuBdju.exe
  2⤵
  PID:5708
- C:\Windows\System\vrUvptI.exe
  C:\Windows\System\vrUvptI.exe
  2⤵
  PID:5756
- C:\Windows\System\YXfdBDx.exe
  C:\Windows\System\YXfdBDx.exe
  2⤵
  PID:5792
- C:\Windows\System\YKqFPsV.exe
  C:\Windows\System\YKqFPsV.exe
  2⤵
  PID:5836
- C:\Windows\System\ApcoRNS.exe
  C:\Windows\System\ApcoRNS.exe
  2⤵
  PID:5904
- C:\Windows\System\LxNUXFo.exe
  C:\Windows\System\LxNUXFo.exe
  2⤵
  PID:5988
- C:\Windows\System\ORjuwXS.exe
  C:\Windows\System\ORjuwXS.exe
  2⤵
  PID:6096
- C:\Windows\System\MiZhbzi.exe
  C:\Windows\System\MiZhbzi.exe
  2⤵
  PID:5140
- C:\Windows\System\AllyAbO.exe
  C:\Windows\System\AllyAbO.exe
  2⤵
  PID:5348
- C:\Windows\System\YzxTMHP.exe
  C:\Windows\System\YzxTMHP.exe
  2⤵
  PID:5424
- C:\Windows\System\CtLvXGt.exe
  C:\Windows\System\CtLvXGt.exe
  2⤵
  PID:5684
- C:\Windows\System\ceQUntl.exe
  C:\Windows\System\ceQUntl.exe
  2⤵
  PID:5736
- C:\Windows\System\SHvNIrY.exe
  C:\Windows\System\SHvNIrY.exe
  2⤵
  PID:5880
- C:\Windows\System\sHaVSJl.exe
  C:\Windows\System\sHaVSJl.exe
  2⤵
  PID:5964
- C:\Windows\System\caxRCZx.exe
  C:\Windows\System\caxRCZx.exe
  2⤵
  PID:5136
- C:\Windows\System\SoIWJFe.exe
  C:\Windows\System\SoIWJFe.exe
  2⤵
  PID:5268
- C:\Windows\System\ODuWGSn.exe
  C:\Windows\System\ODuWGSn.exe
  2⤵
  PID:5644
- C:\Windows\System\EYswVxa.exe
  C:\Windows\System\EYswVxa.exe
  2⤵
  PID:5932
- C:\Windows\System\dJXyhgg.exe
  C:\Windows\System\dJXyhgg.exe
  2⤵
  PID:5272
- C:\Windows\System\EkslhAY.exe
  C:\Windows\System\EkslhAY.exe
  2⤵
  PID:5500
- C:\Windows\System\wyMMTdm.exe
  C:\Windows\System\wyMMTdm.exe
  2⤵
  PID:5828
- C:\Windows\System\HFwfKIC.exe
  C:\Windows\System\HFwfKIC.exe
  2⤵
  PID:6152
- C:\Windows\System\aQaHSHZ.exe
  C:\Windows\System\aQaHSHZ.exe
  2⤵
  PID:6196
- C:\Windows\System\bIVdXtH.exe
  C:\Windows\System\bIVdXtH.exe
  2⤵
  PID:6220
- C:\Windows\System\OZGKDqW.exe
  C:\Windows\System\OZGKDqW.exe
  2⤵
  PID:6260
- C:\Windows\System\VbTlPKx.exe
  C:\Windows\System\VbTlPKx.exe
  2⤵
  PID:6280
- C:\Windows\System\HWnpyLn.exe
  C:\Windows\System\HWnpyLn.exe
  2⤵
  PID:6308
- C:\Windows\System\mwFeNzw.exe
  C:\Windows\System\mwFeNzw.exe
  2⤵
  PID:6336
- C:\Windows\System\LFTVUfH.exe
  C:\Windows\System\LFTVUfH.exe
  2⤵
  PID:6368
- C:\Windows\System\CwAgZUQ.exe
  C:\Windows\System\CwAgZUQ.exe
  2⤵
  PID:6400
- C:\Windows\System\hExlPjL.exe
  C:\Windows\System\hExlPjL.exe
  2⤵
  PID:6424
- C:\Windows\System\WDtmgra.exe
  C:\Windows\System\WDtmgra.exe
  2⤵
  PID:6448
- C:\Windows\System\qGSQxfP.exe
  C:\Windows\System\qGSQxfP.exe
  2⤵
  PID:6476
- C:\Windows\System\gJZDVvr.exe
  C:\Windows\System\gJZDVvr.exe
  2⤵
  PID:6512
- C:\Windows\System\ftNOGXF.exe
  C:\Windows\System\ftNOGXF.exe
  2⤵
  PID:6540
- C:\Windows\System\TEePnJS.exe
  C:\Windows\System\TEePnJS.exe
  2⤵
  PID:6568
- C:\Windows\System\arEfMbi.exe
  C:\Windows\System\arEfMbi.exe
  2⤵
  PID:6592
- C:\Windows\System\QRPUDlj.exe
  C:\Windows\System\QRPUDlj.exe
  2⤵
  PID:6624
- C:\Windows\System\svhHhcl.exe
  C:\Windows\System\svhHhcl.exe
  2⤵
  PID:6648
- C:\Windows\System\GrQZRJU.exe
  C:\Windows\System\GrQZRJU.exe
  2⤵
  PID:6684
- C:\Windows\System\RzNFYzk.exe
  C:\Windows\System\RzNFYzk.exe
  2⤵
  PID:6704
- C:\Windows\System\pKIkWpv.exe
  C:\Windows\System\pKIkWpv.exe
  2⤵
  PID:6740
- C:\Windows\System\SXGylPf.exe
  C:\Windows\System\SXGylPf.exe
  2⤵
  PID:6764
- C:\Windows\System\BacWZND.exe
  C:\Windows\System\BacWZND.exe
  2⤵
  PID:6788
- C:\Windows\System\JjwtQjg.exe
  C:\Windows\System\JjwtQjg.exe
  2⤵
  PID:6812
- C:\Windows\System\ldSGGMX.exe
  C:\Windows\System\ldSGGMX.exe
  2⤵
  PID:6852
- C:\Windows\System\xCcYvao.exe
  C:\Windows\System\xCcYvao.exe
  2⤵
  PID:6880
- C:\Windows\System\xXXxLVb.exe
  C:\Windows\System\xXXxLVb.exe
  2⤵
  PID:6904
- C:\Windows\System\LUfmdZD.exe
  C:\Windows\System\LUfmdZD.exe
  2⤵
  PID:6948
- C:\Windows\System\FabHoaS.exe
  C:\Windows\System\FabHoaS.exe
  2⤵
  PID:6972
- C:\Windows\System\QyejVVW.exe
  C:\Windows\System\QyejVVW.exe
  2⤵
  PID:7008
- C:\Windows\System\gLBYpPQ.exe
  C:\Windows\System\gLBYpPQ.exe
  2⤵
  PID:7028
- C:\Windows\System\zGgTGnj.exe
  C:\Windows\System\zGgTGnj.exe
  2⤵
  PID:7056
- C:\Windows\System\fKRckqq.exe
  C:\Windows\System\fKRckqq.exe
  2⤵
  PID:7084
- C:\Windows\System\nTaGyip.exe
  C:\Windows\System\nTaGyip.exe
  2⤵
  PID:7112
- C:\Windows\System\ZrHTxQG.exe
  C:\Windows\System\ZrHTxQG.exe
  2⤵
  PID:7140
- C:\Windows\System\reqkNXO.exe
  C:\Windows\System\reqkNXO.exe
  2⤵
  PID:6168
- C:\Windows\System\VibtnPY.exe
  C:\Windows\System\VibtnPY.exe
  2⤵
  PID:6228
- C:\Windows\System\NWRYNhV.exe
  C:\Windows\System\NWRYNhV.exe
  2⤵
  PID:6268
- C:\Windows\System\ZncMUwZ.exe
  C:\Windows\System\ZncMUwZ.exe
  2⤵
  PID:6364
- C:\Windows\System\oCBMuBa.exe
  C:\Windows\System\oCBMuBa.exe
  2⤵
  PID:6440
- C:\Windows\System\vJBgEjP.exe
  C:\Windows\System\vJBgEjP.exe
  2⤵
  PID:6500
- C:\Windows\System\SvIBBCT.exe
  C:\Windows\System\SvIBBCT.exe
  2⤵
  PID:6576
- C:\Windows\System\JuXcZtT.exe
  C:\Windows\System\JuXcZtT.exe
  2⤵
  PID:6644
- C:\Windows\System\xTONCVb.exe
  C:\Windows\System\xTONCVb.exe
  2⤵
  PID:6696
- C:\Windows\System\fRgdkAH.exe
  C:\Windows\System\fRgdkAH.exe
  2⤵
  PID:6772
- C:\Windows\System\hdFnxdF.exe
  C:\Windows\System\hdFnxdF.exe
  2⤵
  PID:6828
- C:\Windows\System\mlYUVwH.exe
  C:\Windows\System\mlYUVwH.exe
  2⤵
  PID:6896
- C:\Windows\System\VnTSBnz.exe
  C:\Windows\System\VnTSBnz.exe
  2⤵
  PID:6968
- C:\Windows\System\jfpXrip.exe
  C:\Windows\System\jfpXrip.exe
  2⤵
  PID:7048
- C:\Windows\System\ejlOxim.exe
  C:\Windows\System\ejlOxim.exe
  2⤵
  PID:7104
- C:\Windows\System\TUsqiIn.exe
  C:\Windows\System\TUsqiIn.exe
  2⤵
  PID:6176
- C:\Windows\System\QlpUknw.exe
  C:\Windows\System\QlpUknw.exe
  2⤵
  PID:6272
- C:\Windows\System\YneUgCB.exe
  C:\Windows\System\YneUgCB.exe
  2⤵
  PID:6496
- C:\Windows\System\jPIReHl.exe
  C:\Windows\System\jPIReHl.exe
  2⤵
  PID:6632
- C:\Windows\System\BYxMYan.exe
  C:\Windows\System\BYxMYan.exe
  2⤵
  PID:6804
- C:\Windows\System\jczbHLA.exe
  C:\Windows\System\jczbHLA.exe
  2⤵
  PID:6992
- C:\Windows\System\SRrPUat.exe
  C:\Windows\System\SRrPUat.exe
  2⤵
  PID:7080
- C:\Windows\System\cVvrBXi.exe
  C:\Windows\System\cVvrBXi.exe
  2⤵
  PID:6332
- C:\Windows\System\vWTwqVU.exe
  C:\Windows\System\vWTwqVU.exe
  2⤵
  PID:6752
- C:\Windows\System\bPSPPtP.exe
  C:\Windows\System\bPSPPtP.exe
  2⤵
  PID:7068
- C:\Windows\System\mkUXNTo.exe
  C:\Windows\System\mkUXNTo.exe
  2⤵
  PID:6924
- C:\Windows\System\rCoeAOS.exe
  C:\Windows\System\rCoeAOS.exe
  2⤵
  PID:7188
- C:\Windows\System\FpXvoyh.exe
  C:\Windows\System\FpXvoyh.exe
  2⤵
  PID:7220
- C:\Windows\System\lNVXttb.exe
  C:\Windows\System\lNVXttb.exe
  2⤵
  PID:7256
- C:\Windows\System\fRdREQn.exe
  C:\Windows\System\fRdREQn.exe
  2⤵
  PID:7292
- C:\Windows\System\nJgWnxn.exe
  C:\Windows\System\nJgWnxn.exe
  2⤵
  PID:7320
- C:\Windows\System\hxhsbCA.exe
  C:\Windows\System\hxhsbCA.exe
  2⤵
  PID:7336
- C:\Windows\System\ecohKjR.exe
  C:\Windows\System\ecohKjR.exe
  2⤵
  PID:7376
- C:\Windows\System\hKubsNP.exe
  C:\Windows\System\hKubsNP.exe
  2⤵
  PID:7392
- C:\Windows\System\xYwolYh.exe
  C:\Windows\System\xYwolYh.exe
  2⤵
  PID:7408
- C:\Windows\System\JJFbtwE.exe
  C:\Windows\System\JJFbtwE.exe
  2⤵
  PID:7424
- C:\Windows\System\zWEboPX.exe
  C:\Windows\System\zWEboPX.exe
  2⤵
  PID:7468
- C:\Windows\System\tmYyOYN.exe
  C:\Windows\System\tmYyOYN.exe
  2⤵
  PID:7484
- C:\Windows\System\bvVbkRw.exe
  C:\Windows\System\bvVbkRw.exe
  2⤵
  PID:7500
- C:\Windows\System\BDYlGGS.exe
  C:\Windows\System\BDYlGGS.exe
  2⤵
  PID:7532
- C:\Windows\System\ikbgzAD.exe
  C:\Windows\System\ikbgzAD.exe
  2⤵
  PID:7580
- C:\Windows\System\qOHvTTF.exe
  C:\Windows\System\qOHvTTF.exe
  2⤵
  PID:7620
- C:\Windows\System\CvqQevd.exe
  C:\Windows\System\CvqQevd.exe
  2⤵
  PID:7664
- C:\Windows\System\wsgRJvB.exe
  C:\Windows\System\wsgRJvB.exe
  2⤵
  PID:7692
- C:\Windows\System\tMtXqRG.exe
  C:\Windows\System\tMtXqRG.exe
  2⤵
  PID:7728
- C:\Windows\System\xNckpyS.exe
  C:\Windows\System\xNckpyS.exe
  2⤵
  PID:7756
- C:\Windows\System\RwtAdXY.exe
  C:\Windows\System\RwtAdXY.exe
  2⤵
  PID:7776
- C:\Windows\System\ouzGthq.exe
  C:\Windows\System\ouzGthq.exe
  2⤵
  PID:7804
- C:\Windows\System\TDwqYNC.exe
  C:\Windows\System\TDwqYNC.exe
  2⤵
  PID:7836
- C:\Windows\System\aThVeXe.exe
  C:\Windows\System\aThVeXe.exe
  2⤵
  PID:7860
- C:\Windows\System\EjYwdzR.exe
  C:\Windows\System\EjYwdzR.exe
  2⤵
  PID:7896
- C:\Windows\System\YqOjLtD.exe
  C:\Windows\System\YqOjLtD.exe
  2⤵
  PID:7920
- C:\Windows\System\OBoakdZ.exe
  C:\Windows\System\OBoakdZ.exe
  2⤵
  PID:7952
- C:\Windows\System\zrSjUyb.exe
  C:\Windows\System\zrSjUyb.exe
  2⤵
  PID:7980
- C:\Windows\System\gSrNkuL.exe
  C:\Windows\System\gSrNkuL.exe
  2⤵
  PID:8004
- C:\Windows\System\sJnlWBI.exe
  C:\Windows\System\sJnlWBI.exe
  2⤵
  PID:8036
- C:\Windows\System\QaoMkjQ.exe
  C:\Windows\System\QaoMkjQ.exe
  2⤵
  PID:8064
- C:\Windows\System\RmlUnND.exe
  C:\Windows\System\RmlUnND.exe
  2⤵
  PID:8096
- C:\Windows\System\kfWxDhX.exe
  C:\Windows\System\kfWxDhX.exe
  2⤵
  PID:8136
- C:\Windows\System\rLLYPeh.exe
  C:\Windows\System\rLLYPeh.exe
  2⤵
  PID:8160
- C:\Windows\System\lLjoavP.exe
  C:\Windows\System\lLjoavP.exe
  2⤵
  PID:6872
- C:\Windows\System\zwkDwhd.exe
  C:\Windows\System\zwkDwhd.exe
  2⤵
  PID:7212
- C:\Windows\System\nyabdoC.exe
  C:\Windows\System\nyabdoC.exe
  2⤵
  PID:7280
- C:\Windows\System\yevNKfw.exe
  C:\Windows\System\yevNKfw.exe
  2⤵
  PID:7348
- C:\Windows\System\tlrWglg.exe
  C:\Windows\System\tlrWglg.exe
  2⤵
  PID:7416
- C:\Windows\System\IHmMMxn.exe
  C:\Windows\System\IHmMMxn.exe
  2⤵
  PID:7476
- C:\Windows\System\kXHEpGV.exe
  C:\Windows\System\kXHEpGV.exe
  2⤵
  PID:7528
- C:\Windows\System\JDViGds.exe
  C:\Windows\System\JDViGds.exe
  2⤵
  PID:7604
- C:\Windows\System\ogTmHUq.exe
  C:\Windows\System\ogTmHUq.exe
  2⤵
  PID:7684
- C:\Windows\System\xbEmMAc.exe
  C:\Windows\System\xbEmMAc.exe
  2⤵
  PID:7768
- C:\Windows\System\onUnOWp.exe
  C:\Windows\System\onUnOWp.exe
  2⤵
  PID:7828
- C:\Windows\System\muvMlAu.exe
  C:\Windows\System\muvMlAu.exe
  2⤵
  PID:7880
- C:\Windows\System\tfVGidJ.exe
  C:\Windows\System\tfVGidJ.exe
  2⤵
  PID:7968
- C:\Windows\System\yZAcBkJ.exe
  C:\Windows\System\yZAcBkJ.exe
  2⤵
  PID:8016
- C:\Windows\System\LjJoQjh.exe
  C:\Windows\System\LjJoQjh.exe
  2⤵
  PID:8080
- C:\Windows\System\FZNCKDu.exe
  C:\Windows\System\FZNCKDu.exe
  2⤵
  PID:8168
- C:\Windows\System\aTuCmGb.exe
  C:\Windows\System\aTuCmGb.exe
  2⤵
  PID:7284
- C:\Windows\System\BBzbDyq.exe
  C:\Windows\System\BBzbDyq.exe
  2⤵
  PID:7400
- C:\Windows\System\djTRvhP.exe
  C:\Windows\System\djTRvhP.exe
  2⤵
  PID:7576
- C:\Windows\System\REjkWWW.exe
  C:\Windows\System\REjkWWW.exe
  2⤵
  PID:7736
- C:\Windows\System\sCDRrPe.exe
  C:\Windows\System\sCDRrPe.exe
  2⤵
  PID:7852
- C:\Windows\System\JxEKYui.exe
  C:\Windows\System\JxEKYui.exe
  2⤵
  PID:7996
- C:\Windows\System\RSHAUDW.exe
  C:\Windows\System\RSHAUDW.exe
  2⤵
  PID:7184
- C:\Windows\System\EBIJwlt.exe
  C:\Windows\System\EBIJwlt.exe
  2⤵
  PID:7496
- C:\Windows\System\cQfYnkG.exe
  C:\Windows\System\cQfYnkG.exe
  2⤵
  PID:7908
- C:\Windows\System\GgHvNQJ.exe
  C:\Windows\System\GgHvNQJ.exe
  2⤵
  PID:7444
- C:\Windows\System\CqOnexi.exe
  C:\Windows\System\CqOnexi.exe
  2⤵
  PID:7788
- C:\Windows\System\orVngpv.exe
  C:\Windows\System\orVngpv.exe
  2⤵
  PID:8208
- C:\Windows\System\dQQqvmD.exe
  C:\Windows\System\dQQqvmD.exe
  2⤵
  PID:8232
- C:\Windows\System\fDgCWeF.exe
  C:\Windows\System\fDgCWeF.exe
  2⤵
  PID:8256
- C:\Windows\System\WIjypbr.exe
  C:\Windows\System\WIjypbr.exe
  2⤵
  PID:8288
- C:\Windows\System\buonyPH.exe
  C:\Windows\System\buonyPH.exe
  2⤵
  PID:8320
- C:\Windows\System\pZeSchH.exe
  C:\Windows\System\pZeSchH.exe
  2⤵
  PID:8340
- C:\Windows\System\ghldOKI.exe
  C:\Windows\System\ghldOKI.exe
  2⤵
  PID:8372
- C:\Windows\System\YAGRpbg.exe
  C:\Windows\System\YAGRpbg.exe
  2⤵
  PID:8404
- C:\Windows\System\ihdWJkm.exe
  C:\Windows\System\ihdWJkm.exe
  2⤵
  PID:8432
- C:\Windows\System\DsUOAdk.exe
  C:\Windows\System\DsUOAdk.exe
  2⤵
  PID:8460
- C:\Windows\System\DcUSnOv.exe
  C:\Windows\System\DcUSnOv.exe
  2⤵
  PID:8488
- C:\Windows\System\lHTVSYo.exe
  C:\Windows\System\lHTVSYo.exe
  2⤵
  PID:8516
- C:\Windows\System\RPUiBZE.exe
  C:\Windows\System\RPUiBZE.exe
  2⤵
  PID:8540
- C:\Windows\System\aRVZOHU.exe
  C:\Windows\System\aRVZOHU.exe
  2⤵
  PID:8572
- C:\Windows\System\aAjGqye.exe
  C:\Windows\System\aAjGqye.exe
  2⤵
  PID:8596
- C:\Windows\System\RwFojwX.exe
  C:\Windows\System\RwFojwX.exe
  2⤵
  PID:8624
- C:\Windows\System\nKKzstw.exe
  C:\Windows\System\nKKzstw.exe
  2⤵
  PID:8648
- C:\Windows\System\TXjOZcK.exe
  C:\Windows\System\TXjOZcK.exe
  2⤵
  PID:8680
- C:\Windows\System\nexQrzq.exe
  C:\Windows\System\nexQrzq.exe
  2⤵
  PID:8712
- C:\Windows\System\nyWbEZZ.exe
  C:\Windows\System\nyWbEZZ.exe
  2⤵
  PID:8732
- C:\Windows\System\CQPlZfH.exe
  C:\Windows\System\CQPlZfH.exe
  2⤵
  PID:8772
- C:\Windows\System\ncKZVkB.exe
  C:\Windows\System\ncKZVkB.exe
  2⤵
  PID:8788
- C:\Windows\System\XKnVSBC.exe
  C:\Windows\System\XKnVSBC.exe
  2⤵
  PID:8816
- C:\Windows\System\OkRZxet.exe
  C:\Windows\System\OkRZxet.exe
  2⤵
  PID:8844
- C:\Windows\System\CgiXixm.exe
  C:\Windows\System\CgiXixm.exe
  2⤵
  PID:8872
- C:\Windows\System\egpFfFs.exe
  C:\Windows\System\egpFfFs.exe
  2⤵
  PID:8900
- C:\Windows\System\NiXuXxU.exe
  C:\Windows\System\NiXuXxU.exe
  2⤵
  PID:8928
- C:\Windows\System\ncxAxys.exe
  C:\Windows\System\ncxAxys.exe
  2⤵
  PID:8964
- C:\Windows\System\jSmixUr.exe
  C:\Windows\System\jSmixUr.exe
  2⤵
  PID:8988
- C:\Windows\System\KSAHBUc.exe
  C:\Windows\System\KSAHBUc.exe
  2⤵
  PID:9012
- C:\Windows\System\JbRmlmv.exe
  C:\Windows\System\JbRmlmv.exe
  2⤵
  PID:9040
- C:\Windows\System\uJGCZDc.exe
  C:\Windows\System\uJGCZDc.exe
  2⤵
  PID:9068
- C:\Windows\System\mFohzZH.exe
  C:\Windows\System\mFohzZH.exe
  2⤵
  PID:9096
- C:\Windows\System\aMzzmEq.exe
  C:\Windows\System\aMzzmEq.exe
  2⤵
  PID:9124
- C:\Windows\System\QcfsLUe.exe
  C:\Windows\System\QcfsLUe.exe
  2⤵
  PID:9152
- C:\Windows\System\RBEpsPF.exe
  C:\Windows\System\RBEpsPF.exe
  2⤵
  PID:9180
- C:\Windows\System\TlLHwFb.exe
  C:\Windows\System\TlLHwFb.exe
  2⤵
  PID:9196
- C:\Windows\System\nLOFkvC.exe
  C:\Windows\System\nLOFkvC.exe
  2⤵
  PID:8240
- C:\Windows\System\puhPDPl.exe
  C:\Windows\System\puhPDPl.exe
  2⤵
  PID:8304
- C:\Windows\System\BNDYOzd.exe
  C:\Windows\System\BNDYOzd.exe
  2⤵
  PID:8364
- C:\Windows\System\XHjPwcz.exe
  C:\Windows\System\XHjPwcz.exe
  2⤵
  PID:8440
- C:\Windows\System\gtLNmRD.exe
  C:\Windows\System\gtLNmRD.exe
  2⤵
  PID:8508
- C:\Windows\System\fORKXfc.exe
  C:\Windows\System\fORKXfc.exe
  2⤵
  PID:8580
- C:\Windows\System\gEflcRW.exe
  C:\Windows\System\gEflcRW.exe
  2⤵
  PID:8640
- C:\Windows\System\WnlmLsW.exe
  C:\Windows\System\WnlmLsW.exe
  2⤵
  PID:8704
- C:\Windows\System\udEsZvc.exe
  C:\Windows\System\udEsZvc.exe
  2⤵
  PID:2612
- C:\Windows\System\wFVhgIh.exe
  C:\Windows\System\wFVhgIh.exe
  2⤵
  PID:3040
- C:\Windows\System\RRwIlzi.exe
  C:\Windows\System\RRwIlzi.exe
  2⤵
  PID:388
- C:\Windows\System\mNggOwg.exe
  C:\Windows\System\mNggOwg.exe
  2⤵
  PID:8744
- C:\Windows\System\rQaphln.exe
  C:\Windows\System\rQaphln.exe
  2⤵
  PID:8784
- C:\Windows\System\ZIcqfQB.exe
  C:\Windows\System\ZIcqfQB.exe
  2⤵
  PID:8868
- C:\Windows\System\zyECOat.exe
  C:\Windows\System\zyECOat.exe
  2⤵
  PID:8920
- C:\Windows\System\SejUShx.exe
  C:\Windows\System\SejUShx.exe
  2⤵
  PID:8976
- C:\Windows\System\VWxPQlA.exe
  C:\Windows\System\VWxPQlA.exe
  2⤵
  PID:9036
- C:\Windows\System\HYcFmBY.exe
  C:\Windows\System\HYcFmBY.exe
  2⤵
  PID:9108
- C:\Windows\System\jSWEXhv.exe
  C:\Windows\System\jSWEXhv.exe
  2⤵
  PID:9176
- C:\Windows\System\yAypoNT.exe
  C:\Windows\System\yAypoNT.exe
  2⤵
  PID:8196
- C:\Windows\System\BvnmmAw.exe
  C:\Windows\System\BvnmmAw.exe
  2⤵
  PID:8420
- C:\Windows\System\IyuiiLA.exe
  C:\Windows\System\IyuiiLA.exe
  2⤵
  PID:8560
- C:\Windows\System\VZphFZz.exe
  C:\Windows\System\VZphFZz.exe
  2⤵
  PID:8728
- C:\Windows\System\woxVTTk.exe
  C:\Windows\System\woxVTTk.exe
  2⤵
  PID:3552
- C:\Windows\System\gevNxla.exe
  C:\Windows\System\gevNxla.exe
  2⤵
  PID:8780
- C:\Windows\System\PPtUWOq.exe
  C:\Windows\System\PPtUWOq.exe
  2⤵
  PID:8948
- C:\Windows\System\IahkFMM.exe
  C:\Windows\System\IahkFMM.exe
  2⤵
  PID:9088
- C:\Windows\System\rGQYHOd.exe
  C:\Windows\System\rGQYHOd.exe
  2⤵
  PID:8220
- C:\Windows\System\HJdqnGm.exe
  C:\Windows\System\HJdqnGm.exe
  2⤵
  PID:8632
- C:\Windows\System\PkEoJKn.exe
  C:\Windows\System\PkEoJKn.exe
  2⤵
  PID:8760
- C:\Windows\System\hGkgGbU.exe
  C:\Windows\System\hGkgGbU.exe
  2⤵
  PID:9064
- C:\Windows\System\hQvALHt.exe
  C:\Windows\System\hQvALHt.exe
  2⤵
  PID:1208
- C:\Windows\System\kNTBNlF.exe
  C:\Windows\System\kNTBNlF.exe
  2⤵
  PID:8532
- C:\Windows\System\uWLCiLC.exe
  C:\Windows\System\uWLCiLC.exe
  2⤵
  PID:9236
- C:\Windows\System\cOgwJWW.exe
  C:\Windows\System\cOgwJWW.exe
  2⤵
  PID:9264
- C:\Windows\System\Gkhobva.exe
  C:\Windows\System\Gkhobva.exe
  2⤵
  PID:9292
- C:\Windows\System\cgbMhDf.exe
  C:\Windows\System\cgbMhDf.exe
  2⤵
  PID:9320
- C:\Windows\System\lQfTuyN.exe
  C:\Windows\System\lQfTuyN.exe
  2⤵
  PID:9348
- C:\Windows\System\dyEHrff.exe
  C:\Windows\System\dyEHrff.exe
  2⤵
  PID:9376
- C:\Windows\System\nGILwnB.exe
  C:\Windows\System\nGILwnB.exe
  2⤵
  PID:9408
- C:\Windows\System\lbXfkln.exe
  C:\Windows\System\lbXfkln.exe
  2⤵
  PID:9432
- C:\Windows\System\nmLEVHr.exe
  C:\Windows\System\nmLEVHr.exe
  2⤵
  PID:9460
- C:\Windows\System\ZYFiqYp.exe
  C:\Windows\System\ZYFiqYp.exe
  2⤵
  PID:9488
- C:\Windows\System\RUhRrFh.exe
  C:\Windows\System\RUhRrFh.exe
  2⤵
  PID:9516
- C:\Windows\System\RWtOSnG.exe
  C:\Windows\System\RWtOSnG.exe
  2⤵
  PID:9544
- C:\Windows\System\zYDIHHN.exe
  C:\Windows\System\zYDIHHN.exe
  2⤵
  PID:9572
- C:\Windows\System\hJYEZiu.exe
  C:\Windows\System\hJYEZiu.exe
  2⤵
  PID:9600
- C:\Windows\System\tNZDNey.exe
  C:\Windows\System\tNZDNey.exe
  2⤵
  PID:9628
- C:\Windows\System\kWbvWQd.exe
  C:\Windows\System\kWbvWQd.exe
  2⤵
  PID:9656
- C:\Windows\System\CXwfueV.exe
  C:\Windows\System\CXwfueV.exe
  2⤵
  PID:9684
- C:\Windows\System\KCduXDD.exe
  C:\Windows\System\KCduXDD.exe
  2⤵
  PID:9712
- C:\Windows\System\aoJEAuo.exe
  C:\Windows\System\aoJEAuo.exe
  2⤵
  PID:9740
- C:\Windows\System\mCARZwS.exe
  C:\Windows\System\mCARZwS.exe
  2⤵
  PID:9768
- C:\Windows\System\EYNXqko.exe
  C:\Windows\System\EYNXqko.exe
  2⤵
  PID:9796
- C:\Windows\System\fOTCkjG.exe
  C:\Windows\System\fOTCkjG.exe
  2⤵
  PID:9824
- C:\Windows\System\QrAqxhI.exe
  C:\Windows\System\QrAqxhI.exe
  2⤵
  PID:9856
- C:\Windows\System\RytYHHV.exe
  C:\Windows\System\RytYHHV.exe
  2⤵
  PID:9884
- C:\Windows\System\dnqaAxY.exe
  C:\Windows\System\dnqaAxY.exe
  2⤵
  PID:9912
- C:\Windows\System\sGdOEJa.exe
  C:\Windows\System\sGdOEJa.exe
  2⤵
  PID:9940
- C:\Windows\System\QjFlVCI.exe
  C:\Windows\System\QjFlVCI.exe
  2⤵
  PID:9968
- C:\Windows\System\RglQqDQ.exe
  C:\Windows\System\RglQqDQ.exe
  2⤵
  PID:9996
- C:\Windows\System\eBicEIH.exe
  C:\Windows\System\eBicEIH.exe
  2⤵
  PID:10024
- C:\Windows\System\PPMisHu.exe
  C:\Windows\System\PPMisHu.exe
  2⤵
  PID:10052
- C:\Windows\System\tHOfVCd.exe
  C:\Windows\System\tHOfVCd.exe
  2⤵
  PID:10080
- C:\Windows\System\cuxhTwP.exe
  C:\Windows\System\cuxhTwP.exe
  2⤵
  PID:10108
- C:\Windows\System\ryPhlrg.exe
  C:\Windows\System\ryPhlrg.exe
  2⤵
  PID:10136
- C:\Windows\System\eODtQSW.exe
  C:\Windows\System\eODtQSW.exe
  2⤵
  PID:10164
- C:\Windows\System\KbnJbNE.exe
  C:\Windows\System\KbnJbNE.exe
  2⤵
  PID:10192
- C:\Windows\System\IaUGuQT.exe
  C:\Windows\System\IaUGuQT.exe
  2⤵
  PID:10220
- C:\Windows\System\UsUbven.exe
  C:\Windows\System\UsUbven.exe
  2⤵
  PID:9220
- C:\Windows\System\BaZYDru.exe
  C:\Windows\System\BaZYDru.exe
  2⤵
  PID:9284
- C:\Windows\System\Qgnrjyh.exe
  C:\Windows\System\Qgnrjyh.exe
  2⤵
  PID:9344
- C:\Windows\System\EkhtQSp.exe
  C:\Windows\System\EkhtQSp.exe
  2⤵
  PID:9416
- C:\Windows\System\LIclqPi.exe
  C:\Windows\System\LIclqPi.exe
  2⤵
  PID:9472
- C:\Windows\System\ZDsxBRA.exe
  C:\Windows\System\ZDsxBRA.exe
  2⤵
  PID:9536
- C:\Windows\System\VSBQARH.exe
  C:\Windows\System\VSBQARH.exe
  2⤵
  PID:9596
- C:\Windows\System\yRplQvl.exe
  C:\Windows\System\yRplQvl.exe
  2⤵
  PID:9668
- C:\Windows\System\vptwrNC.exe
  C:\Windows\System\vptwrNC.exe
  2⤵
  PID:9732
- C:\Windows\System\feBFDhW.exe
  C:\Windows\System\feBFDhW.exe
  2⤵
  PID:9792
- C:\Windows\System\MfYximo.exe
  C:\Windows\System\MfYximo.exe
  2⤵
  PID:9868
- C:\Windows\System\orgrjdE.exe
  C:\Windows\System\orgrjdE.exe
  2⤵
  PID:9932
- C:\Windows\System\vbWokCt.exe
  C:\Windows\System\vbWokCt.exe
  2⤵
  PID:9992
- C:\Windows\System\FIcyLid.exe
  C:\Windows\System\FIcyLid.exe
  2⤵
  PID:10048
- C:\Windows\System\CFOqKIm.exe
  C:\Windows\System\CFOqKIm.exe
  2⤵
  PID:10120
- C:\Windows\System\QdNpoFS.exe
  C:\Windows\System\QdNpoFS.exe
  2⤵
  PID:10184
- C:\Windows\System\ORMjRot.exe
  C:\Windows\System\ORMjRot.exe
  2⤵
  PID:8216
- C:\Windows\System\dBZbBCT.exe
  C:\Windows\System\dBZbBCT.exe
  2⤵
  PID:9372
- C:\Windows\System\uXYFdAH.exe
  C:\Windows\System\uXYFdAH.exe
  2⤵
  PID:9512
- C:\Windows\System\yjktnbM.exe
  C:\Windows\System\yjktnbM.exe
  2⤵
  PID:9652
- C:\Windows\System\RcovVSe.exe
  C:\Windows\System\RcovVSe.exe
  2⤵
  PID:9820
- C:\Windows\System\FpYskYw.exe
  C:\Windows\System\FpYskYw.exe
  2⤵
  PID:9980
- C:\Windows\System\mMHynvt.exe
  C:\Windows\System\mMHynvt.exe
  2⤵
  PID:10104
- C:\Windows\System\PSjPJcu.exe
  C:\Windows\System\PSjPJcu.exe
  2⤵
  PID:9276
- C:\Windows\System\PMcxEeT.exe
  C:\Windows\System\PMcxEeT.exe
  2⤵
  PID:9648
- C:\Windows\System\KVzkCpq.exe
  C:\Windows\System\KVzkCpq.exe
  2⤵
  PID:9924
- C:\Windows\System\WKULvZz.exe
  C:\Windows\System\WKULvZz.exe
  2⤵
  PID:9444
- C:\Windows\System\jbgTGeJ.exe
  C:\Windows\System\jbgTGeJ.exe
  2⤵
  PID:10100
- C:\Windows\System\lQjROjb.exe
  C:\Windows\System\lQjROjb.exe
  2⤵
  PID:9960
- C:\Windows\System\bajiVqy.exe
  C:\Windows\System\bajiVqy.exe
  2⤵
  PID:10272
- C:\Windows\System\RpmKLyl.exe
  C:\Windows\System\RpmKLyl.exe
  2⤵
  PID:10300
- C:\Windows\System\blLjCTi.exe
  C:\Windows\System\blLjCTi.exe
  2⤵
  PID:10328
- C:\Windows\System\rwqpCEC.exe
  C:\Windows\System\rwqpCEC.exe
  2⤵
  PID:10356
- C:\Windows\System\LDTLXxl.exe
  C:\Windows\System\LDTLXxl.exe
  2⤵
  PID:10384
- C:\Windows\System\BtblBEF.exe
  C:\Windows\System\BtblBEF.exe
  2⤵
  PID:10412
- C:\Windows\System\KAAIMPN.exe
  C:\Windows\System\KAAIMPN.exe
  2⤵
  PID:10440
- C:\Windows\System\tKtArnU.exe
  C:\Windows\System\tKtArnU.exe
  2⤵
  PID:10468
- C:\Windows\System\puBnKcQ.exe
  C:\Windows\System\puBnKcQ.exe
  2⤵
  PID:10496
- C:\Windows\System\mJQKMSv.exe
  C:\Windows\System\mJQKMSv.exe
  2⤵
  PID:10528
- C:\Windows\System\YqJjGUa.exe
  C:\Windows\System\YqJjGUa.exe
  2⤵
  PID:10556
- C:\Windows\System\vQtftVa.exe
  C:\Windows\System\vQtftVa.exe
  2⤵
  PID:10584
- C:\Windows\System\htfmeaG.exe
  C:\Windows\System\htfmeaG.exe
  2⤵
  PID:10612
- C:\Windows\System\SfJSwsZ.exe
  C:\Windows\System\SfJSwsZ.exe
  2⤵
  PID:10640
- C:\Windows\System\ovcFwQI.exe
  C:\Windows\System\ovcFwQI.exe
  2⤵
  PID:10668
- C:\Windows\System\uMYEafN.exe
  C:\Windows\System\uMYEafN.exe
  2⤵
  PID:10696
- C:\Windows\System\hUmSCLA.exe
  C:\Windows\System\hUmSCLA.exe
  2⤵
  PID:10724
- C:\Windows\System\ivoZrfM.exe
  C:\Windows\System\ivoZrfM.exe
  2⤵
  PID:10752
- C:\Windows\System\jgtfyqE.exe
  C:\Windows\System\jgtfyqE.exe
  2⤵
  PID:10780
- C:\Windows\System\WZzvlDp.exe
  C:\Windows\System\WZzvlDp.exe
  2⤵
  PID:10808
- C:\Windows\System\kMUxBwh.exe
  C:\Windows\System\kMUxBwh.exe
  2⤵
  PID:10836
- C:\Windows\System\pggjhRw.exe
  C:\Windows\System\pggjhRw.exe
  2⤵
  PID:10864
- C:\Windows\System\nJZICAI.exe
  C:\Windows\System\nJZICAI.exe
  2⤵
  PID:10892
- C:\Windows\System\VvhErSQ.exe
  C:\Windows\System\VvhErSQ.exe
  2⤵
  PID:10920
- C:\Windows\System\IeQGcjX.exe
  C:\Windows\System\IeQGcjX.exe
  2⤵
  PID:10948
- C:\Windows\System\sQeUcQH.exe
  C:\Windows\System\sQeUcQH.exe
  2⤵
  PID:10976
- C:\Windows\System\yccbuJO.exe
  C:\Windows\System\yccbuJO.exe
  2⤵
  PID:11004
- C:\Windows\System\jAgUOgL.exe
  C:\Windows\System\jAgUOgL.exe
  2⤵
  PID:11032
- C:\Windows\System\DmaoMGA.exe
  C:\Windows\System\DmaoMGA.exe
  2⤵
  PID:11060
- C:\Windows\System\XiCohJb.exe
  C:\Windows\System\XiCohJb.exe
  2⤵
  PID:11088
- C:\Windows\System\MgsZTtn.exe
  C:\Windows\System\MgsZTtn.exe
  2⤵
  PID:11116
- C:\Windows\System\DRsZqec.exe
  C:\Windows\System\DRsZqec.exe
  2⤵
  PID:11144
- C:\Windows\System\TeHRIWW.exe
  C:\Windows\System\TeHRIWW.exe
  2⤵
  PID:11172
- C:\Windows\System\VScGbKU.exe
  C:\Windows\System\VScGbKU.exe
  2⤵
  PID:11200
- C:\Windows\System\pXkkrpO.exe
  C:\Windows\System\pXkkrpO.exe
  2⤵
  PID:11228
- C:\Windows\System\FUnMgaV.exe
  C:\Windows\System\FUnMgaV.exe
  2⤵
  PID:11256
- C:\Windows\System\QIZBMcn.exe
  C:\Windows\System\QIZBMcn.exe
  2⤵
  PID:10284
- C:\Windows\System\PyGHmLr.exe
  C:\Windows\System\PyGHmLr.exe
  2⤵
  PID:10348
- C:\Windows\System\qSPaNXc.exe
  C:\Windows\System\qSPaNXc.exe
  2⤵
  PID:10404
- C:\Windows\System\IgSTUwQ.exe
  C:\Windows\System\IgSTUwQ.exe
  2⤵
  PID:10480
- C:\Windows\System\piICibk.exe
  C:\Windows\System\piICibk.exe
  2⤵
  PID:10548
- C:\Windows\System\zJHnbhx.exe
  C:\Windows\System\zJHnbhx.exe
  2⤵
  PID:10608
- C:\Windows\System\JPCzCnb.exe
  C:\Windows\System\JPCzCnb.exe
  2⤵
  PID:10684
- C:\Windows\System\bJxxLKC.exe
  C:\Windows\System\bJxxLKC.exe
  2⤵
  PID:10744
- C:\Windows\System\ZazeftT.exe
  C:\Windows\System\ZazeftT.exe
  2⤵
  PID:10804
- C:\Windows\System\PBvnUVn.exe
  C:\Windows\System\PBvnUVn.exe
  2⤵
  PID:10876
- C:\Windows\System\esDHbyp.exe
  C:\Windows\System\esDHbyp.exe
  2⤵
  PID:10944
- C:\Windows\System\ojuyNhT.exe
  C:\Windows\System\ojuyNhT.exe
  2⤵
  PID:11000
- C:\Windows\System\lhGsgvl.exe
  C:\Windows\System\lhGsgvl.exe
  2⤵
  PID:11056
- C:\Windows\System\aiZqeYP.exe
  C:\Windows\System\aiZqeYP.exe
  2⤵
  PID:11136
- C:\Windows\System\wHhGwEw.exe
  C:\Windows\System\wHhGwEw.exe
  2⤵
  PID:11196
- C:\Windows\System\kvWfuSw.exe
  C:\Windows\System\kvWfuSw.exe
  2⤵
  PID:10244
- C:\Windows\System\HyeMAJM.exe
  C:\Windows\System\HyeMAJM.exe
  2⤵
  PID:10396
- C:\Windows\System\wbRAqPF.exe
  C:\Windows\System\wbRAqPF.exe
  2⤵
  PID:10540
- C:\Windows\System\cbQxzZs.exe
  C:\Windows\System\cbQxzZs.exe
  2⤵
  PID:10712
- C:\Windows\System\xNawEpa.exe
  C:\Windows\System\xNawEpa.exe
  2⤵
  PID:10860
- C:\Windows\System\lGIocli.exe
  C:\Windows\System\lGIocli.exe
  2⤵
  PID:10996
- C:\Windows\System\QkqLpNQ.exe
  C:\Windows\System\QkqLpNQ.exe
  2⤵
  PID:11164
- C:\Windows\System\xsIDihu.exe
  C:\Windows\System\xsIDihu.exe
  2⤵
  PID:10312
- C:\Windows\System\JXNPVyS.exe
  C:\Windows\System\JXNPVyS.exe
  2⤵
  PID:10660
- C:\Windows\System\YoAiVJQ.exe
  C:\Windows\System\YoAiVJQ.exe
  2⤵
  PID:10988
- C:\Windows\System\fVLjaaR.exe
  C:\Windows\System\fVLjaaR.exe
  2⤵
  PID:10512
- C:\Windows\System\wwFUVQf.exe
  C:\Windows\System\wwFUVQf.exe
  2⤵
  PID:11252
- C:\Windows\System\hGFyllp.exe
  C:\Windows\System\hGFyllp.exe
  2⤵
  PID:11272
- C:\Windows\System\dtZIHKd.exe
  C:\Windows\System\dtZIHKd.exe
  2⤵
  PID:11304
- C:\Windows\System\vpKHYqO.exe
  C:\Windows\System\vpKHYqO.exe
  2⤵
  PID:11332
- C:\Windows\System\jHedJqx.exe
  C:\Windows\System\jHedJqx.exe
  2⤵
  PID:11360
- C:\Windows\System\LddWsOc.exe
  C:\Windows\System\LddWsOc.exe
  2⤵
  PID:11388
- C:\Windows\System\WfkZmVU.exe
  C:\Windows\System\WfkZmVU.exe
  2⤵
  PID:11416
- C:\Windows\System\ZFQxSgK.exe
  C:\Windows\System\ZFQxSgK.exe
  2⤵
  PID:11444
- C:\Windows\System\XLJVdZt.exe
  C:\Windows\System\XLJVdZt.exe
  2⤵
  PID:11472
- C:\Windows\System\diqhVNi.exe
  C:\Windows\System\diqhVNi.exe
  2⤵
  PID:11500
- C:\Windows\System\wvtDMIp.exe
  C:\Windows\System\wvtDMIp.exe
  2⤵
  PID:11528
- C:\Windows\System\dIULqXo.exe
  C:\Windows\System\dIULqXo.exe
  2⤵
  PID:11556
- C:\Windows\System\JOceWgW.exe
  C:\Windows\System\JOceWgW.exe
  2⤵
  PID:11584
- C:\Windows\System\BIcKUuN.exe
  C:\Windows\System\BIcKUuN.exe
  2⤵
  PID:11612
- C:\Windows\System\dutaOIz.exe
  C:\Windows\System\dutaOIz.exe
  2⤵
  PID:11640
- C:\Windows\System\DhrDaVA.exe
  C:\Windows\System\DhrDaVA.exe
  2⤵
  PID:11668
- C:\Windows\System\MmWzXBk.exe
  C:\Windows\System\MmWzXBk.exe
  2⤵
  PID:11696
- C:\Windows\System\EjBCABE.exe
  C:\Windows\System\EjBCABE.exe
  2⤵
  PID:11724
- C:\Windows\System\ebGKGlH.exe
  C:\Windows\System\ebGKGlH.exe
  2⤵
  PID:11752
- C:\Windows\System\BhwpvdG.exe
  C:\Windows\System\BhwpvdG.exe
  2⤵
  PID:11780
- C:\Windows\System\JiMDauH.exe
  C:\Windows\System\JiMDauH.exe
  2⤵
  PID:11808
- C:\Windows\System\rBJTiMp.exe
  C:\Windows\System\rBJTiMp.exe
  2⤵
  PID:11836
- C:\Windows\System\aTXmOys.exe
  C:\Windows\System\aTXmOys.exe
  2⤵
  PID:11864
- C:\Windows\System\cGXfvzt.exe
  C:\Windows\System\cGXfvzt.exe
  2⤵
  PID:11892
- C:\Windows\System\dCOkekx.exe
  C:\Windows\System\dCOkekx.exe
  2⤵
  PID:11920
- C:\Windows\System\rwuXyyA.exe
  C:\Windows\System\rwuXyyA.exe
  2⤵
  PID:11948
- C:\Windows\System\UlXuVqu.exe
  C:\Windows\System\UlXuVqu.exe
  2⤵
  PID:11976
- C:\Windows\System\AIgDkTM.exe
  C:\Windows\System\AIgDkTM.exe
  2⤵
  PID:12004
- C:\Windows\System\XYGDpls.exe
  C:\Windows\System\XYGDpls.exe
  2⤵
  PID:12032
- C:\Windows\System\zSSrdhs.exe
  C:\Windows\System\zSSrdhs.exe
  2⤵
  PID:12060
- C:\Windows\System\fqKBGUd.exe
  C:\Windows\System\fqKBGUd.exe
  2⤵
  PID:12088
- C:\Windows\System\DFcjDnp.exe
  C:\Windows\System\DFcjDnp.exe
  2⤵
  PID:12116
- C:\Windows\System\HEwkMbg.exe
  C:\Windows\System\HEwkMbg.exe
  2⤵
  PID:12144
- C:\Windows\System\XqPzaET.exe
  C:\Windows\System\XqPzaET.exe
  2⤵
  PID:12172
- C:\Windows\System\PwAREPT.exe
  C:\Windows\System\PwAREPT.exe
  2⤵
  PID:12200
- C:\Windows\System\rfEbVxW.exe
  C:\Windows\System\rfEbVxW.exe
  2⤵
  PID:12228
- C:\Windows\System\QFqsidl.exe
  C:\Windows\System\QFqsidl.exe
  2⤵
  PID:12256
- C:\Windows\System\NXitGWU.exe
  C:\Windows\System\NXitGWU.exe
  2⤵
  PID:12284
- C:\Windows\System\DDIjdMM.exe
  C:\Windows\System\DDIjdMM.exe
  2⤵
  PID:11324
- C:\Windows\System\TMorBeK.exe
  C:\Windows\System\TMorBeK.exe
  2⤵
  PID:11384
- C:\Windows\System\azgrKjk.exe
  C:\Windows\System\azgrKjk.exe
  2⤵
  PID:11440
- C:\Windows\System\Wotfpzh.exe
  C:\Windows\System\Wotfpzh.exe
  2⤵
  PID:11520
- C:\Windows\System\PlcrwuX.exe
  C:\Windows\System\PlcrwuX.exe
  2⤵
  PID:11552
- C:\Windows\System\IksWoXV.exe
  C:\Windows\System\IksWoXV.exe
  2⤵
  PID:11636
- C:\Windows\System\aiaziGR.exe
  C:\Windows\System\aiaziGR.exe
  2⤵
  PID:5040
- C:\Windows\System\jUFmkhw.exe
  C:\Windows\System\jUFmkhw.exe
  2⤵
  PID:11708
- C:\Windows\System\cnQluhT.exe
  C:\Windows\System\cnQluhT.exe
  2⤵
  PID:4404
- C:\Windows\System\nXoGWXG.exe
  C:\Windows\System\nXoGWXG.exe
  2⤵
  PID:11828
- C:\Windows\System\HWDmhTJ.exe
  C:\Windows\System\HWDmhTJ.exe
  2⤵
  PID:11888
- C:\Windows\System\eAhIhrF.exe
  C:\Windows\System\eAhIhrF.exe
  2⤵
  PID:11960
- C:\Windows\System\pTxCrNr.exe
  C:\Windows\System\pTxCrNr.exe
  2⤵
  PID:12024
- C:\Windows\System\sZpSaMa.exe
  C:\Windows\System\sZpSaMa.exe
  2⤵
  PID:12084
- C:\Windows\System\sKzhYCD.exe
  C:\Windows\System\sKzhYCD.exe
  2⤵
  PID:12156
- C:\Windows\System\UAUTHsp.exe
  C:\Windows\System\UAUTHsp.exe
  2⤵
  PID:12224
- C:\Windows\System\OXGBPTR.exe
  C:\Windows\System\OXGBPTR.exe
  2⤵
  PID:12280
- C:\Windows\System\PHpIKxQ.exe
  C:\Windows\System\PHpIKxQ.exe
  2⤵
  PID:11412
- C:\Windows\System\VBlMUQy.exe
  C:\Windows\System\VBlMUQy.exe
  2⤵
  PID:11548
- C:\Windows\System\luDapiH.exe
  C:\Windows\System\luDapiH.exe
  2⤵
  PID:1684
- C:\Windows\System\IanDeiu.exe
  C:\Windows\System\IanDeiu.exe
  2⤵
  PID:11792
- C:\Windows\System\yXSLbMs.exe
  C:\Windows\System\yXSLbMs.exe
  2⤵
  PID:11940
- C:\Windows\System\PfXkXty.exe
  C:\Windows\System\PfXkXty.exe
  2⤵
  PID:12080
- C:\Windows\System\zUhsfEe.exe
  C:\Windows\System\zUhsfEe.exe
  2⤵
  PID:12248
- C:\Windows\System\occtnwd.exe
  C:\Windows\System\occtnwd.exe
  2⤵
  PID:11512
- C:\Windows\System\RNVxJtj.exe
  C:\Windows\System\RNVxJtj.exe
  2⤵
  PID:11764
- C:\Windows\System\dDLZFGs.exe
  C:\Windows\System\dDLZFGs.exe
  2⤵
  PID:12140
- C:\Windows\System\qVRcaer.exe
  C:\Windows\System\qVRcaer.exe
  2⤵
  PID:11744
- C:\Windows\System\jecuift.exe
  C:\Windows\System\jecuift.exe
  2⤵
  PID:2632
- C:\Windows\System\oMbwSfY.exe
  C:\Windows\System\oMbwSfY.exe
  2⤵
  PID:12304
- C:\Windows\System\IhjokLx.exe
  C:\Windows\System\IhjokLx.exe
  2⤵
  PID:12332
- C:\Windows\System\GOBaKIJ.exe
  C:\Windows\System\GOBaKIJ.exe
  2⤵
  PID:12360
- C:\Windows\System\qdIQoor.exe
  C:\Windows\System\qdIQoor.exe
  2⤵
  PID:12388
- C:\Windows\System\hKrOWDf.exe
  C:\Windows\System\hKrOWDf.exe
  2⤵
  PID:12416
- C:\Windows\System\DpjFTFP.exe
  C:\Windows\System\DpjFTFP.exe
  2⤵
  PID:12444
- C:\Windows\System\VHgDlSb.exe
  C:\Windows\System\VHgDlSb.exe
  2⤵
  PID:12472
- C:\Windows\System\Ofugvxd.exe
  C:\Windows\System\Ofugvxd.exe
  2⤵
  PID:12500
- C:\Windows\System\oWrbhRX.exe
  C:\Windows\System\oWrbhRX.exe
  2⤵
  PID:12528
- C:\Windows\System\WvsKoOW.exe
  C:\Windows\System\WvsKoOW.exe
  2⤵
  PID:12556
- C:\Windows\System\eWyBgFO.exe
  C:\Windows\System\eWyBgFO.exe
  2⤵
  PID:12584
- C:\Windows\System\qDlHxdo.exe
  C:\Windows\System\qDlHxdo.exe
  2⤵
  PID:12612
- C:\Windows\System\mkTBbwz.exe
  C:\Windows\System\mkTBbwz.exe
  2⤵
  PID:12640
- C:\Windows\System\ysTInTf.exe
  C:\Windows\System\ysTInTf.exe
  2⤵
  PID:12668
- C:\Windows\System\eeBhSDs.exe
  C:\Windows\System\eeBhSDs.exe
  2⤵
  PID:12696
- C:\Windows\System\UVzxHnp.exe
  C:\Windows\System\UVzxHnp.exe
  2⤵
  PID:12724
- C:\Windows\System\zJfZogS.exe
  C:\Windows\System\zJfZogS.exe
  2⤵
  PID:12752
- C:\Windows\System\hWOcitl.exe
  C:\Windows\System\hWOcitl.exe
  2⤵
  PID:12780
- C:\Windows\System\XLIGUQc.exe
  C:\Windows\System\XLIGUQc.exe
  2⤵
  PID:12804
- C:\Windows\System\duotWAr.exe
  C:\Windows\System\duotWAr.exe
  2⤵
  PID:12836
- C:\Windows\System\YlnEhBS.exe
  C:\Windows\System\YlnEhBS.exe
  2⤵
  PID:12872
- C:\Windows\System\axuTQKs.exe
  C:\Windows\System\axuTQKs.exe
  2⤵
  PID:12900
- C:\Windows\System\aGxoDJN.exe
  C:\Windows\System\aGxoDJN.exe
  2⤵
  PID:12928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h433qv3s.ieh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BkOLtkF.exe

Filesize
3.1MB

MD5
1daa85ead4e86607b24cb1496d33e582

SHA1
a403d33320681d5bbac43c9d503973f06c3d64fe

SHA256
e322de1059bf037aa51dd397e07e8050496fb637851b65671f74cbadd8ee8903

SHA512
4d8f163278f4904f3461d6d6fe3ede6a4d5b939b648418ab4920d2b7eaab6de01c6790907ddafbe2a9df2c89499c15ee7a9f2f6350b3a06c90fb09937d23eb0d

Download Submit
C:\Windows\System\ENkRlvw.exe

Filesize
3.1MB

MD5
e09636e94c2866f522b0085695b3d749

SHA1
df5b4c76ad47c431b0c40825c7f91649bb9fdb92

SHA256
87130bcd0a22f29e69cb5d4a93b89bdda1461cbf11c57dbb34a0decf06071c3f

SHA512
108e0d5afbbd2225c8f6677e943726323bd6d966fc64bf31d8841e921a051210adcddd056fc21883823b68a5ecc572441bd6861eddd90fc66e5ebf3ce39c022a

Download Submit
C:\Windows\System\EqtNXOF.exe

Filesize
3.1MB

MD5
13e515ef5ec53e930a44c6924cf2baaa

SHA1
c972f48f6fa891c8f2399a691f5af6a5c2482b6b

SHA256
76dfac650e43c83e8656c1a691817e29beb123a5d828c9fc1b18cf6f2cb3f27a

SHA512
b6c057b67d1447d0f76743f59294eee685a514c2eedf528428b5fdee481bdb11bafa4dc72bb55778e8668a5c266a8a7a83304a60662e63d3f7c0c0c7f8d9f378

Download Submit
C:\Windows\System\GMlBrxW.exe

Filesize
3.1MB

MD5
593d5491dc72cac061a0df86fd250e20

SHA1
8590141ad8d4e8120755855a9885c40e29d738c5

SHA256
3a945e6be02a34e91ee32ab48fd13ecab981ffbe5227eae04c08f5ac3bc6b06d

SHA512
87f8afac312d6c68eb705e2c127045726ee036665f37885bb81d7d4a1d974fed2a31d76a2d126505df11cc6b65e83684cfe8b85426310ac94d68046d9b8a82c3

Download Submit
C:\Windows\System\GctMpcU.exe

Filesize
3.1MB

MD5
03d510dacbadf9a5f7eee7e1272e8ddf

SHA1
9e2cf1404ce39e63c7746da45e816cdfbeaef33a

SHA256
bc25dcfe6f1c08a79941e6bef8b15bcadd362e301b2a2ac4e8f7d916074df0e6

SHA512
efd06a484c025cbc1a5d0de1f616d0c800119af954c50877915eb3fc89766927cc7ee2c46d1236c357d6cda1dcd2850298c2acf150bc2e62fa4318a1cd810cb0

Download Submit
C:\Windows\System\IWgVMMR.exe

Filesize
3.1MB

MD5
a252436e6c6a986a6705c86463b89e40

SHA1
2762543581c6e3070c6f175a7ca137897ec04578

SHA256
15b794788c56dba540660250a9dfa58c5829cfaffa98023f21aed7fcb7b39fe5

SHA512
949d1a3a01a7324f1c36bf40ec41f5e3f53c85a00e007d41cb4b3a53478384a1a9fc138ccd3cbb21390d8cff6fd35c97d17444f8fa72e04c7d687ba3c3c2ecc6

Download Submit
C:\Windows\System\IkvRdFP.exe

Filesize
3.1MB

MD5
77f42fc7e3b1f861fef6f29bb57933f0

SHA1
d8d0675fc7b72dacbe20372e1ac27f7b49d1f242

SHA256
d4d42062dd3794f7ffe6647e99e606b4ed5129d1798aa423388a2ad1c36d2bd9

SHA512
f6cbedd2bdbe2c0d49c47a09fea587fe76ec6606f37afe5f9291c0889ad0feea290012c922e3612b728c7989516927f566a4c7cfcaca9f21650649627c120510

Download Submit
C:\Windows\System\KZUzVuc.exe

Filesize
3.1MB

MD5
fa6471708782a6a094bbea30fc70b6f6

SHA1
c9cec8f89aa13392e018310f538e6de87a5c50ef

SHA256
ca15bc2d284779c43f08f8fcefc4ac2dc75064370a0673206d0e42a604c9d225

SHA512
b5d2760770619546ec3e67f96d4ec488d06a923e8a65b1432292b28f28b09d1af6cbf7eeac64c2990402c1ebfb8fcc8d7a585de0995bd5f470684d1917271c40

Download Submit
C:\Windows\System\LBExupY.exe

Filesize
8B

MD5
22cacd7d3bd9019903a59ff06bcd8478

SHA1
d1f910928dcd392d84d2992fb865de60e7dfc54b

SHA256
705aa9dd34996e4e385c6f042286c7208120ebc134fa299633cabd108fcaeed4

SHA512
bd865b4e44550de1d3a085a76bb9dfaf94b4d5645b3fb5a24c248b53778403f41b054f3ae1c053cb6f64269ebc7818e8260f30c857e38421c0423c14aefd838d

Download Submit
C:\Windows\System\LfnIOkT.exe

Filesize
3.1MB

MD5
6afbaa2ebba1091bd1ee600bd6638a27

SHA1
c9faec2d010d53ba9ec524662b58752d261d40f5

SHA256
8e768a5af1c75c90f15fc3b9f4fdc189273c345590b38410967b746d8b7cd7ee

SHA512
ccfefe74e37c7f9217e9ac84ab33adc1dc1219f1060df0955b13ecb2d99dd6c89ea25d1e1400283aeda7bcbc8672e73521e2851523bd2572747f2fdd583cc41e

Download Submit
C:\Windows\System\LiLhWJF.exe

Filesize
3.1MB

MD5
55ae1b253d4c4318a39e7675cee99fe8

SHA1
b355de459f3de2601cfe2548acbdea463be63dc9

SHA256
5cd0252e7dc0c77d0a69571aa6b3336570e874bec5b03569edf86b3c48e10394

SHA512
acfb2390b429bd7def49ea1c8aecac4f401d2cd99ddbc18d7d6f7dd01d63dc9dd8642e858f21ce5e91feff9e0f3ffb11c76d6b6720935e1d02ff2e1f5893b6d9

Download Submit
C:\Windows\System\MUTkTMI.exe

Filesize
3.1MB

MD5
a8700aee10a7929f822502ac446c074f

SHA1
20e5df3fc637756cb82c2e130e7d6c615b4f14fe

SHA256
a9afaa2ec88875ab7347625b9efad2dd8da2aca307675b7f3bacea8d18805e23

SHA512
c35d26250a2ea19cc6ebc065185a09554a8c8411b446be21d4ed8c2aa57dce88570617bc3e8ff201c05163fef93e24c4d780f10819dd7f4136d59d213a8a77cc

Download Submit
C:\Windows\System\MjyjXBA.exe

Filesize
3.1MB

MD5
a984299b68126d80f5ae48dfd6f2b6d6

SHA1
6aa8329a5a945b29329e58c79160c83f18c90481

SHA256
e7122b437273d7e1884bae0129f5ad21ce554e71459a0d382098c45c9265778e

SHA512
2fe64a7afc7f6f92883586c4a4fb5e7c007a5a244112e44d8fb4799a8a1f32188d317b2163b7d153f72edb03be360483d68fa2febc88fb4c98d595fa23e0e619

Download Submit
C:\Windows\System\Ogkbjbm.exe

Filesize
3.1MB

MD5
b0bc40f6609dd145cfc29ffa436feffb

SHA1
6da0ece74a9aee59becb079c251ac77d222d2328

SHA256
1b7744b95c02af5da2f322fc10660fcbdd62f031ea0d2a311b3b13abc141be70

SHA512
a632c6c8d51ffe8cf0c4c5a2ece4448225fa8ac2e9c8f79c536c721a8f8b16efae1d0bcbbffd9f24d9f318bf3291ab4aafe3309079ba658abd1e9c69108fe08a

Download Submit
C:\Windows\System\PfCVrYM.exe

Filesize
3.1MB

MD5
f00c25948c9cf88b19bb3d97f7265ee7

SHA1
02b00830b67ee566577e67fdc5f19cb57b2f1087

SHA256
4dd553918c3b3aff92325bb17586e1583a413d588526956043e57a4b9ce0fcc3

SHA512
1ee37e86c6486858ac160b9e3dc51d8bec4533c19c45c8bb4edc1dd1ab64e8b8376712189baa52083e335673bb7cf8f6ad137096793fcdfa907191b7d899f932

Download Submit
C:\Windows\System\QCIEwuj.exe

Filesize
3.1MB

MD5
bd06f739a95fa478ca2d8ecdd18cdeba

SHA1
1747f05d8f5a0fff112ba63fd569b2f09bd8461e

SHA256
2bda7d542975cc16054af2c257c134b6f9ee461b1d228a7c05ffdee88d50d410

SHA512
2ec8c68a029cd9fbf837a8fbcdbd5016899028707a27e5265b8ce34194d7d11bc1e3095ff8da9a802ade176077951e6f1618a6f29465fece3d55b6044b8a7cbd

Download Submit
C:\Windows\System\QtcGmIS.exe

Filesize
3.1MB

MD5
029c4766efed0b749c534395362a474c

SHA1
a7f21efcf26d7896abb48c5966bfe4133636ad69

SHA256
e80329bae10a1a194f67a3d9ec44a49eba8df5d725cf05ba84350df01c223a13

SHA512
a7286ef7ef06d5ea881518ae2145e82ff5dad1e82b701f52f805a864defb07d364b92ee9673ef1ad5240ef6a764ca687f1795200c3496f5168473130b6f16d70

Download Submit
C:\Windows\System\RTNagbh.exe

Filesize
3.1MB

MD5
18cef062d3a5d634371f966a9cc04ad3

SHA1
152445877d0c280b760c9d6832d4c44aca566b42

SHA256
324fa0f1948375df5fd1e5ad9599eac8d1d2ef1ab4f1b4a33b252330f97bdc42

SHA512
6d4c246a632437f99f9b4c0c4b62f062d43069a2d611234f4f046ff43a2cf116ad7b13215e9d3def5071bbd878054b4d74827222efa39407b46dfcbeb744cdc1

Download Submit
C:\Windows\System\RrsSslT.exe

Filesize
3.1MB

MD5
90abcbbf75c8202db3cd2c7c083608a9

SHA1
48e9e7611d2ad16e16c3e3244f6068a172bf861a

SHA256
7d23e7cfb180a0a3a26db4f482b7a35845ba74e4bb9f2b3321af59afba032fd6

SHA512
093c9bca0b0c9414ae8986dedbab1aad3f99b95f46189ea15dffc84e7258d21c791c1f7dfdfaacebc91f580c34dcecb2b23f5100f69de0d0d82f0bbed5bd2676

Download Submit
C:\Windows\System\TpHaqWN.exe

Filesize
3.1MB

MD5
d51f1eea5bc0151cdd3565438880a4a2

SHA1
b2716d67a246427b4b5629a82dc3b500ca7874ae

SHA256
1e8162820d1e27d34f927b4183f23c18d7c188c9a7c6848e50837887db02d0dd

SHA512
90a8768c8d3d40a674b4ef65f648298faf54f9d9514fe3dff4bdd9e965891a907dc952b004785dcdfcbf0046bf8b643c9c39580b3e2e99cf8b95815515b9ed70

Download Submit
C:\Windows\System\TvZTaIj.exe

Filesize
3.1MB

MD5
710b5272e129c855c3b3f94831995f58

SHA1
0daaa2ee69c81c103fb58febfd2e1c1f7988e22c

SHA256
2e2238edfffcf235719687002efb1fe389971c0516788fa58f1919ef7af6b756

SHA512
02b03ccfe88b9c41872d7dc8d00257950a637bab3e763ae15debead4300e49d10cb1a3fb83a037e27bc5c077ed3f3da147bf2278e5acf1d5ee226e4edc07a341

Download Submit
C:\Windows\System\WMLWNOw.exe

Filesize
3.1MB

MD5
a41124880d313e73fe1098d9708fcf57

SHA1
7fe8e8afe61d719644219d31ef2fa18b4bb8b9be

SHA256
491d1849bcfd0e574130336d288b89f8085d2039d47ad09f65308872d29a4aef

SHA512
89c51aa70b840b9703759001e744d9c2f93526d2e7e8ed96a75c310ae3bf3f4829d3765c61164ac8d7093206a145791e6b56c586b8290f279e33c1a8b29e6e49

Download Submit
C:\Windows\System\WdUypfV.exe

Filesize
3.1MB

MD5
a3fa5c8a6f159624fd93517c4e83354f

SHA1
4014a2fe874454c11c1d425e0655b1d2659e09cf

SHA256
0cffec2cf33a2173946c2a3d2fd81dea6ce0811db07cd06e2be776e5d1de12c3

SHA512
43cf6bbc0da8904c86f89b18d0f50588a572c71cad2a0f6e39d90410102fb5cbb7ba14dc5c3c951e6da0fa8de476522aed7f8eae268780ceece2d3c1369bb954

Download Submit
C:\Windows\System\WzhETPI.exe

Filesize
3.1MB

MD5
27d88638a65d52fc0b9814709b44af64

SHA1
25ee33c9bac37c1ae9f6108f9bd5a78cf4cbddba

SHA256
1f48fb1d0d836553cf72fd1191c06a5addc88a51c961e3e0f30517efa0fd6f3f

SHA512
12d563b558607b1bb892546fd4cd8f720b3d0ce9e8fac089548511bf34a9d056992986433142e8a3493695d00d99562d5dd095f857257b3615efe3d077226e17

Download Submit
C:\Windows\System\XmDVlje.exe

Filesize
3.1MB

MD5
aed9c8e94f90be8bc20bc6827057a7d0

SHA1
fbed9abea4c1a4dc3505137a99db8cd3ba3c696c

SHA256
15280cbbb55ab3054d595394968632835e05c13d980f5dbad3ef2b610e11fc2e

SHA512
a1ee8a056e1c8e4219cb34874708e7f8aa314cc18b9b653c60b4ceba110792836be9215328a7477974602f28d3101c6e03fe57d5dd2f4d2e09e5618c454ee889

Download Submit
C:\Windows\System\YIbcKgp.exe

Filesize
3.1MB

MD5
3ebdefd6344c0e931c9b66b9cd1c3c71

SHA1
d22601d55f31da4e9a31dd76b65a45022208fbad

SHA256
a14983e35777ec781e8860c507c0a50e81d350d4285cb55b3945d38c0d334148

SHA512
7cbb8c2eac79e966813336142555be5e809db43105b36e0dd78f4cd553473f3c4df440b4cee848fa9604b676a2d496405c970dc937811f8e891bcfdb92e5eb9f

Download Submit
C:\Windows\System\YLvQBcq.exe

Filesize
3.1MB

MD5
5397fb45e790c6632c28eddef168cb38

SHA1
80a360d5d999379dd86a2d053927424c79a8e972

SHA256
e63dacf68e54bfb39335ac79fb24f91953590ab3e5fbd9177106e4c9056dfe29

SHA512
b2455fcf56486395d47d48ea956f009f1e84688688558775929914104a7d47c2c59bab2f76c9f610bfef6844234e0bf22e40bb480567f2ce1024f8375342341d

Download Submit
C:\Windows\System\ZTjkyjW.exe

Filesize
3.1MB

MD5
a1e33d96527f8f47ba1b7340c43923ed

SHA1
e382dc37585512c42ff1df6197e8e86a6448889d

SHA256
b584c0a453e2cbfcc3049c92010542ef10c720481dd9df154e9a3292dd3182d3

SHA512
1025ff7bc9d17fade9bd083c4fe191b7fdcd7c2c8c3c15e7bcb07baee183f69c20f8822b653f5ac6521d279e90d2d730b8385c7689d4b126e8cb9755276fb2eb

Download Submit
C:\Windows\System\bMeHVZn.exe

Filesize
3.1MB

MD5
d3f2ff7bee21ecf56ce595ad4238c014

SHA1
40e9dba2494580d431061b96d4361cdd1315cb1e

SHA256
cb564e6f60ddfc59911cf19ae6bd6c108a498210715454464b8c7a82723a46cc

SHA512
bf842405aae6126da1d972c15abcc196193d35914be861c7f7d58fb6a75e707b4eded7fb7b680892e8848010bead2f23539d648e79f7aa10c6ea7a3d0c3360f2

Download Submit
C:\Windows\System\bgiuIuw.exe

Filesize
3.1MB

MD5
3171958b9f4c501bd63b12f098fea98a

SHA1
ad9dec1ab9155313c19b974430ff7506c7787379

SHA256
206e7427961e2f9072c79843e23fbf297c9e4671e4c6e04639f5df051527015d

SHA512
8a16bb6b1ea8ddbce79fe36dcc4499da2053c64ae1c6801257f4f8ed2484eaf3228aa1b23144b6661816c817a159250121186a28ba70982c9951cb5d937d9721

Download Submit
C:\Windows\System\hewFWkR.exe

Filesize
3.1MB

MD5
29a925104be9ced20167ffa2fc5ae6fa

SHA1
13dd0549f3255f6b3ab76667467178f62a84c1eb

SHA256
6a2b7ce4301382f38855037f456aa6018e2b7c5a27197aa2d1c8842df84d1167

SHA512
158dad90f2e17d166b96cb71da4b04f1cc0c12bd104faf4b5cc5baf942f80d8032f8f272442d632e16130f8815956cbbf593c0803f46f914c293f399acd650d6

Download Submit
C:\Windows\System\iXBxVHR.exe

Filesize
3.1MB

MD5
cc4cc844be6e34ac4f8a5f41d14d211d

SHA1
46e941faaa31ea666e9a45a00d0f40851c00bd88

SHA256
53c72076d7a64327d14d151f9ea5c48eb8ea4d6f697cb213d67e48343c16ef7c

SHA512
90f0a3a61e4549524d9c6a07e647892f06c4926946f9d4f8c054b1f0a437141f07ba04af5c2bfaa033cc4f8c52d711f6269ccdf754717b5be32169aa54989036

Download Submit
C:\Windows\System\ineTURz.exe

Filesize
3.1MB

MD5
8ea5a32d06931e921da2442e7ea31101

SHA1
a031bd237d2a2411791eaf1c1361b3467a00bbc2

SHA256
81387e63ab7b9829966b07bb2ee542f259d0cab012ba5741b154a81a8d62e114

SHA512
0256b20c7e5b67cd031bac5619332a02f65c4df4cacf388c10095c9d69c5aaa8f2619d5c2d7f5a9957b4e85faf165ffdc49fe1f65e6bc8a5724d270550e7f351

Download Submit
C:\Windows\System\qlsJuAa.exe

Filesize
3.1MB

MD5
a59143ebbc853aaa1646987698a4749d

SHA1
b8c1b6a035990863f844bfa8952dc1359b2bd1dc

SHA256
e12afdadd65ad7a5edbe31f95ff1787e484f9e93dae9185af1b2b191d7fee37b

SHA512
42ab2c8002d228e1a7f66849f24a23103aac052140b4d1325068aba2d994fa1fecbe31a4ee3d33ce77521c01e0ca6495c39f1c59f783a1d489ff987586909081

Download Submit
C:\Windows\System\zUlYUNX.exe

Filesize
3.1MB

MD5
6ccd1eec005999d4a975b2eae3316194

SHA1
7af8c84c24f1bbdf50082c44e33be362406610a7

SHA256
6b39914fe27b3f3ff64ea256ac6ab4486a05fa0599de45f436fbd03fbc866a7b

SHA512
7542d29f2f47401c32e75fe8be124a205eb298de72abd7cb139c3c86379a108f7cb7fdbff91a595cb09475088bd49bce9c2dd8415f59da905ae80cbd7bac8ad3

Download Submit
memory/464-2208-0x00007FF6B9A60000-0x00007FF6B9E56000-memory.dmp

Filesize
4.0MB

Download
memory/464-2215-0x00007FF6B9A60000-0x00007FF6B9E56000-memory.dmp

Filesize
4.0MB

Download
memory/464-19-0x00007FF6B9A60000-0x00007FF6B9E56000-memory.dmp

Filesize
4.0MB

Download
memory/1152-224-0x00007FF7BB720000-0x00007FF7BBB16000-memory.dmp

Filesize
4.0MB

Download
memory/1152-2222-0x00007FF7BB720000-0x00007FF7BBB16000-memory.dmp

Filesize
4.0MB

Download
memory/1384-90-0x00007FF605400000-0x00007FF6057F6000-memory.dmp

Filesize
4.0MB

Download
memory/1384-2221-0x00007FF605400000-0x00007FF6057F6000-memory.dmp

Filesize
4.0MB

Download
memory/1580-2228-0x00007FF60C030000-0x00007FF60C426000-memory.dmp

Filesize
4.0MB

Download
memory/1580-103-0x00007FF60C030000-0x00007FF60C426000-memory.dmp

Filesize
4.0MB

Download
memory/1588-2214-0x00007FF6B32E0000-0x00007FF6B36D6000-memory.dmp

Filesize
4.0MB

Download
memory/1588-2216-0x00007FF6B32E0000-0x00007FF6B36D6000-memory.dmp

Filesize
4.0MB

Download
memory/1588-21-0x00007FF6B32E0000-0x00007FF6B36D6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-35-0x00007FF7251D0000-0x00007FF7255C6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-2219-0x00007FF7251D0000-0x00007FF7255C6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-2209-0x00007FF7251D0000-0x00007FF7255C6000-memory.dmp

Filesize
4.0MB

Download
memory/2392-2223-0x00007FF6A34D0000-0x00007FF6A38C6000-memory.dmp

Filesize
4.0MB

Download
memory/2392-208-0x00007FF6A34D0000-0x00007FF6A38C6000-memory.dmp

Filesize
4.0MB

Download
memory/2488-2232-0x00007FF6134F0000-0x00007FF6138E6000-memory.dmp

Filesize
4.0MB

Download
memory/2488-168-0x00007FF6134F0000-0x00007FF6138E6000-memory.dmp

Filesize
4.0MB

Download
memory/2660-215-0x00007FF798740000-0x00007FF798B36000-memory.dmp

Filesize
4.0MB

Download
memory/2660-2220-0x00007FF798740000-0x00007FF798B36000-memory.dmp

Filesize
4.0MB

Download
memory/2792-2229-0x00007FF6B0240000-0x00007FF6B0636000-memory.dmp

Filesize
4.0MB

Download
memory/2792-184-0x00007FF6B0240000-0x00007FF6B0636000-memory.dmp

Filesize
4.0MB

Download
memory/2900-2233-0x00007FF6B98E0000-0x00007FF6B9CD6000-memory.dmp

Filesize
4.0MB

Download
memory/2900-180-0x00007FF6B98E0000-0x00007FF6B9CD6000-memory.dmp

Filesize
4.0MB

Download
memory/2996-167-0x00007FF79F840000-0x00007FF79FC36000-memory.dmp

Filesize
4.0MB

Download
memory/2996-2230-0x00007FF79F840000-0x00007FF79FC36000-memory.dmp

Filesize
4.0MB

Download
memory/3128-242-0x000001E470780000-0x000001E470F26000-memory.dmp

Filesize
7.6MB

Download
memory/3128-213-0x000001E46FAA0000-0x000001E46FAC2000-memory.dmp

Filesize
136KB

Download
memory/3172-189-0x00007FF6A1E40000-0x00007FF6A2236000-memory.dmp

Filesize
4.0MB

Download
memory/3172-2217-0x00007FF6A1E40000-0x00007FF6A2236000-memory.dmp

Filesize
4.0MB

Download
memory/3224-2237-0x00007FF62AF00000-0x00007FF62B2F6000-memory.dmp

Filesize
4.0MB

Download
memory/3224-185-0x00007FF62AF00000-0x00007FF62B2F6000-memory.dmp

Filesize
4.0MB

Download
memory/3608-56-0x00007FF6CA960000-0x00007FF6CAD56000-memory.dmp

Filesize
4.0MB

Download
memory/3608-2211-0x00007FF6CA960000-0x00007FF6CAD56000-memory.dmp

Filesize
4.0MB

Download
memory/3608-2224-0x00007FF6CA960000-0x00007FF6CAD56000-memory.dmp

Filesize
4.0MB

Download
memory/3908-2213-0x00007FF7E8730000-0x00007FF7E8B26000-memory.dmp

Filesize
4.0MB

Download
memory/3908-2234-0x00007FF7E8730000-0x00007FF7E8B26000-memory.dmp

Filesize
4.0MB

Download
memory/3908-120-0x00007FF7E8730000-0x00007FF7E8B26000-memory.dmp

Filesize
4.0MB

Download
memory/4340-2227-0x00007FF7B1470000-0x00007FF7B1866000-memory.dmp

Filesize
4.0MB

Download
memory/4340-2210-0x00007FF7B1470000-0x00007FF7B1866000-memory.dmp

Filesize
4.0MB

Download
memory/4340-48-0x00007FF7B1470000-0x00007FF7B1866000-memory.dmp

Filesize
4.0MB

Download
memory/4488-2238-0x00007FF6DBD20000-0x00007FF6DC116000-memory.dmp

Filesize
4.0MB

Download
memory/4488-240-0x00007FF6DBD20000-0x00007FF6DC116000-memory.dmp

Filesize
4.0MB

Download
memory/4788-2225-0x00007FF66B4F0000-0x00007FF66B8E6000-memory.dmp

Filesize
4.0MB

Download
memory/4788-225-0x00007FF66B4F0000-0x00007FF66B8E6000-memory.dmp

Filesize
4.0MB

Download
memory/4816-2218-0x00007FF6C3800000-0x00007FF6C3BF6000-memory.dmp

Filesize
4.0MB

Download
memory/4816-86-0x00007FF6C3800000-0x00007FF6C3BF6000-memory.dmp

Filesize
4.0MB

Download
memory/4836-2231-0x00007FF75B440000-0x00007FF75B836000-memory.dmp

Filesize
4.0MB

Download
memory/4836-241-0x00007FF75B440000-0x00007FF75B836000-memory.dmp

Filesize
4.0MB

Download
memory/4928-60-0x00007FF667A10000-0x00007FF667E06000-memory.dmp

Filesize
4.0MB

Download
memory/4928-2226-0x00007FF667A10000-0x00007FF667E06000-memory.dmp

Filesize
4.0MB

Download
memory/4928-2212-0x00007FF667A10000-0x00007FF667E06000-memory.dmp

Filesize
4.0MB

Download
memory/5060-2235-0x00007FF6F5750000-0x00007FF6F5B46000-memory.dmp

Filesize
4.0MB

Download
memory/5060-238-0x00007FF6F5750000-0x00007FF6F5B46000-memory.dmp

Filesize
4.0MB

Download
memory/5088-0-0x00007FF6372B0000-0x00007FF6376A6000-memory.dmp

Filesize
4.0MB

Download
memory/5088-1-0x0000022F66830000-0x0000022F66840000-memory.dmp

Filesize
64KB

Download
memory/5092-165-0x00007FF742B50000-0x00007FF742F46000-memory.dmp

Filesize
4.0MB

Download
memory/5092-2236-0x00007FF742B50000-0x00007FF742F46000-memory.dmp

Filesize
4.0MB

Download