xmrig | 4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035

Analysis

max time kernel
91s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
Size

3.1MB
MD5

3761e2cd3eb61af40442bc4eb1d23fc1
SHA1

6a5ff3b74b8c3689495b8b66425abb254e8e7b51
SHA256

4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035
SHA512

caafae185d0b0c1a2ea2801c92246a4f27601ba18e0171a452fc38c1d6874448fcdd0adc6b70ccc2c0a3b326e76f8f2cf7d87ee33da5183f7e4bfb16270b5405
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW2:7bBeSFky

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3992-0-0x00007FF7F5CD0000-0x00007FF7F60C6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023460-5.dat	xmrig
behavioral2/files/0x0007000000023468-22.dat	xmrig
behavioral2/files/0x000700000002346a-27.dat	xmrig
behavioral2/files/0x0007000000023467-31.dat	xmrig
behavioral2/files/0x0007000000023473-86.dat	xmrig
behavioral2/files/0x0007000000023470-105.dat	xmrig
behavioral2/files/0x0007000000023474-122.dat	xmrig
behavioral2/memory/652-134-0x00007FF68A7A0000-0x00007FF68AB96000-memory.dmp	xmrig
behavioral2/memory/2268-154-0x00007FF7A5890000-0x00007FF7A5C86000-memory.dmp	xmrig
behavioral2/files/0x0007000000023481-168.dat	xmrig
behavioral2/memory/4088-172-0x00007FF704E70000-0x00007FF705266000-memory.dmp	xmrig
behavioral2/memory/4972-177-0x00007FF6A9010000-0x00007FF6A9406000-memory.dmp	xmrig
behavioral2/memory/4764-182-0x00007FF627940000-0x00007FF627D36000-memory.dmp	xmrig
behavioral2/memory/4792-184-0x00007FF6B8140000-0x00007FF6B8536000-memory.dmp	xmrig
behavioral2/memory/2184-183-0x00007FF6075C0000-0x00007FF6079B6000-memory.dmp	xmrig
behavioral2/memory/3220-181-0x00007FF7AE670000-0x00007FF7AEA66000-memory.dmp	xmrig
behavioral2/memory/4808-180-0x00007FF72A300000-0x00007FF72A6F6000-memory.dmp	xmrig
behavioral2/memory/440-179-0x00007FF73F4F0000-0x00007FF73F8E6000-memory.dmp	xmrig
behavioral2/memory/4984-178-0x00007FF673790000-0x00007FF673B86000-memory.dmp	xmrig
behavioral2/memory/2744-176-0x00007FF7F1740000-0x00007FF7F1B36000-memory.dmp	xmrig
behavioral2/memory/224-175-0x00007FF6EC750000-0x00007FF6ECB46000-memory.dmp	xmrig
behavioral2/memory/4452-174-0x00007FF652660000-0x00007FF652A56000-memory.dmp	xmrig
behavioral2/memory/4444-173-0x00007FF6307E0000-0x00007FF630BD6000-memory.dmp	xmrig
behavioral2/memory/868-171-0x00007FF704570000-0x00007FF704966000-memory.dmp	xmrig
behavioral2/memory/2364-170-0x00007FF7B7AC0000-0x00007FF7B7EB6000-memory.dmp	xmrig
behavioral2/memory/1760-167-0x00007FF7C8A50000-0x00007FF7C8E46000-memory.dmp	xmrig
behavioral2/files/0x000700000002347d-165.dat	xmrig
behavioral2/files/0x000700000002347f-163.dat	xmrig
behavioral2/files/0x000700000002347e-161.dat	xmrig
behavioral2/files/0x0007000000023480-159.dat	xmrig
behavioral2/memory/1468-158-0x00007FF6B43D0000-0x00007FF6B47C6000-memory.dmp	xmrig
behavioral2/memory/1996-157-0x00007FF606D00000-0x00007FF6070F6000-memory.dmp	xmrig
behavioral2/files/0x000700000002347a-147.dat	xmrig
behavioral2/files/0x0008000000023464-142.dat	xmrig
behavioral2/files/0x0008000000023476-141.dat	xmrig
behavioral2/files/0x000700000002347b-139.dat	xmrig
behavioral2/files/0x0007000000023479-136.dat	xmrig
behavioral2/files/0x0007000000023478-129.dat	xmrig
behavioral2/files/0x0007000000023477-124.dat	xmrig
behavioral2/memory/4268-118-0x00007FF614E00000-0x00007FF6151F6000-memory.dmp	xmrig
behavioral2/files/0x000700000002347c-116.dat	xmrig
behavioral2/memory/460-114-0x00007FF697850000-0x00007FF697C46000-memory.dmp	xmrig
behavioral2/files/0x0007000000023471-111.dat	xmrig
behavioral2/files/0x0007000000023472-108.dat	xmrig
behavioral2/files/0x000700000002346f-101.dat	xmrig
behavioral2/memory/1908-97-0x00007FF66C3E0000-0x00007FF66C7D6000-memory.dmp	xmrig
behavioral2/files/0x000700000002346e-87.dat	xmrig
behavioral2/files/0x000700000002346d-79.dat	xmrig
behavioral2/files/0x000700000002346c-53.dat	xmrig
behavioral2/files/0x000700000002346b-39.dat	xmrig
behavioral2/files/0x0007000000023469-34.dat	xmrig
behavioral2/memory/3140-17-0x00007FF683C80000-0x00007FF684076000-memory.dmp	xmrig
behavioral2/files/0x0008000000023466-13.dat	xmrig
behavioral2/files/0x0008000000023475-292.dat	xmrig
behavioral2/files/0x00070000000234a4-299.dat	xmrig
behavioral2/files/0x00070000000234a6-311.dat	xmrig
behavioral2/files/0x00070000000234a5-308.dat	xmrig
behavioral2/memory/3140-2103-0x00007FF683C80000-0x00007FF684076000-memory.dmp	xmrig
behavioral2/memory/4984-2104-0x00007FF673790000-0x00007FF673B86000-memory.dmp	xmrig
behavioral2/memory/1908-2105-0x00007FF66C3E0000-0x00007FF66C7D6000-memory.dmp	xmrig
behavioral2/memory/440-2106-0x00007FF73F4F0000-0x00007FF73F8E6000-memory.dmp	xmrig
behavioral2/memory/460-2107-0x00007FF697850000-0x00007FF697C46000-memory.dmp	xmrig
behavioral2/memory/652-2108-0x00007FF68A7A0000-0x00007FF68AB96000-memory.dmp	xmrig

Blocklisted process makes network request 10 IoCs

flow	pid	Process
3	4576	powershell.exe
5	4576	powershell.exe
7	4576	powershell.exe
8	4576	powershell.exe
10	4576	powershell.exe
11	4576	powershell.exe
13	4576	powershell.exe
20	4576	powershell.exe
21	4576	powershell.exe
22	4576	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4576	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3140	jnBaQyF.exe
4984	EAYtTDr.exe
440	DjaosrU.exe
1908	pAqLdXE.exe
460	oRxZPZI.exe
4268	cAcqJWW.exe
652	IFzaZej.exe
2268	vTDAgDX.exe
1996	hInKVlm.exe
4808	wngSCHl.exe
1468	GuorHrK.exe
1760	VrbaJia.exe
3220	AtFomUd.exe
2364	qWLFscj.exe
868	XVkIJtF.exe
4088	vlfdsDd.exe
4444	vEILjpe.exe
4452	qWQUpAX.exe
224	dkHUjuu.exe
4764	xDcAdts.exe
2744	SMTAfxB.exe
4972	pLwZkmH.exe
2184	dPezLkc.exe
4792	VUfSAGb.exe
1128	BLtfwdh.exe
4572	sHgCZOy.exe
3144	SRUGZDG.exe
4472	IMXFHNP.exe
4496	GeQPYqv.exe
3020	szbDKhX.exe
3872	IDSGFub.exe
1604	mMIKPmu.exe
3212	QFBVXfp.exe
3064	RrsSrym.exe
4580	BBMehsQ.exe
452	AQAiinq.exe
3604	vFMMpUk.exe
1048	GZagqcl.exe
4716	cflqVGL.exe
2024	vRuxCdp.exe
1204	qCfiRxc.exe
3188	qJcVmAT.exe
1076	yYTBDdm.exe
2588	lUuxUWi.exe
3776	aGkwbDA.exe
4828	ytdZFko.exe
4508	UMvRmXc.exe
4632	eDhICqX.exe
4120	kGzLjSL.exe
3680	ohbeQOu.exe
1896	VExUoMN.exe
936	EoXEaOM.exe
4836	SfxSjKW.exe
3500	oHQGdib.exe
3388	GWMNLlf.exe
2072	MTtVPXn.exe
3196	UDObFXF.exe
4900	BZARZkM.exe
4968	uiSsPAD.exe
4656	RGCmeiC.exe
4112	fkiYOfs.exe
4932	RuBpIAT.exe
4664	KrSrGbR.exe
4860	DDVmyct.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3992-0-0x00007FF7F5CD0000-0x00007FF7F60C6000-memory.dmp	upx
behavioral2/files/0x0008000000023460-5.dat	upx
behavioral2/files/0x0007000000023468-22.dat	upx
behavioral2/files/0x000700000002346a-27.dat	upx
behavioral2/files/0x0007000000023467-31.dat	upx
behavioral2/files/0x0007000000023473-86.dat	upx
behavioral2/files/0x0007000000023470-105.dat	upx
behavioral2/files/0x0007000000023474-122.dat	upx
behavioral2/memory/652-134-0x00007FF68A7A0000-0x00007FF68AB96000-memory.dmp	upx
behavioral2/memory/2268-154-0x00007FF7A5890000-0x00007FF7A5C86000-memory.dmp	upx
behavioral2/files/0x0007000000023481-168.dat	upx
behavioral2/memory/4088-172-0x00007FF704E70000-0x00007FF705266000-memory.dmp	upx
behavioral2/memory/4972-177-0x00007FF6A9010000-0x00007FF6A9406000-memory.dmp	upx
behavioral2/memory/4764-182-0x00007FF627940000-0x00007FF627D36000-memory.dmp	upx
behavioral2/memory/4792-184-0x00007FF6B8140000-0x00007FF6B8536000-memory.dmp	upx
behavioral2/memory/2184-183-0x00007FF6075C0000-0x00007FF6079B6000-memory.dmp	upx
behavioral2/memory/3220-181-0x00007FF7AE670000-0x00007FF7AEA66000-memory.dmp	upx
behavioral2/memory/4808-180-0x00007FF72A300000-0x00007FF72A6F6000-memory.dmp	upx
behavioral2/memory/440-179-0x00007FF73F4F0000-0x00007FF73F8E6000-memory.dmp	upx
behavioral2/memory/4984-178-0x00007FF673790000-0x00007FF673B86000-memory.dmp	upx
behavioral2/memory/2744-176-0x00007FF7F1740000-0x00007FF7F1B36000-memory.dmp	upx
behavioral2/memory/224-175-0x00007FF6EC750000-0x00007FF6ECB46000-memory.dmp	upx
behavioral2/memory/4452-174-0x00007FF652660000-0x00007FF652A56000-memory.dmp	upx
behavioral2/memory/4444-173-0x00007FF6307E0000-0x00007FF630BD6000-memory.dmp	upx
behavioral2/memory/868-171-0x00007FF704570000-0x00007FF704966000-memory.dmp	upx
behavioral2/memory/2364-170-0x00007FF7B7AC0000-0x00007FF7B7EB6000-memory.dmp	upx
behavioral2/memory/1760-167-0x00007FF7C8A50000-0x00007FF7C8E46000-memory.dmp	upx
behavioral2/files/0x000700000002347d-165.dat	upx
behavioral2/files/0x000700000002347f-163.dat	upx
behavioral2/files/0x000700000002347e-161.dat	upx
behavioral2/files/0x0007000000023480-159.dat	upx
behavioral2/memory/1468-158-0x00007FF6B43D0000-0x00007FF6B47C6000-memory.dmp	upx
behavioral2/memory/1996-157-0x00007FF606D00000-0x00007FF6070F6000-memory.dmp	upx
behavioral2/files/0x000700000002347a-147.dat	upx
behavioral2/files/0x0008000000023464-142.dat	upx
behavioral2/files/0x0008000000023476-141.dat	upx
behavioral2/files/0x000700000002347b-139.dat	upx
behavioral2/files/0x0007000000023479-136.dat	upx
behavioral2/files/0x0007000000023478-129.dat	upx
behavioral2/files/0x0007000000023477-124.dat	upx
behavioral2/memory/4268-118-0x00007FF614E00000-0x00007FF6151F6000-memory.dmp	upx
behavioral2/files/0x000700000002347c-116.dat	upx
behavioral2/memory/460-114-0x00007FF697850000-0x00007FF697C46000-memory.dmp	upx
behavioral2/files/0x0007000000023471-111.dat	upx
behavioral2/files/0x0007000000023472-108.dat	upx
behavioral2/files/0x000700000002346f-101.dat	upx
behavioral2/memory/1908-97-0x00007FF66C3E0000-0x00007FF66C7D6000-memory.dmp	upx
behavioral2/files/0x000700000002346e-87.dat	upx
behavioral2/files/0x000700000002346d-79.dat	upx
behavioral2/files/0x000700000002346c-53.dat	upx
behavioral2/files/0x000700000002346b-39.dat	upx
behavioral2/files/0x0007000000023469-34.dat	upx
behavioral2/memory/3140-17-0x00007FF683C80000-0x00007FF684076000-memory.dmp	upx
behavioral2/files/0x0008000000023466-13.dat	upx
behavioral2/files/0x0008000000023475-292.dat	upx
behavioral2/files/0x00070000000234a4-299.dat	upx
behavioral2/files/0x00070000000234a6-311.dat	upx
behavioral2/files/0x00070000000234a5-308.dat	upx
behavioral2/memory/3140-2103-0x00007FF683C80000-0x00007FF684076000-memory.dmp	upx
behavioral2/memory/4984-2104-0x00007FF673790000-0x00007FF673B86000-memory.dmp	upx
behavioral2/memory/1908-2105-0x00007FF66C3E0000-0x00007FF66C7D6000-memory.dmp	upx
behavioral2/memory/440-2106-0x00007FF73F4F0000-0x00007FF73F8E6000-memory.dmp	upx
behavioral2/memory/460-2107-0x00007FF697850000-0x00007FF697C46000-memory.dmp	upx
behavioral2/memory/652-2108-0x00007FF68A7A0000-0x00007FF68AB96000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yGLhJlx.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\XOfbGmn.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\RBqgkeO.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\bRUJvZz.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\gZpoLxA.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\RGCmeiC.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\pgSTSEV.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\MwHKKvS.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\eYyTzQy.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\rFVChRb.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\GOUEtid.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\SYQRWTu.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\vFMMpUk.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\VBTqoPj.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\ElDCtba.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\tKxJRqT.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\cJfVNHw.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\InAzsTV.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\SnoNFwO.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\yCHDbcU.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\cAcqJWW.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\AQAiinq.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\wgvVjGl.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\lvQnXUD.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\jAgsiVY.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\IIupMjO.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\wQLcNRV.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\keJdILp.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\DuOrigX.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\zwYzyEL.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\qhPwxFw.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\PcTHkxL.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\oeCxqoo.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\Shzelwl.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\wcufIfW.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\XNEDlIi.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\wPnLnxQ.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\hhzbVcB.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\joFbyXf.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\rlnCODh.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\doFczER.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\DJOxOGY.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\dkpLxPo.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\QgQsiuM.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\WhcLgqc.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\SKvOTmS.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\TFLEfls.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\lIEkGfq.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\siJjKRd.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\dAmADCH.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\MyXxBXk.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\PDaizAW.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\Pyofdjf.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\lVoqyfw.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\oMQSodU.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\fEWIvCz.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\DqqkQRU.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\zmNDUoh.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\YSaEUlx.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\IQwsNfb.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\wWlhboI.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\oKCVmvf.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\NPMedEc.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
File created	C:\Windows\System\hdYaGDb.exe	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeLockMemoryPrivilege	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 4576	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	86
PID 3992 wrote to memory of 4576	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	86
PID 3992 wrote to memory of 3140	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	87
PID 3992 wrote to memory of 3140	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	87
PID 3992 wrote to memory of 4984	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	88
PID 3992 wrote to memory of 4984	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	88
PID 3992 wrote to memory of 440	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	89
PID 3992 wrote to memory of 440	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	89
PID 3992 wrote to memory of 1908	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	90
PID 3992 wrote to memory of 1908	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	90
PID 3992 wrote to memory of 460	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	91
PID 3992 wrote to memory of 460	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	91
PID 3992 wrote to memory of 4268	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	92
PID 3992 wrote to memory of 4268	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	92
PID 3992 wrote to memory of 652	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	93
PID 3992 wrote to memory of 652	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	93
PID 3992 wrote to memory of 2268	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	94
PID 3992 wrote to memory of 2268	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	94
PID 3992 wrote to memory of 1996	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	95
PID 3992 wrote to memory of 1996	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	95
PID 3992 wrote to memory of 4808	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	96
PID 3992 wrote to memory of 4808	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	96
PID 3992 wrote to memory of 1468	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	97
PID 3992 wrote to memory of 1468	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	97
PID 3992 wrote to memory of 1760	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	98
PID 3992 wrote to memory of 1760	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	98
PID 3992 wrote to memory of 4452	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	99
PID 3992 wrote to memory of 4452	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	99
PID 3992 wrote to memory of 3220	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	100
PID 3992 wrote to memory of 3220	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	100
PID 3992 wrote to memory of 2364	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	101
PID 3992 wrote to memory of 2364	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	101
PID 3992 wrote to memory of 868	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	102
PID 3992 wrote to memory of 868	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	102
PID 3992 wrote to memory of 4088	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	103
PID 3992 wrote to memory of 4088	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	103
PID 3992 wrote to memory of 4444	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	104
PID 3992 wrote to memory of 4444	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	104
PID 3992 wrote to memory of 4764	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	105
PID 3992 wrote to memory of 4764	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	105
PID 3992 wrote to memory of 224	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	106
PID 3992 wrote to memory of 224	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	106
PID 3992 wrote to memory of 2744	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	107
PID 3992 wrote to memory of 2744	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	107
PID 3992 wrote to memory of 4972	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	108
PID 3992 wrote to memory of 4972	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	108
PID 3992 wrote to memory of 2184	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	109
PID 3992 wrote to memory of 2184	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	109
PID 3992 wrote to memory of 3144	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	110
PID 3992 wrote to memory of 3144	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	110
PID 3992 wrote to memory of 4792	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	111
PID 3992 wrote to memory of 4792	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	111
PID 3992 wrote to memory of 1128	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	112
PID 3992 wrote to memory of 1128	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	112
PID 3992 wrote to memory of 4572	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	113
PID 3992 wrote to memory of 4572	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	113
PID 3992 wrote to memory of 4472	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	114
PID 3992 wrote to memory of 4472	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	114
PID 3992 wrote to memory of 4496	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	115
PID 3992 wrote to memory of 4496	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	115
PID 3992 wrote to memory of 3020	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	116
PID 3992 wrote to memory of 3020	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	116
PID 3992 wrote to memory of 3872	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	117
PID 3992 wrote to memory of 3872	3992	4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe	117

C:\Users\Admin\AppData\Local\Temp\4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe
"C:\Users\Admin\AppData\Local\Temp\4b1137c965714aacb03de2bb9c6e4b5c91e0bad54f7b35912f0e2fa63fbd7035.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\System\jnBaQyF.exe
  C:\Windows\System\jnBaQyF.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\EAYtTDr.exe
  C:\Windows\System\EAYtTDr.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\DjaosrU.exe
  C:\Windows\System\DjaosrU.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\pAqLdXE.exe
  C:\Windows\System\pAqLdXE.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\oRxZPZI.exe
  C:\Windows\System\oRxZPZI.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\cAcqJWW.exe
  C:\Windows\System\cAcqJWW.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\IFzaZej.exe
  C:\Windows\System\IFzaZej.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\vTDAgDX.exe
  C:\Windows\System\vTDAgDX.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\hInKVlm.exe
  C:\Windows\System\hInKVlm.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\wngSCHl.exe
  C:\Windows\System\wngSCHl.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\GuorHrK.exe
  C:\Windows\System\GuorHrK.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\VrbaJia.exe
  C:\Windows\System\VrbaJia.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\qWQUpAX.exe
  C:\Windows\System\qWQUpAX.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\AtFomUd.exe
  C:\Windows\System\AtFomUd.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\qWLFscj.exe
  C:\Windows\System\qWLFscj.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\XVkIJtF.exe
  C:\Windows\System\XVkIJtF.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\vlfdsDd.exe
  C:\Windows\System\vlfdsDd.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\vEILjpe.exe
  C:\Windows\System\vEILjpe.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\xDcAdts.exe
  C:\Windows\System\xDcAdts.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\dkHUjuu.exe
  C:\Windows\System\dkHUjuu.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\SMTAfxB.exe
  C:\Windows\System\SMTAfxB.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\pLwZkmH.exe
  C:\Windows\System\pLwZkmH.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\dPezLkc.exe
  C:\Windows\System\dPezLkc.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\SRUGZDG.exe
  C:\Windows\System\SRUGZDG.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\VUfSAGb.exe
  C:\Windows\System\VUfSAGb.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\BLtfwdh.exe
  C:\Windows\System\BLtfwdh.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\sHgCZOy.exe
  C:\Windows\System\sHgCZOy.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\IMXFHNP.exe
  C:\Windows\System\IMXFHNP.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\GeQPYqv.exe
  C:\Windows\System\GeQPYqv.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\szbDKhX.exe
  C:\Windows\System\szbDKhX.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\IDSGFub.exe
  C:\Windows\System\IDSGFub.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\mMIKPmu.exe
  C:\Windows\System\mMIKPmu.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\QFBVXfp.exe
  C:\Windows\System\QFBVXfp.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\RrsSrym.exe
  C:\Windows\System\RrsSrym.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\BBMehsQ.exe
  C:\Windows\System\BBMehsQ.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\AQAiinq.exe
  C:\Windows\System\AQAiinq.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\qCfiRxc.exe
  C:\Windows\System\qCfiRxc.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\vFMMpUk.exe
  C:\Windows\System\vFMMpUk.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\GZagqcl.exe
  C:\Windows\System\GZagqcl.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\cflqVGL.exe
  C:\Windows\System\cflqVGL.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\vRuxCdp.exe
  C:\Windows\System\vRuxCdp.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\qJcVmAT.exe
  C:\Windows\System\qJcVmAT.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\yYTBDdm.exe
  C:\Windows\System\yYTBDdm.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\lUuxUWi.exe
  C:\Windows\System\lUuxUWi.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\aGkwbDA.exe
  C:\Windows\System\aGkwbDA.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\ytdZFko.exe
  C:\Windows\System\ytdZFko.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\UMvRmXc.exe
  C:\Windows\System\UMvRmXc.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\eDhICqX.exe
  C:\Windows\System\eDhICqX.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\kGzLjSL.exe
  C:\Windows\System\kGzLjSL.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\ohbeQOu.exe
  C:\Windows\System\ohbeQOu.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\VExUoMN.exe
  C:\Windows\System\VExUoMN.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\EoXEaOM.exe
  C:\Windows\System\EoXEaOM.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\SfxSjKW.exe
  C:\Windows\System\SfxSjKW.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\oHQGdib.exe
  C:\Windows\System\oHQGdib.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\GWMNLlf.exe
  C:\Windows\System\GWMNLlf.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\MTtVPXn.exe
  C:\Windows\System\MTtVPXn.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\UDObFXF.exe
  C:\Windows\System\UDObFXF.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\BZARZkM.exe
  C:\Windows\System\BZARZkM.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\uiSsPAD.exe
  C:\Windows\System\uiSsPAD.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\RGCmeiC.exe
  C:\Windows\System\RGCmeiC.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\fkiYOfs.exe
  C:\Windows\System\fkiYOfs.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\RuBpIAT.exe
  C:\Windows\System\RuBpIAT.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\KrSrGbR.exe
  C:\Windows\System\KrSrGbR.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\DDVmyct.exe
  C:\Windows\System\DDVmyct.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\OqyTTRi.exe
  C:\Windows\System\OqyTTRi.exe
  2⤵
  PID:4940
- C:\Windows\System\sPXHFhY.exe
  C:\Windows\System\sPXHFhY.exe
  2⤵
  PID:4048
- C:\Windows\System\OQQAcoh.exe
  C:\Windows\System\OQQAcoh.exe
  2⤵
  PID:1744
- C:\Windows\System\AUkGexb.exe
  C:\Windows\System\AUkGexb.exe
  2⤵
  PID:4044
- C:\Windows\System\GsduIHx.exe
  C:\Windows\System\GsduIHx.exe
  2⤵
  PID:3336
- C:\Windows\System\TxQOYyr.exe
  C:\Windows\System\TxQOYyr.exe
  2⤵
  PID:4732
- C:\Windows\System\NTmxVex.exe
  C:\Windows\System\NTmxVex.exe
  2⤵
  PID:920
- C:\Windows\System\aLHdyGf.exe
  C:\Windows\System\aLHdyGf.exe
  2⤵
  PID:4460
- C:\Windows\System\guGChrH.exe
  C:\Windows\System\guGChrH.exe
  2⤵
  PID:5060
- C:\Windows\System\khzIVcl.exe
  C:\Windows\System\khzIVcl.exe
  2⤵
  PID:3832
- C:\Windows\System\YCryRlb.exe
  C:\Windows\System\YCryRlb.exe
  2⤵
  PID:2104
- C:\Windows\System\OKUfIqP.exe
  C:\Windows\System\OKUfIqP.exe
  2⤵
  PID:3324
- C:\Windows\System\VfdCDmf.exe
  C:\Windows\System\VfdCDmf.exe
  2⤵
  PID:1480
- C:\Windows\System\jICZIWB.exe
  C:\Windows\System\jICZIWB.exe
  2⤵
  PID:1264
- C:\Windows\System\huqYTVs.exe
  C:\Windows\System\huqYTVs.exe
  2⤵
  PID:1340
- C:\Windows\System\BigbnMA.exe
  C:\Windows\System\BigbnMA.exe
  2⤵
  PID:4816
- C:\Windows\System\pgSTSEV.exe
  C:\Windows\System\pgSTSEV.exe
  2⤵
  PID:4512
- C:\Windows\System\GlOyZcf.exe
  C:\Windows\System\GlOyZcf.exe
  2⤵
  PID:2360
- C:\Windows\System\GkipjkS.exe
  C:\Windows\System\GkipjkS.exe
  2⤵
  PID:1072
- C:\Windows\System\AJBrVQx.exe
  C:\Windows\System\AJBrVQx.exe
  2⤵
  PID:3380
- C:\Windows\System\mgJUCmf.exe
  C:\Windows\System\mgJUCmf.exe
  2⤵
  PID:2028
- C:\Windows\System\sjaCGsn.exe
  C:\Windows\System\sjaCGsn.exe
  2⤵
  PID:1168
- C:\Windows\System\iJEhrvO.exe
  C:\Windows\System\iJEhrvO.exe
  2⤵
  PID:4396
- C:\Windows\System\kDYPDia.exe
  C:\Windows\System\kDYPDia.exe
  2⤵
  PID:3728
- C:\Windows\System\UXZkQPk.exe
  C:\Windows\System\UXZkQPk.exe
  2⤵
  PID:1840
- C:\Windows\System\iIoSUaB.exe
  C:\Windows\System\iIoSUaB.exe
  2⤵
  PID:5140
- C:\Windows\System\SujCMZX.exe
  C:\Windows\System\SujCMZX.exe
  2⤵
  PID:5176
- C:\Windows\System\lDThxwP.exe
  C:\Windows\System\lDThxwP.exe
  2⤵
  PID:5204
- C:\Windows\System\QcryaIN.exe
  C:\Windows\System\QcryaIN.exe
  2⤵
  PID:5224
- C:\Windows\System\zCrfAqb.exe
  C:\Windows\System\zCrfAqb.exe
  2⤵
  PID:5256
- C:\Windows\System\ZejsbdG.exe
  C:\Windows\System\ZejsbdG.exe
  2⤵
  PID:5300
- C:\Windows\System\HVikcci.exe
  C:\Windows\System\HVikcci.exe
  2⤵
  PID:5332
- C:\Windows\System\bxNfyAq.exe
  C:\Windows\System\bxNfyAq.exe
  2⤵
  PID:5364
- C:\Windows\System\NUzPCrE.exe
  C:\Windows\System\NUzPCrE.exe
  2⤵
  PID:5388
- C:\Windows\System\GElcnzt.exe
  C:\Windows\System\GElcnzt.exe
  2⤵
  PID:5420
- C:\Windows\System\edQyorZ.exe
  C:\Windows\System\edQyorZ.exe
  2⤵
  PID:5448
- C:\Windows\System\Pyofdjf.exe
  C:\Windows\System\Pyofdjf.exe
  2⤵
  PID:5492
- C:\Windows\System\qeOxVuE.exe
  C:\Windows\System\qeOxVuE.exe
  2⤵
  PID:5524
- C:\Windows\System\YeFSxEh.exe
  C:\Windows\System\YeFSxEh.exe
  2⤵
  PID:5544
- C:\Windows\System\bxRhUEo.exe
  C:\Windows\System\bxRhUEo.exe
  2⤵
  PID:5568
- C:\Windows\System\AudwcjY.exe
  C:\Windows\System\AudwcjY.exe
  2⤵
  PID:5600
- C:\Windows\System\SzBMwJy.exe
  C:\Windows\System\SzBMwJy.exe
  2⤵
  PID:5640
- C:\Windows\System\rggAtst.exe
  C:\Windows\System\rggAtst.exe
  2⤵
  PID:5660
- C:\Windows\System\XxTpluc.exe
  C:\Windows\System\XxTpluc.exe
  2⤵
  PID:5688
- C:\Windows\System\qcosuoz.exe
  C:\Windows\System\qcosuoz.exe
  2⤵
  PID:5708
- C:\Windows\System\SSCKWWN.exe
  C:\Windows\System\SSCKWWN.exe
  2⤵
  PID:5744
- C:\Windows\System\mRkOJBT.exe
  C:\Windows\System\mRkOJBT.exe
  2⤵
  PID:5780
- C:\Windows\System\nuiqABA.exe
  C:\Windows\System\nuiqABA.exe
  2⤵
  PID:5808
- C:\Windows\System\mVwCGtu.exe
  C:\Windows\System\mVwCGtu.exe
  2⤵
  PID:5824
- C:\Windows\System\sUgvTko.exe
  C:\Windows\System\sUgvTko.exe
  2⤵
  PID:5860
- C:\Windows\System\bDbkwVz.exe
  C:\Windows\System\bDbkwVz.exe
  2⤵
  PID:5904
- C:\Windows\System\LSWIshD.exe
  C:\Windows\System\LSWIshD.exe
  2⤵
  PID:5924
- C:\Windows\System\BbseWUf.exe
  C:\Windows\System\BbseWUf.exe
  2⤵
  PID:5960
- C:\Windows\System\jTgsoha.exe
  C:\Windows\System\jTgsoha.exe
  2⤵
  PID:5992
- C:\Windows\System\sMKWPHL.exe
  C:\Windows\System\sMKWPHL.exe
  2⤵
  PID:6020
- C:\Windows\System\fXUgCFT.exe
  C:\Windows\System\fXUgCFT.exe
  2⤵
  PID:6068
- C:\Windows\System\lEwBgbj.exe
  C:\Windows\System\lEwBgbj.exe
  2⤵
  PID:6096
- C:\Windows\System\NaclcjX.exe
  C:\Windows\System\NaclcjX.exe
  2⤵
  PID:6124
- C:\Windows\System\fgOcxfC.exe
  C:\Windows\System\fgOcxfC.exe
  2⤵
  PID:5132
- C:\Windows\System\bkudUxP.exe
  C:\Windows\System\bkudUxP.exe
  2⤵
  PID:5172
- C:\Windows\System\ukAhyoS.exe
  C:\Windows\System\ukAhyoS.exe
  2⤵
  PID:5220
- C:\Windows\System\iziotgI.exe
  C:\Windows\System\iziotgI.exe
  2⤵
  PID:5376
- C:\Windows\System\rDBNZrI.exe
  C:\Windows\System\rDBNZrI.exe
  2⤵
  PID:5444
- C:\Windows\System\DvckrKg.exe
  C:\Windows\System\DvckrKg.exe
  2⤵
  PID:5480
- C:\Windows\System\BKsHMXy.exe
  C:\Windows\System\BKsHMXy.exe
  2⤵
  PID:5560
- C:\Windows\System\dKoiKtz.exe
  C:\Windows\System\dKoiKtz.exe
  2⤵
  PID:5648
- C:\Windows\System\MFIbcCf.exe
  C:\Windows\System\MFIbcCf.exe
  2⤵
  PID:5728
- C:\Windows\System\CNubACJ.exe
  C:\Windows\System\CNubACJ.exe
  2⤵
  PID:5820
- C:\Windows\System\VfoyZOm.exe
  C:\Windows\System\VfoyZOm.exe
  2⤵
  PID:5852
- C:\Windows\System\ryBYkCC.exe
  C:\Windows\System\ryBYkCC.exe
  2⤵
  PID:5916
- C:\Windows\System\ZDtTjRe.exe
  C:\Windows\System\ZDtTjRe.exe
  2⤵
  PID:5976
- C:\Windows\System\SuzaDPg.exe
  C:\Windows\System\SuzaDPg.exe
  2⤵
  PID:6004
- C:\Windows\System\bimrGEg.exe
  C:\Windows\System\bimrGEg.exe
  2⤵
  PID:6056
- C:\Windows\System\qmhXnWW.exe
  C:\Windows\System\qmhXnWW.exe
  2⤵
  PID:6140
- C:\Windows\System\TlFprsk.exe
  C:\Windows\System\TlFprsk.exe
  2⤵
  PID:5292
- C:\Windows\System\BaSjANq.exe
  C:\Windows\System\BaSjANq.exe
  2⤵
  PID:5404
- C:\Windows\System\ZCAZxaX.exe
  C:\Windows\System\ZCAZxaX.exe
  2⤵
  PID:5672
- C:\Windows\System\dcPozbQ.exe
  C:\Windows\System\dcPozbQ.exe
  2⤵
  PID:3932
- C:\Windows\System\PThfrpX.exe
  C:\Windows\System\PThfrpX.exe
  2⤵
  PID:5848
- C:\Windows\System\VBTqoPj.exe
  C:\Windows\System\VBTqoPj.exe
  2⤵
  PID:2728
- C:\Windows\System\HzaIXMk.exe
  C:\Windows\System\HzaIXMk.exe
  2⤵
  PID:5920
- C:\Windows\System\nCapWQE.exe
  C:\Windows\System\nCapWQE.exe
  2⤵
  PID:6088
- C:\Windows\System\hhzbVcB.exe
  C:\Windows\System\hhzbVcB.exe
  2⤵
  PID:5324
- C:\Windows\System\PoTQoxw.exe
  C:\Windows\System\PoTQoxw.exe
  2⤵
  PID:5484
- C:\Windows\System\sQBQytn.exe
  C:\Windows\System\sQBQytn.exe
  2⤵
  PID:2576
- C:\Windows\System\msBtihl.exe
  C:\Windows\System\msBtihl.exe
  2⤵
  PID:5984
- C:\Windows\System\yVrBFdu.exe
  C:\Windows\System\yVrBFdu.exe
  2⤵
  PID:5236
- C:\Windows\System\IIupMjO.exe
  C:\Windows\System\IIupMjO.exe
  2⤵
  PID:5584
- C:\Windows\System\rLEUVKg.exe
  C:\Windows\System\rLEUVKg.exe
  2⤵
  PID:5912
- C:\Windows\System\JwViqJK.exe
  C:\Windows\System\JwViqJK.exe
  2⤵
  PID:6156
- C:\Windows\System\KPhiXWZ.exe
  C:\Windows\System\KPhiXWZ.exe
  2⤵
  PID:6184
- C:\Windows\System\MwHKKvS.exe
  C:\Windows\System\MwHKKvS.exe
  2⤵
  PID:6212
- C:\Windows\System\wWlhboI.exe
  C:\Windows\System\wWlhboI.exe
  2⤵
  PID:6256
- C:\Windows\System\RigBsSB.exe
  C:\Windows\System\RigBsSB.exe
  2⤵
  PID:6280
- C:\Windows\System\XWAbqXj.exe
  C:\Windows\System\XWAbqXj.exe
  2⤵
  PID:6320
- C:\Windows\System\VpDOICX.exe
  C:\Windows\System\VpDOICX.exe
  2⤵
  PID:6340
- C:\Windows\System\VVdDUcR.exe
  C:\Windows\System\VVdDUcR.exe
  2⤵
  PID:6368
- C:\Windows\System\UsLsRaP.exe
  C:\Windows\System\UsLsRaP.exe
  2⤵
  PID:6392
- C:\Windows\System\kPJeorv.exe
  C:\Windows\System\kPJeorv.exe
  2⤵
  PID:6432
- C:\Windows\System\MbdJLae.exe
  C:\Windows\System\MbdJLae.exe
  2⤵
  PID:6448
- C:\Windows\System\lIEkGfq.exe
  C:\Windows\System\lIEkGfq.exe
  2⤵
  PID:6476
- C:\Windows\System\VRBsBrf.exe
  C:\Windows\System\VRBsBrf.exe
  2⤵
  PID:6504
- C:\Windows\System\joFbyXf.exe
  C:\Windows\System\joFbyXf.exe
  2⤵
  PID:6536
- C:\Windows\System\UWwNnOJ.exe
  C:\Windows\System\UWwNnOJ.exe
  2⤵
  PID:6564
- C:\Windows\System\VVJUwTm.exe
  C:\Windows\System\VVJUwTm.exe
  2⤵
  PID:6588
- C:\Windows\System\DXcaSfJ.exe
  C:\Windows\System\DXcaSfJ.exe
  2⤵
  PID:6616
- C:\Windows\System\FijTDzx.exe
  C:\Windows\System\FijTDzx.exe
  2⤵
  PID:6644
- C:\Windows\System\hoFDItd.exe
  C:\Windows\System\hoFDItd.exe
  2⤵
  PID:6676
- C:\Windows\System\vtmBiyk.exe
  C:\Windows\System\vtmBiyk.exe
  2⤵
  PID:6716
- C:\Windows\System\rVjAYSt.exe
  C:\Windows\System\rVjAYSt.exe
  2⤵
  PID:6744
- C:\Windows\System\pemxGfK.exe
  C:\Windows\System\pemxGfK.exe
  2⤵
  PID:6760
- C:\Windows\System\yGLhJlx.exe
  C:\Windows\System\yGLhJlx.exe
  2⤵
  PID:6780
- C:\Windows\System\XRnYPSl.exe
  C:\Windows\System\XRnYPSl.exe
  2⤵
  PID:6824
- C:\Windows\System\KibQCGi.exe
  C:\Windows\System\KibQCGi.exe
  2⤵
  PID:6856
- C:\Windows\System\ThPbjsy.exe
  C:\Windows\System\ThPbjsy.exe
  2⤵
  PID:6876
- C:\Windows\System\Shzelwl.exe
  C:\Windows\System\Shzelwl.exe
  2⤵
  PID:6912
- C:\Windows\System\mmpxZfF.exe
  C:\Windows\System\mmpxZfF.exe
  2⤵
  PID:6940
- C:\Windows\System\ZcpRcIg.exe
  C:\Windows\System\ZcpRcIg.exe
  2⤵
  PID:6968
- C:\Windows\System\GiBegUh.exe
  C:\Windows\System\GiBegUh.exe
  2⤵
  PID:6988
- C:\Windows\System\buhQBwU.exe
  C:\Windows\System\buhQBwU.exe
  2⤵
  PID:7012
- C:\Windows\System\qDoUguB.exe
  C:\Windows\System\qDoUguB.exe
  2⤵
  PID:7032
- C:\Windows\System\aCPxDCC.exe
  C:\Windows\System\aCPxDCC.exe
  2⤵
  PID:7064
- C:\Windows\System\plpcEAa.exe
  C:\Windows\System\plpcEAa.exe
  2⤵
  PID:7092
- C:\Windows\System\YTLJnGY.exe
  C:\Windows\System\YTLJnGY.exe
  2⤵
  PID:7128
- C:\Windows\System\uvdKdGm.exe
  C:\Windows\System\uvdKdGm.exe
  2⤵
  PID:6152
- C:\Windows\System\SOCNALn.exe
  C:\Windows\System\SOCNALn.exe
  2⤵
  PID:6208
- C:\Windows\System\wQRCSvx.exe
  C:\Windows\System\wQRCSvx.exe
  2⤵
  PID:6312
- C:\Windows\System\oHCOjRz.exe
  C:\Windows\System\oHCOjRz.exe
  2⤵
  PID:5384
- C:\Windows\System\XPuIvlh.exe
  C:\Windows\System\XPuIvlh.exe
  2⤵
  PID:6384
- C:\Windows\System\xsQRTWu.exe
  C:\Windows\System\xsQRTWu.exe
  2⤵
  PID:6496
- C:\Windows\System\KtvrLwF.exe
  C:\Windows\System\KtvrLwF.exe
  2⤵
  PID:6492
- C:\Windows\System\sPcrkah.exe
  C:\Windows\System\sPcrkah.exe
  2⤵
  PID:6560
- C:\Windows\System\qUNDpSX.exe
  C:\Windows\System\qUNDpSX.exe
  2⤵
  PID:6628
- C:\Windows\System\GZGIhEc.exe
  C:\Windows\System\GZGIhEc.exe
  2⤵
  PID:6728
- C:\Windows\System\lHmvCQp.exe
  C:\Windows\System\lHmvCQp.exe
  2⤵
  PID:5716
- C:\Windows\System\zBFogsG.exe
  C:\Windows\System\zBFogsG.exe
  2⤵
  PID:6868
- C:\Windows\System\GLezpEi.exe
  C:\Windows\System\GLezpEi.exe
  2⤵
  PID:6908
- C:\Windows\System\aXJxQsr.exe
  C:\Windows\System\aXJxQsr.exe
  2⤵
  PID:6980
- C:\Windows\System\kTRUAEe.exe
  C:\Windows\System\kTRUAEe.exe
  2⤵
  PID:7048
- C:\Windows\System\tnUIpUE.exe
  C:\Windows\System\tnUIpUE.exe
  2⤵
  PID:7140
- C:\Windows\System\DFKtSGj.exe
  C:\Windows\System\DFKtSGj.exe
  2⤵
  PID:6200
- C:\Windows\System\XRRSoLx.exe
  C:\Windows\System\XRRSoLx.exe
  2⤵
  PID:6352
- C:\Windows\System\KJtvlQo.exe
  C:\Windows\System\KJtvlQo.exe
  2⤵
  PID:6464
- C:\Windows\System\PQJoFEG.exe
  C:\Windows\System\PQJoFEG.exe
  2⤵
  PID:6612
- C:\Windows\System\IIWXYnJ.exe
  C:\Windows\System\IIWXYnJ.exe
  2⤵
  PID:6752
- C:\Windows\System\KRhUjFL.exe
  C:\Windows\System\KRhUjFL.exe
  2⤵
  PID:6936
- C:\Windows\System\VNLxiJw.exe
  C:\Windows\System\VNLxiJw.exe
  2⤵
  PID:7080
- C:\Windows\System\GzKeFtR.exe
  C:\Windows\System\GzKeFtR.exe
  2⤵
  PID:6272
- C:\Windows\System\TCwHpkK.exe
  C:\Windows\System\TCwHpkK.exe
  2⤵
  PID:6688
- C:\Windows\System\wisLnSG.exe
  C:\Windows\System\wisLnSG.exe
  2⤵
  PID:7024
- C:\Windows\System\iqyLRal.exe
  C:\Windows\System\iqyLRal.exe
  2⤵
  PID:6516
- C:\Windows\System\BUuiYcP.exe
  C:\Windows\System\BUuiYcP.exe
  2⤵
  PID:7176
- C:\Windows\System\WQrLRta.exe
  C:\Windows\System\WQrLRta.exe
  2⤵
  PID:7208
- C:\Windows\System\ZHVFllv.exe
  C:\Windows\System\ZHVFllv.exe
  2⤵
  PID:7236
- C:\Windows\System\voNadTb.exe
  C:\Windows\System\voNadTb.exe
  2⤵
  PID:7268
- C:\Windows\System\IFhqcEI.exe
  C:\Windows\System\IFhqcEI.exe
  2⤵
  PID:7300
- C:\Windows\System\JHJEMZs.exe
  C:\Windows\System\JHJEMZs.exe
  2⤵
  PID:7332
- C:\Windows\System\LAhxRZe.exe
  C:\Windows\System\LAhxRZe.exe
  2⤵
  PID:7364
- C:\Windows\System\goTxcLA.exe
  C:\Windows\System\goTxcLA.exe
  2⤵
  PID:7396
- C:\Windows\System\xdSLMmx.exe
  C:\Windows\System\xdSLMmx.exe
  2⤵
  PID:7424
- C:\Windows\System\HvBdbSb.exe
  C:\Windows\System\HvBdbSb.exe
  2⤵
  PID:7460
- C:\Windows\System\UwLtUln.exe
  C:\Windows\System\UwLtUln.exe
  2⤵
  PID:7480
- C:\Windows\System\wQLcNRV.exe
  C:\Windows\System\wQLcNRV.exe
  2⤵
  PID:7512
- C:\Windows\System\ZZCtjYa.exe
  C:\Windows\System\ZZCtjYa.exe
  2⤵
  PID:7540
- C:\Windows\System\VBvJmYu.exe
  C:\Windows\System\VBvJmYu.exe
  2⤵
  PID:7568
- C:\Windows\System\gkQdADk.exe
  C:\Windows\System\gkQdADk.exe
  2⤵
  PID:7604
- C:\Windows\System\oAWKINM.exe
  C:\Windows\System\oAWKINM.exe
  2⤵
  PID:7632
- C:\Windows\System\XahUimX.exe
  C:\Windows\System\XahUimX.exe
  2⤵
  PID:7672
- C:\Windows\System\NkNfKGm.exe
  C:\Windows\System\NkNfKGm.exe
  2⤵
  PID:7708
- C:\Windows\System\FvJBDKh.exe
  C:\Windows\System\FvJBDKh.exe
  2⤵
  PID:7736
- C:\Windows\System\xsJmMkl.exe
  C:\Windows\System\xsJmMkl.exe
  2⤵
  PID:7772
- C:\Windows\System\GgPkcfI.exe
  C:\Windows\System\GgPkcfI.exe
  2⤵
  PID:7812
- C:\Windows\System\lmXDJeh.exe
  C:\Windows\System\lmXDJeh.exe
  2⤵
  PID:7836
- C:\Windows\System\fUeFgas.exe
  C:\Windows\System\fUeFgas.exe
  2⤵
  PID:7872
- C:\Windows\System\ehQTxzX.exe
  C:\Windows\System\ehQTxzX.exe
  2⤵
  PID:7892
- C:\Windows\System\LkSgiif.exe
  C:\Windows\System\LkSgiif.exe
  2⤵
  PID:7920
- C:\Windows\System\UvVkmjR.exe
  C:\Windows\System\UvVkmjR.exe
  2⤵
  PID:7948
- C:\Windows\System\ePiBhuk.exe
  C:\Windows\System\ePiBhuk.exe
  2⤵
  PID:7996
- C:\Windows\System\kvCPWvW.exe
  C:\Windows\System\kvCPWvW.exe
  2⤵
  PID:8024
- C:\Windows\System\pJwqmdN.exe
  C:\Windows\System\pJwqmdN.exe
  2⤵
  PID:8056
- C:\Windows\System\YAyRULP.exe
  C:\Windows\System\YAyRULP.exe
  2⤵
  PID:8092
- C:\Windows\System\ivfHGGU.exe
  C:\Windows\System\ivfHGGU.exe
  2⤵
  PID:8128
- C:\Windows\System\siJjKRd.exe
  C:\Windows\System\siJjKRd.exe
  2⤵
  PID:8160
- C:\Windows\System\doFczER.exe
  C:\Windows\System\doFczER.exe
  2⤵
  PID:8176
- C:\Windows\System\SrXJCkg.exe
  C:\Windows\System\SrXJCkg.exe
  2⤵
  PID:7196
- C:\Windows\System\hIUgJDu.exe
  C:\Windows\System\hIUgJDu.exe
  2⤵
  PID:7228
- C:\Windows\System\ZpbYaay.exe
  C:\Windows\System\ZpbYaay.exe
  2⤵
  PID:7320
- C:\Windows\System\OnFUIrD.exe
  C:\Windows\System\OnFUIrD.exe
  2⤵
  PID:7436
- C:\Windows\System\wlJvgum.exe
  C:\Windows\System\wlJvgum.exe
  2⤵
  PID:7476
- C:\Windows\System\amAQYua.exe
  C:\Windows\System\amAQYua.exe
  2⤵
  PID:7536
- C:\Windows\System\NmaxshU.exe
  C:\Windows\System\NmaxshU.exe
  2⤵
  PID:7580
- C:\Windows\System\XOfbGmn.exe
  C:\Windows\System\XOfbGmn.exe
  2⤵
  PID:7644
- C:\Windows\System\JqRfLBW.exe
  C:\Windows\System\JqRfLBW.exe
  2⤵
  PID:7732
- C:\Windows\System\lgfkXIJ.exe
  C:\Windows\System\lgfkXIJ.exe
  2⤵
  PID:7848
- C:\Windows\System\DIlTWss.exe
  C:\Windows\System\DIlTWss.exe
  2⤵
  PID:7916
- C:\Windows\System\diQQlSA.exe
  C:\Windows\System\diQQlSA.exe
  2⤵
  PID:8048
- C:\Windows\System\hJNQgYe.exe
  C:\Windows\System\hJNQgYe.exe
  2⤵
  PID:8152
- C:\Windows\System\kBcilKV.exe
  C:\Windows\System\kBcilKV.exe
  2⤵
  PID:7232
- C:\Windows\System\Fpqkzpg.exe
  C:\Windows\System\Fpqkzpg.exe
  2⤵
  PID:7356
- C:\Windows\System\zClioKw.exe
  C:\Windows\System\zClioKw.exe
  2⤵
  PID:7532
- C:\Windows\System\EkftOfQ.exe
  C:\Windows\System\EkftOfQ.exe
  2⤵
  PID:7700
- C:\Windows\System\LysEuwx.exe
  C:\Windows\System\LysEuwx.exe
  2⤵
  PID:7888
- C:\Windows\System\KUhzJOd.exe
  C:\Windows\System\KUhzJOd.exe
  2⤵
  PID:8116
- C:\Windows\System\AhzHlNl.exe
  C:\Windows\System\AhzHlNl.exe
  2⤵
  PID:7448
- C:\Windows\System\OzWgbQs.exe
  C:\Windows\System\OzWgbQs.exe
  2⤵
  PID:7860
- C:\Windows\System\pPIxDTV.exe
  C:\Windows\System\pPIxDTV.exe
  2⤵
  PID:7284
- C:\Windows\System\TdCVZuZ.exe
  C:\Windows\System\TdCVZuZ.exe
  2⤵
  PID:8168
- C:\Windows\System\qKNHSau.exe
  C:\Windows\System\qKNHSau.exe
  2⤵
  PID:8216
- C:\Windows\System\hGAMcVp.exe
  C:\Windows\System\hGAMcVp.exe
  2⤵
  PID:8244
- C:\Windows\System\eYyTzQy.exe
  C:\Windows\System\eYyTzQy.exe
  2⤵
  PID:8272
- C:\Windows\System\HPBbfvQ.exe
  C:\Windows\System\HPBbfvQ.exe
  2⤵
  PID:8304
- C:\Windows\System\UwiLEYZ.exe
  C:\Windows\System\UwiLEYZ.exe
  2⤵
  PID:8332
- C:\Windows\System\QYuzzxz.exe
  C:\Windows\System\QYuzzxz.exe
  2⤵
  PID:8364
- C:\Windows\System\VBgqFdh.exe
  C:\Windows\System\VBgqFdh.exe
  2⤵
  PID:8392
- C:\Windows\System\dAmADCH.exe
  C:\Windows\System\dAmADCH.exe
  2⤵
  PID:8416
- C:\Windows\System\TYmQlHh.exe
  C:\Windows\System\TYmQlHh.exe
  2⤵
  PID:8444
- C:\Windows\System\MubjOfD.exe
  C:\Windows\System\MubjOfD.exe
  2⤵
  PID:8472
- C:\Windows\System\npMRvmF.exe
  C:\Windows\System\npMRvmF.exe
  2⤵
  PID:8508
- C:\Windows\System\GgbKHuR.exe
  C:\Windows\System\GgbKHuR.exe
  2⤵
  PID:8532
- C:\Windows\System\DQHcMMc.exe
  C:\Windows\System\DQHcMMc.exe
  2⤵
  PID:8572
- C:\Windows\System\QaUDRfw.exe
  C:\Windows\System\QaUDRfw.exe
  2⤵
  PID:8592
- C:\Windows\System\NOzvdfu.exe
  C:\Windows\System\NOzvdfu.exe
  2⤵
  PID:8624
- C:\Windows\System\oKCVmvf.exe
  C:\Windows\System\oKCVmvf.exe
  2⤵
  PID:8648
- C:\Windows\System\fPotPHj.exe
  C:\Windows\System\fPotPHj.exe
  2⤵
  PID:8676
- C:\Windows\System\NyDawYE.exe
  C:\Windows\System\NyDawYE.exe
  2⤵
  PID:8696
- C:\Windows\System\WadyGqP.exe
  C:\Windows\System\WadyGqP.exe
  2⤵
  PID:8732
- C:\Windows\System\lVoqyfw.exe
  C:\Windows\System\lVoqyfw.exe
  2⤵
  PID:8760
- C:\Windows\System\Htjvxhs.exe
  C:\Windows\System\Htjvxhs.exe
  2⤵
  PID:8788
- C:\Windows\System\itIyBiv.exe
  C:\Windows\System\itIyBiv.exe
  2⤵
  PID:8816
- C:\Windows\System\KcpMAeE.exe
  C:\Windows\System\KcpMAeE.exe
  2⤵
  PID:8844
- C:\Windows\System\ewDHAyM.exe
  C:\Windows\System\ewDHAyM.exe
  2⤵
  PID:8892
- C:\Windows\System\nVZkULW.exe
  C:\Windows\System\nVZkULW.exe
  2⤵
  PID:8912
- C:\Windows\System\VsjIVlh.exe
  C:\Windows\System\VsjIVlh.exe
  2⤵
  PID:8936
- C:\Windows\System\xLlQwWN.exe
  C:\Windows\System\xLlQwWN.exe
  2⤵
  PID:8964
- C:\Windows\System\uQJFpKi.exe
  C:\Windows\System\uQJFpKi.exe
  2⤵
  PID:8992
- C:\Windows\System\rUaabIi.exe
  C:\Windows\System\rUaabIi.exe
  2⤵
  PID:9020
- C:\Windows\System\qpHosGu.exe
  C:\Windows\System\qpHosGu.exe
  2⤵
  PID:9048
- C:\Windows\System\CRlPWdt.exe
  C:\Windows\System\CRlPWdt.exe
  2⤵
  PID:9076
- C:\Windows\System\ElDCtba.exe
  C:\Windows\System\ElDCtba.exe
  2⤵
  PID:9104
- C:\Windows\System\xtzLGpV.exe
  C:\Windows\System\xtzLGpV.exe
  2⤵
  PID:9132
- C:\Windows\System\FVxOmHx.exe
  C:\Windows\System\FVxOmHx.exe
  2⤵
  PID:9160
- C:\Windows\System\TzimrPv.exe
  C:\Windows\System\TzimrPv.exe
  2⤵
  PID:9188
- C:\Windows\System\OzkzYsW.exe
  C:\Windows\System\OzkzYsW.exe
  2⤵
  PID:7352
- C:\Windows\System\DDeYaug.exe
  C:\Windows\System\DDeYaug.exe
  2⤵
  PID:8264
- C:\Windows\System\DtkBykq.exe
  C:\Windows\System\DtkBykq.exe
  2⤵
  PID:8324
- C:\Windows\System\MjRwFfG.exe
  C:\Windows\System\MjRwFfG.exe
  2⤵
  PID:8384
- C:\Windows\System\FmJOulw.exe
  C:\Windows\System\FmJOulw.exe
  2⤵
  PID:8456
- C:\Windows\System\kFITtpP.exe
  C:\Windows\System\kFITtpP.exe
  2⤵
  PID:8524
- C:\Windows\System\GfrFWFT.exe
  C:\Windows\System\GfrFWFT.exe
  2⤵
  PID:8588
- C:\Windows\System\yigcrgq.exe
  C:\Windows\System\yigcrgq.exe
  2⤵
  PID:8660
- C:\Windows\System\fFvcIRP.exe
  C:\Windows\System\fFvcIRP.exe
  2⤵
  PID:8716
- C:\Windows\System\CwLVXjc.exe
  C:\Windows\System\CwLVXjc.exe
  2⤵
  PID:8780
- C:\Windows\System\QXvcHCj.exe
  C:\Windows\System\QXvcHCj.exe
  2⤵
  PID:8856
- C:\Windows\System\ZLiNCfO.exe
  C:\Windows\System\ZLiNCfO.exe
  2⤵
  PID:8920
- C:\Windows\System\yFbiPOD.exe
  C:\Windows\System\yFbiPOD.exe
  2⤵
  PID:8984
- C:\Windows\System\EYOuSbw.exe
  C:\Windows\System\EYOuSbw.exe
  2⤵
  PID:9044
- C:\Windows\System\TFlVEIe.exe
  C:\Windows\System\TFlVEIe.exe
  2⤵
  PID:9116
- C:\Windows\System\wgJzsjG.exe
  C:\Windows\System\wgJzsjG.exe
  2⤵
  PID:9184
- C:\Windows\System\FuxLcdT.exe
  C:\Windows\System\FuxLcdT.exe
  2⤵
  PID:8256
- C:\Windows\System\WnMnsAi.exe
  C:\Windows\System\WnMnsAi.exe
  2⤵
  PID:8412
- C:\Windows\System\RpklsuR.exe
  C:\Windows\System\RpklsuR.exe
  2⤵
  PID:8584
- C:\Windows\System\ieeyafp.exe
  C:\Windows\System\ieeyafp.exe
  2⤵
  PID:8724
- C:\Windows\System\QgQsiuM.exe
  C:\Windows\System\QgQsiuM.exe
  2⤵
  PID:8880
- C:\Windows\System\YHREAaX.exe
  C:\Windows\System\YHREAaX.exe
  2⤵
  PID:9012
- C:\Windows\System\igkVMFI.exe
  C:\Windows\System\igkVMFI.exe
  2⤵
  PID:9152
- C:\Windows\System\CZOLahI.exe
  C:\Windows\System\CZOLahI.exe
  2⤵
  PID:8380
- C:\Windows\System\fImGOAQ.exe
  C:\Windows\System\fImGOAQ.exe
  2⤵
  PID:8756
- C:\Windows\System\DJOxOGY.exe
  C:\Windows\System\DJOxOGY.exe
  2⤵
  PID:9144
- C:\Windows\System\wcufIfW.exe
  C:\Windows\System\wcufIfW.exe
  2⤵
  PID:8948
- C:\Windows\System\ebTnvFv.exe
  C:\Windows\System\ebTnvFv.exe
  2⤵
  PID:9224
- C:\Windows\System\hdYaGDb.exe
  C:\Windows\System\hdYaGDb.exe
  2⤵
  PID:9252
- C:\Windows\System\XWgjGMn.exe
  C:\Windows\System\XWgjGMn.exe
  2⤵
  PID:9280
- C:\Windows\System\dkpLxPo.exe
  C:\Windows\System\dkpLxPo.exe
  2⤵
  PID:9308
- C:\Windows\System\kqGSLTZ.exe
  C:\Windows\System\kqGSLTZ.exe
  2⤵
  PID:9336
- C:\Windows\System\WpWJrXU.exe
  C:\Windows\System\WpWJrXU.exe
  2⤵
  PID:9364
- C:\Windows\System\OqKKYPb.exe
  C:\Windows\System\OqKKYPb.exe
  2⤵
  PID:9392
- C:\Windows\System\yIinqjg.exe
  C:\Windows\System\yIinqjg.exe
  2⤵
  PID:9424
- C:\Windows\System\SpdsmHD.exe
  C:\Windows\System\SpdsmHD.exe
  2⤵
  PID:9448
- C:\Windows\System\UQzSWZg.exe
  C:\Windows\System\UQzSWZg.exe
  2⤵
  PID:9476
- C:\Windows\System\IGjStnL.exe
  C:\Windows\System\IGjStnL.exe
  2⤵
  PID:9504
- C:\Windows\System\KOcGAMP.exe
  C:\Windows\System\KOcGAMP.exe
  2⤵
  PID:9532
- C:\Windows\System\mrBltJM.exe
  C:\Windows\System\mrBltJM.exe
  2⤵
  PID:9560
- C:\Windows\System\DjxGZiF.exe
  C:\Windows\System\DjxGZiF.exe
  2⤵
  PID:9588
- C:\Windows\System\FTNMlcz.exe
  C:\Windows\System\FTNMlcz.exe
  2⤵
  PID:9616
- C:\Windows\System\BJaLGad.exe
  C:\Windows\System\BJaLGad.exe
  2⤵
  PID:9644
- C:\Windows\System\WWNHVcU.exe
  C:\Windows\System\WWNHVcU.exe
  2⤵
  PID:9672
- C:\Windows\System\FalXrOw.exe
  C:\Windows\System\FalXrOw.exe
  2⤵
  PID:9700
- C:\Windows\System\KJEMuuG.exe
  C:\Windows\System\KJEMuuG.exe
  2⤵
  PID:9728
- C:\Windows\System\THhRTtX.exe
  C:\Windows\System\THhRTtX.exe
  2⤵
  PID:9756
- C:\Windows\System\dUWvoHX.exe
  C:\Windows\System\dUWvoHX.exe
  2⤵
  PID:9784
- C:\Windows\System\EAQkODI.exe
  C:\Windows\System\EAQkODI.exe
  2⤵
  PID:9812
- C:\Windows\System\HKWoJVx.exe
  C:\Windows\System\HKWoJVx.exe
  2⤵
  PID:9840
- C:\Windows\System\dFYzwNA.exe
  C:\Windows\System\dFYzwNA.exe
  2⤵
  PID:9868
- C:\Windows\System\oCxFCAT.exe
  C:\Windows\System\oCxFCAT.exe
  2⤵
  PID:9896
- C:\Windows\System\ryZupGK.exe
  C:\Windows\System\ryZupGK.exe
  2⤵
  PID:9924
- C:\Windows\System\NgkQudt.exe
  C:\Windows\System\NgkQudt.exe
  2⤵
  PID:9952
- C:\Windows\System\ROkAKXu.exe
  C:\Windows\System\ROkAKXu.exe
  2⤵
  PID:9980
- C:\Windows\System\XNEDlIi.exe
  C:\Windows\System\XNEDlIi.exe
  2⤵
  PID:10008
- C:\Windows\System\hEYthFL.exe
  C:\Windows\System\hEYthFL.exe
  2⤵
  PID:10036
- C:\Windows\System\DuOrigX.exe
  C:\Windows\System\DuOrigX.exe
  2⤵
  PID:10064
- C:\Windows\System\AUWRSLo.exe
  C:\Windows\System\AUWRSLo.exe
  2⤵
  PID:10092
- C:\Windows\System\dbYUxzt.exe
  C:\Windows\System\dbYUxzt.exe
  2⤵
  PID:10120
- C:\Windows\System\BKjEzaU.exe
  C:\Windows\System\BKjEzaU.exe
  2⤵
  PID:10148
- C:\Windows\System\girOOUo.exe
  C:\Windows\System\girOOUo.exe
  2⤵
  PID:10176
- C:\Windows\System\RUpGoVH.exe
  C:\Windows\System\RUpGoVH.exe
  2⤵
  PID:10204
- C:\Windows\System\BjqHhcX.exe
  C:\Windows\System\BjqHhcX.exe
  2⤵
  PID:10232
- C:\Windows\System\XCkvDyv.exe
  C:\Windows\System\XCkvDyv.exe
  2⤵
  PID:9248
- C:\Windows\System\NZtcXuq.exe
  C:\Windows\System\NZtcXuq.exe
  2⤵
  PID:9292
- C:\Windows\System\JiamdWx.exe
  C:\Windows\System\JiamdWx.exe
  2⤵
  PID:9356
- C:\Windows\System\ZcQLWXE.exe
  C:\Windows\System\ZcQLWXE.exe
  2⤵
  PID:9440
- C:\Windows\System\SoaIcAe.exe
  C:\Windows\System\SoaIcAe.exe
  2⤵
  PID:9496
- C:\Windows\System\OFJfDvN.exe
  C:\Windows\System\OFJfDvN.exe
  2⤵
  PID:9552
- C:\Windows\System\WhcLgqc.exe
  C:\Windows\System\WhcLgqc.exe
  2⤵
  PID:9640
- C:\Windows\System\ATqUJvL.exe
  C:\Windows\System\ATqUJvL.exe
  2⤵
  PID:9712
- C:\Windows\System\GLqBdmV.exe
  C:\Windows\System\GLqBdmV.exe
  2⤵
  PID:9776
- C:\Windows\System\zaGcjyU.exe
  C:\Windows\System\zaGcjyU.exe
  2⤵
  PID:9836
- C:\Windows\System\NPMedEc.exe
  C:\Windows\System\NPMedEc.exe
  2⤵
  PID:9908
- C:\Windows\System\cKhwSEG.exe
  C:\Windows\System\cKhwSEG.exe
  2⤵
  PID:9972
- C:\Windows\System\iRRdBjP.exe
  C:\Windows\System\iRRdBjP.exe
  2⤵
  PID:10032
- C:\Windows\System\GOUEtid.exe
  C:\Windows\System\GOUEtid.exe
  2⤵
  PID:10104
- C:\Windows\System\keJdILp.exe
  C:\Windows\System\keJdILp.exe
  2⤵
  PID:10168
- C:\Windows\System\AkNiLPT.exe
  C:\Windows\System\AkNiLPT.exe
  2⤵
  PID:10228
- C:\Windows\System\lvQnXUD.exe
  C:\Windows\System\lvQnXUD.exe
  2⤵
  PID:9332
- C:\Windows\System\TEUhESG.exe
  C:\Windows\System\TEUhESG.exe
  2⤵
  PID:9468
- C:\Windows\System\XldGnew.exe
  C:\Windows\System\XldGnew.exe
  2⤵
  PID:9612
- C:\Windows\System\IQRswyn.exe
  C:\Windows\System\IQRswyn.exe
  2⤵
  PID:9824
- C:\Windows\System\KUOySFc.exe
  C:\Windows\System\KUOySFc.exe
  2⤵
  PID:9936
- C:\Windows\System\uvuukGP.exe
  C:\Windows\System\uvuukGP.exe
  2⤵
  PID:10084
- C:\Windows\System\fEWIvCz.exe
  C:\Windows\System\fEWIvCz.exe
  2⤵
  PID:9244
- C:\Windows\System\HrKabTz.exe
  C:\Windows\System\HrKabTz.exe
  2⤵
  PID:9608
- C:\Windows\System\QsXyGgE.exe
  C:\Windows\System\QsXyGgE.exe
  2⤵
  PID:9940
- C:\Windows\System\RBqgkeO.exe
  C:\Windows\System\RBqgkeO.exe
  2⤵
  PID:9384
- C:\Windows\System\ulvGMjk.exe
  C:\Windows\System\ulvGMjk.exe
  2⤵
  PID:10216
- C:\Windows\System\PjLXdKo.exe
  C:\Windows\System\PjLXdKo.exe
  2⤵
  PID:10244
- C:\Windows\System\mmKYojV.exe
  C:\Windows\System\mmKYojV.exe
  2⤵
  PID:10272
- C:\Windows\System\FONWioJ.exe
  C:\Windows\System\FONWioJ.exe
  2⤵
  PID:10300
- C:\Windows\System\ZoAwkzF.exe
  C:\Windows\System\ZoAwkzF.exe
  2⤵
  PID:10328
- C:\Windows\System\TbNdzfh.exe
  C:\Windows\System\TbNdzfh.exe
  2⤵
  PID:10356
- C:\Windows\System\sWZnLjp.exe
  C:\Windows\System\sWZnLjp.exe
  2⤵
  PID:10384
- C:\Windows\System\XknEewc.exe
  C:\Windows\System\XknEewc.exe
  2⤵
  PID:10412
- C:\Windows\System\HIlMXeu.exe
  C:\Windows\System\HIlMXeu.exe
  2⤵
  PID:10440
- C:\Windows\System\DqqkQRU.exe
  C:\Windows\System\DqqkQRU.exe
  2⤵
  PID:10468
- C:\Windows\System\zwYzyEL.exe
  C:\Windows\System\zwYzyEL.exe
  2⤵
  PID:10496
- C:\Windows\System\CgYkgnC.exe
  C:\Windows\System\CgYkgnC.exe
  2⤵
  PID:10524
- C:\Windows\System\zmNDUoh.exe
  C:\Windows\System\zmNDUoh.exe
  2⤵
  PID:10552
- C:\Windows\System\fHxZGUw.exe
  C:\Windows\System\fHxZGUw.exe
  2⤵
  PID:10580
- C:\Windows\System\tZpzaqF.exe
  C:\Windows\System\tZpzaqF.exe
  2⤵
  PID:10608
- C:\Windows\System\rsUaknM.exe
  C:\Windows\System\rsUaknM.exe
  2⤵
  PID:10636
- C:\Windows\System\fzWyKTz.exe
  C:\Windows\System\fzWyKTz.exe
  2⤵
  PID:10664
- C:\Windows\System\vHcxEYh.exe
  C:\Windows\System\vHcxEYh.exe
  2⤵
  PID:10692
- C:\Windows\System\tnlHdwk.exe
  C:\Windows\System\tnlHdwk.exe
  2⤵
  PID:10720
- C:\Windows\System\LizOhJe.exe
  C:\Windows\System\LizOhJe.exe
  2⤵
  PID:10748
- C:\Windows\System\wgvVjGl.exe
  C:\Windows\System\wgvVjGl.exe
  2⤵
  PID:10764
- C:\Windows\System\ycNEqiQ.exe
  C:\Windows\System\ycNEqiQ.exe
  2⤵
  PID:10804
- C:\Windows\System\YreqioI.exe
  C:\Windows\System\YreqioI.exe
  2⤵
  PID:10820
- C:\Windows\System\MRozSkl.exe
  C:\Windows\System\MRozSkl.exe
  2⤵
  PID:10848
- C:\Windows\System\ScSQPJC.exe
  C:\Windows\System\ScSQPJC.exe
  2⤵
  PID:10888
- C:\Windows\System\qhPwxFw.exe
  C:\Windows\System\qhPwxFw.exe
  2⤵
  PID:10916
- C:\Windows\System\PcTHkxL.exe
  C:\Windows\System\PcTHkxL.exe
  2⤵
  PID:10944
- C:\Windows\System\wJlsDEN.exe
  C:\Windows\System\wJlsDEN.exe
  2⤵
  PID:10972
- C:\Windows\System\oBzFMom.exe
  C:\Windows\System\oBzFMom.exe
  2⤵
  PID:11000
- C:\Windows\System\KieepXP.exe
  C:\Windows\System\KieepXP.exe
  2⤵
  PID:11028
- C:\Windows\System\VDSglFd.exe
  C:\Windows\System\VDSglFd.exe
  2⤵
  PID:11056
- C:\Windows\System\AmuSkwe.exe
  C:\Windows\System\AmuSkwe.exe
  2⤵
  PID:11100
- C:\Windows\System\XuXvsOz.exe
  C:\Windows\System\XuXvsOz.exe
  2⤵
  PID:11116
- C:\Windows\System\MuUrOkD.exe
  C:\Windows\System\MuUrOkD.exe
  2⤵
  PID:11144
- C:\Windows\System\KwfvKPR.exe
  C:\Windows\System\KwfvKPR.exe
  2⤵
  PID:11168
- C:\Windows\System\Kxehedo.exe
  C:\Windows\System\Kxehedo.exe
  2⤵
  PID:11200
- C:\Windows\System\FleZEDj.exe
  C:\Windows\System\FleZEDj.exe
  2⤵
  PID:11228
- C:\Windows\System\iRQkGPz.exe
  C:\Windows\System\iRQkGPz.exe
  2⤵
  PID:11256
- C:\Windows\System\FBijQho.exe
  C:\Windows\System\FBijQho.exe
  2⤵
  PID:10292
- C:\Windows\System\aUsaWli.exe
  C:\Windows\System\aUsaWli.exe
  2⤵
  PID:10352
- C:\Windows\System\stSWeOF.exe
  C:\Windows\System\stSWeOF.exe
  2⤵
  PID:10436
- C:\Windows\System\NqcUBSU.exe
  C:\Windows\System\NqcUBSU.exe
  2⤵
  PID:10492
- C:\Windows\System\LDcPkOq.exe
  C:\Windows\System\LDcPkOq.exe
  2⤵
  PID:10564
- C:\Windows\System\AQJzMLM.exe
  C:\Windows\System\AQJzMLM.exe
  2⤵
  PID:10628
- C:\Windows\System\psKTuyX.exe
  C:\Windows\System\psKTuyX.exe
  2⤵
  PID:10688
- C:\Windows\System\wbIcyPZ.exe
  C:\Windows\System\wbIcyPZ.exe
  2⤵
  PID:10756
- C:\Windows\System\bBbtabj.exe
  C:\Windows\System\bBbtabj.exe
  2⤵
  PID:10812
- C:\Windows\System\rFVChRb.exe
  C:\Windows\System\rFVChRb.exe
  2⤵
  PID:10880
- C:\Windows\System\sPIXjjG.exe
  C:\Windows\System\sPIXjjG.exe
  2⤵
  PID:10940
- C:\Windows\System\vVgerow.exe
  C:\Windows\System\vVgerow.exe
  2⤵
  PID:11012
- C:\Windows\System\RzXWcqj.exe
  C:\Windows\System\RzXWcqj.exe
  2⤵
  PID:2660
- C:\Windows\System\taYCfyn.exe
  C:\Windows\System\taYCfyn.exe
  2⤵
  PID:4720
- C:\Windows\System\NYKbwpK.exe
  C:\Windows\System\NYKbwpK.exe
  2⤵
  PID:8008
- C:\Windows\System\SqDmbUA.exe
  C:\Windows\System\SqDmbUA.exe
  2⤵
  PID:11044
- C:\Windows\System\uEBbsjX.exe
  C:\Windows\System\uEBbsjX.exe
  2⤵
  PID:11084
- C:\Windows\System\bTqdjbl.exe
  C:\Windows\System\bTqdjbl.exe
  2⤵
  PID:11140
- C:\Windows\System\KnwMFLt.exe
  C:\Windows\System\KnwMFLt.exe
  2⤵
  PID:11216
- C:\Windows\System\xIZxoZj.exe
  C:\Windows\System\xIZxoZj.exe
  2⤵
  PID:10284
- C:\Windows\System\BitDEAG.exe
  C:\Windows\System\BitDEAG.exe
  2⤵
  PID:10424
- C:\Windows\System\uCbknoX.exe
  C:\Windows\System\uCbknoX.exe
  2⤵
  PID:10592
- C:\Windows\System\gFpkpfs.exe
  C:\Windows\System\gFpkpfs.exe
  2⤵
  PID:10740
- C:\Windows\System\VTNxrCH.exe
  C:\Windows\System\VTNxrCH.exe
  2⤵
  PID:10872
- C:\Windows\System\oeCxqoo.exe
  C:\Windows\System\oeCxqoo.exe
  2⤵
  PID:5028
- C:\Windows\System\TnamItq.exe
  C:\Windows\System\TnamItq.exe
  2⤵
  PID:1916
- C:\Windows\System\nQAmLYv.exe
  C:\Windows\System\nQAmLYv.exe
  2⤵
  PID:9412
- C:\Windows\System\wZQFxfw.exe
  C:\Windows\System\wZQFxfw.exe
  2⤵
  PID:11240
- C:\Windows\System\WFEhRfp.exe
  C:\Windows\System\WFEhRfp.exe
  2⤵
  PID:10380
- C:\Windows\System\tKxJRqT.exe
  C:\Windows\System\tKxJRqT.exe
  2⤵
  PID:10876
- C:\Windows\System\tCzocPh.exe
  C:\Windows\System\tCzocPh.exe
  2⤵
  PID:7588
- C:\Windows\System\VDidyNO.exe
  C:\Windows\System\VDidyNO.exe
  2⤵
  PID:10548
- C:\Windows\System\qqvhvxf.exe
  C:\Windows\System\qqvhvxf.exe
  2⤵
  PID:11192
- C:\Windows\System\IdczOZf.exe
  C:\Windows\System\IdczOZf.exe
  2⤵
  PID:1740
- C:\Windows\System\lLmIxGE.exe
  C:\Windows\System\lLmIxGE.exe
  2⤵
  PID:11304
- C:\Windows\System\LNgybCn.exe
  C:\Windows\System\LNgybCn.exe
  2⤵
  PID:11320
- C:\Windows\System\dOKSNux.exe
  C:\Windows\System\dOKSNux.exe
  2⤵
  PID:11348
- C:\Windows\System\lNHGHSJ.exe
  C:\Windows\System\lNHGHSJ.exe
  2⤵
  PID:11376
- C:\Windows\System\IQrayDm.exe
  C:\Windows\System\IQrayDm.exe
  2⤵
  PID:11404
- C:\Windows\System\ifzxjxg.exe
  C:\Windows\System\ifzxjxg.exe
  2⤵
  PID:11432
- C:\Windows\System\xagfbch.exe
  C:\Windows\System\xagfbch.exe
  2⤵
  PID:11460
- C:\Windows\System\tWoDdAV.exe
  C:\Windows\System\tWoDdAV.exe
  2⤵
  PID:11488
- C:\Windows\System\aFpiRMF.exe
  C:\Windows\System\aFpiRMF.exe
  2⤵
  PID:11516
- C:\Windows\System\sVAKQrg.exe
  C:\Windows\System\sVAKQrg.exe
  2⤵
  PID:11544
- C:\Windows\System\MpGxJNn.exe
  C:\Windows\System\MpGxJNn.exe
  2⤵
  PID:11572
- C:\Windows\System\lGRkzJO.exe
  C:\Windows\System\lGRkzJO.exe
  2⤵
  PID:11600
- C:\Windows\System\YSaEUlx.exe
  C:\Windows\System\YSaEUlx.exe
  2⤵
  PID:11628
- C:\Windows\System\cEDmXaO.exe
  C:\Windows\System\cEDmXaO.exe
  2⤵
  PID:11656
- C:\Windows\System\vFeEJmZ.exe
  C:\Windows\System\vFeEJmZ.exe
  2⤵
  PID:11684
- C:\Windows\System\IQwsNfb.exe
  C:\Windows\System\IQwsNfb.exe
  2⤵
  PID:11712
- C:\Windows\System\sWvdpCw.exe
  C:\Windows\System\sWvdpCw.exe
  2⤵
  PID:11740
- C:\Windows\System\fNJuyOw.exe
  C:\Windows\System\fNJuyOw.exe
  2⤵
  PID:11768
- C:\Windows\System\PIKKlfm.exe
  C:\Windows\System\PIKKlfm.exe
  2⤵
  PID:11796
- C:\Windows\System\ZyVIoRO.exe
  C:\Windows\System\ZyVIoRO.exe
  2⤵
  PID:11824
- C:\Windows\System\HAecpzV.exe
  C:\Windows\System\HAecpzV.exe
  2⤵
  PID:11856
- C:\Windows\System\PHyBxuS.exe
  C:\Windows\System\PHyBxuS.exe
  2⤵
  PID:11884
- C:\Windows\System\vtWkZms.exe
  C:\Windows\System\vtWkZms.exe
  2⤵
  PID:11912
- C:\Windows\System\bKzCban.exe
  C:\Windows\System\bKzCban.exe
  2⤵
  PID:11940
- C:\Windows\System\ofWAGem.exe
  C:\Windows\System\ofWAGem.exe
  2⤵
  PID:11968
- C:\Windows\System\yDVAQoU.exe
  C:\Windows\System\yDVAQoU.exe
  2⤵
  PID:11996
- C:\Windows\System\SvcxoBR.exe
  C:\Windows\System\SvcxoBR.exe
  2⤵
  PID:12024
- C:\Windows\System\ZYjJxHV.exe
  C:\Windows\System\ZYjJxHV.exe
  2⤵
  PID:12040
- C:\Windows\System\xvrxdoG.exe
  C:\Windows\System\xvrxdoG.exe
  2⤵
  PID:12056
- C:\Windows\System\czNKPsU.exe
  C:\Windows\System\czNKPsU.exe
  2⤵
  PID:12088
- C:\Windows\System\wjgMSVq.exe
  C:\Windows\System\wjgMSVq.exe
  2⤵
  PID:12136
- C:\Windows\System\rlnCODh.exe
  C:\Windows\System\rlnCODh.exe
  2⤵
  PID:12164
- C:\Windows\System\JcFiPea.exe
  C:\Windows\System\JcFiPea.exe
  2⤵
  PID:12192
- C:\Windows\System\VxIfCwy.exe
  C:\Windows\System\VxIfCwy.exe
  2⤵
  PID:12220
- C:\Windows\System\PLOVlTR.exe
  C:\Windows\System\PLOVlTR.exe
  2⤵
  PID:12248
- C:\Windows\System\BqPQlDI.exe
  C:\Windows\System\BqPQlDI.exe
  2⤵
  PID:12276
- C:\Windows\System\YQksfoS.exe
  C:\Windows\System\YQksfoS.exe
  2⤵
  PID:11288
- C:\Windows\System\pnnQvsH.exe
  C:\Windows\System\pnnQvsH.exe
  2⤵
  PID:11368
- C:\Windows\System\SKvOTmS.exe
  C:\Windows\System\SKvOTmS.exe
  2⤵
  PID:11424
- C:\Windows\System\TKltsuR.exe
  C:\Windows\System\TKltsuR.exe
  2⤵
  PID:11500
- C:\Windows\System\xRuRdfA.exe
  C:\Windows\System\xRuRdfA.exe
  2⤵
  PID:11556
- C:\Windows\System\JNwZGXN.exe
  C:\Windows\System\JNwZGXN.exe
  2⤵
  PID:11620
- C:\Windows\System\JdyNIBx.exe
  C:\Windows\System\JdyNIBx.exe
  2⤵
  PID:11680
- C:\Windows\System\XNnctna.exe
  C:\Windows\System\XNnctna.exe
  2⤵
  PID:11752
- C:\Windows\System\CjcHjSy.exe
  C:\Windows\System\CjcHjSy.exe
  2⤵
  PID:11816
- C:\Windows\System\VnlNODO.exe
  C:\Windows\System\VnlNODO.exe
  2⤵
  PID:11880
- C:\Windows\System\dzhkiTp.exe
  C:\Windows\System\dzhkiTp.exe
  2⤵
  PID:11952
- C:\Windows\System\XrQTLTu.exe
  C:\Windows\System\XrQTLTu.exe
  2⤵
  PID:12020
- C:\Windows\System\fEDtIsh.exe
  C:\Windows\System\fEDtIsh.exe
  2⤵
  PID:12072
- C:\Windows\System\KIhDKPr.exe
  C:\Windows\System\KIhDKPr.exe
  2⤵
  PID:12152
- C:\Windows\System\XwARImz.exe
  C:\Windows\System\XwARImz.exe
  2⤵
  PID:12212
- C:\Windows\System\skyaCbQ.exe
  C:\Windows\System\skyaCbQ.exe
  2⤵
  PID:988
- C:\Windows\System\NjpOICY.exe
  C:\Windows\System\NjpOICY.exe
  2⤵
  PID:12268
- C:\Windows\System\lPmZPzb.exe
  C:\Windows\System\lPmZPzb.exe
  2⤵
  PID:11360
- C:\Windows\System\NIzduOp.exe
  C:\Windows\System\NIzduOp.exe
  2⤵
  PID:11508
- C:\Windows\System\peUKiXF.exe
  C:\Windows\System\peUKiXF.exe
  2⤵
  PID:11668
- C:\Windows\System\JzOWnqz.exe
  C:\Windows\System\JzOWnqz.exe
  2⤵
  PID:11808
- C:\Windows\System\IUdBGjT.exe
  C:\Windows\System\IUdBGjT.exe
  2⤵
  PID:11980
- C:\Windows\System\TFLEfls.exe
  C:\Windows\System\TFLEfls.exe
  2⤵
  PID:12124
- C:\Windows\System\fMIlIYd.exe
  C:\Windows\System\fMIlIYd.exe
  2⤵
  PID:2372
- C:\Windows\System\BsyVOZz.exe
  C:\Windows\System\BsyVOZz.exe
  2⤵
  PID:11428
- C:\Windows\System\HKSsRMv.exe
  C:\Windows\System\HKSsRMv.exe
  2⤵
  PID:11648
- C:\Windows\System\fWoYeTV.exe
  C:\Windows\System\fWoYeTV.exe
  2⤵
  PID:1592
- C:\Windows\System\VGWcXtO.exe
  C:\Windows\System\VGWcXtO.exe
  2⤵
  PID:11876
- C:\Windows\System\UCyQOrn.exe
  C:\Windows\System\UCyQOrn.exe
  2⤵
  PID:11844
- C:\Windows\System\jtqywqt.exe
  C:\Windows\System\jtqywqt.exe
  2⤵
  PID:12244
- C:\Windows\System\rIYupud.exe
  C:\Windows\System\rIYupud.exe
  2⤵
  PID:12316
- C:\Windows\System\aFJEOll.exe
  C:\Windows\System\aFJEOll.exe
  2⤵
  PID:12344
- C:\Windows\System\BiNjZRy.exe
  C:\Windows\System\BiNjZRy.exe
  2⤵
  PID:12372
- C:\Windows\System\eWIyoOQ.exe
  C:\Windows\System\eWIyoOQ.exe
  2⤵
  PID:12400
- C:\Windows\System\yDlYHDm.exe
  C:\Windows\System\yDlYHDm.exe
  2⤵
  PID:12428
- C:\Windows\System\bRUJvZz.exe
  C:\Windows\System\bRUJvZz.exe
  2⤵
  PID:12456
- C:\Windows\System\cJfVNHw.exe
  C:\Windows\System\cJfVNHw.exe
  2⤵
  PID:12484
- C:\Windows\System\EkUEeum.exe
  C:\Windows\System\EkUEeum.exe
  2⤵
  PID:12512
- C:\Windows\System\LgLWWqR.exe
  C:\Windows\System\LgLWWqR.exe
  2⤵
  PID:12540
- C:\Windows\System\hRdDlrH.exe
  C:\Windows\System\hRdDlrH.exe
  2⤵
  PID:12568
- C:\Windows\System\FeSFYTl.exe
  C:\Windows\System\FeSFYTl.exe
  2⤵
  PID:12600
- C:\Windows\System\InAzsTV.exe
  C:\Windows\System\InAzsTV.exe
  2⤵
  PID:12628
- C:\Windows\System\SWinRgC.exe
  C:\Windows\System\SWinRgC.exe
  2⤵
  PID:12656
- C:\Windows\System\EksfScw.exe
  C:\Windows\System\EksfScw.exe
  2⤵
  PID:12684
- C:\Windows\System\wPnLnxQ.exe
  C:\Windows\System\wPnLnxQ.exe
  2⤵
  PID:12712
- C:\Windows\System\YGfhpuf.exe
  C:\Windows\System\YGfhpuf.exe
  2⤵
  PID:12740
- C:\Windows\System\PVKLjVk.exe
  C:\Windows\System\PVKLjVk.exe
  2⤵
  PID:12768
- C:\Windows\System\cJPcdmz.exe
  C:\Windows\System\cJPcdmz.exe
  2⤵
  PID:12796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dncwu4pw.vhf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AtFomUd.exe

Filesize
3.1MB

MD5
7eaf7b8613e3ab5f854a01bc87347cfa

SHA1
67dfda44dbf922da6be05c228d67ce9fef7a3241

SHA256
7f709e391ab56ac9516ed2d1ebdf15919757845497f69fc279b3fc0724de554a

SHA512
92a14c26283788e3ad26202bda03f17be5268c8f61553aaced52a4a5f2a1b71afcb3b58808da363407d8766df3aa42629b2c35347ca4016bea8cc175a03142e2

Download Submit
C:\Windows\System\BLtfwdh.exe

Filesize
3.1MB

MD5
7ed7bdf01bae15d2e17109adc1809584

SHA1
ebcfcd437f30c75898851b9eeec6eac655fbedcc

SHA256
a3673b6734c1e5e2ed419e30678b962ce69aac31815c02d52b8ac56ce58aa7f8

SHA512
afd5b12c4fbb24fae8613de8bac521c6d7ec7c84402eaa48fdcb41094916a23bb5fef5135389b9c1bc1a43426be7f0ad5f36dc100759c3ea8209dd8bbfbf18ae

Download Submit
C:\Windows\System\DjaosrU.exe

Filesize
3.1MB

MD5
345d78f90aee02c73926f5b9d0994f41

SHA1
a5281477dd8b76af33953da5b30c5f0548f36cc1

SHA256
e1aafa31ee1027550ba5ef924979a95f6b7cc42bd8259451b5cca6543c7c15db

SHA512
faf5882bad42832f6189d7719263e94e61720c1a441604b28a88a462fcca6f46f78e0860fcc8bf65626180a48e257ee09696778e36220758065686e53255189d

Download Submit
C:\Windows\System\EAYtTDr.exe

Filesize
3.1MB

MD5
171473cb6d3f50141acd18432be526aa

SHA1
619f8168b0afd6cf3a5a254baebf7c3a71b30c46

SHA256
afa0d968ade23b1e82edf9d7d92e37db57a6fe96bae9e39eb0492cba0c281e40

SHA512
5d78d1eab8303a693c44f7b0adea884efb97a863cfc3d85ee44c8c99d3fed8108a658873993c2e7032246ff81645666235ef3d59984963ca13e11345bc941482

Download Submit
C:\Windows\System\GeQPYqv.exe

Filesize
3.1MB

MD5
d98fefda74a4fe88c2e4de323068aff1

SHA1
f10dbd2bfcf49b450964f730b3bd5f3ad5481924

SHA256
490ad03cea4bbcff705cb84c09409c36df8277ae30e3a2d0e5b4e9dc12129c1a

SHA512
6759139047a21241232123054329767343f4ecf0a6d5ea49fa66dea85e2fbfb7bec95f83da2495359dbb0630c46a4fb782dfd99d6ec906aceed153793206360d

Download Submit
C:\Windows\System\GuorHrK.exe

Filesize
3.1MB

MD5
f88735ea208c47961d3f7f04c477d5e0

SHA1
564611711a0709a052b7e5b01cead3ad98be8f2f

SHA256
539b2cc40be48164c891fc01356b9aecdc24b16aab1c22ce246064dbf71e957e

SHA512
76f5a092a04728906356fb5884d5f14440628a58459a13564bf241c28a2f89234046baeda9a9b5fd208ca2a8f553f34cb81141d85ee9dd2a91f3a67017d79a96

Download Submit
C:\Windows\System\IDSGFub.exe

Filesize
3.1MB

MD5
bb208f4bc47b5216465b99adb3f28cb3

SHA1
7b08b29565b94cd2387d62e35711115f7fecd0f1

SHA256
ba9789d7bc17690a87d8500168da2ffbc3ec31ec92d139f5fb6afc1947015140

SHA512
8976fff05830f32a953463b5256eda169f635a3ce8cebb5349c5e5a0ccc7c047d23edfceb037a2c883e278a2b38e663f187fb4baa336b8b8a1f0df47eb56cfc4

Download Submit
C:\Windows\System\IFzaZej.exe

Filesize
3.1MB

MD5
d6b78c776c659ebbc8b44a3b1cfc0e90

SHA1
cebf1a4a6b43bec141534caeb247abb5caa3ca5b

SHA256
8b11c14ec6fbdac91c824f506d1791323cf0ba31eaecbe75002321f1e0239419

SHA512
1a2d58804b3b7ffa13ee2e94051c129ff56c43156099adced7d7186b95163b5c38c6beb530a765f851de7ebab02cb6e0be6addde9bb1aa4dd449dbf1610209ec

Download Submit
C:\Windows\System\IMXFHNP.exe

Filesize
3.1MB

MD5
bf573b09a531ca48b8ee9ff761090f3e

SHA1
eda71b6cea9f73fbada64df7fff8c20295f8a5d9

SHA256
8e25b68d1687abdea27205acbd0a8a6b588efc3f4c55d7e8d8d12e923924e2ab

SHA512
9574dbe507b462360f6560663f1bc49e9416131119a61d6baea0f940dd0865619df275149fd97232843daff8c64fa1e0fe47c46ea9c55ebd8da94c47f2d42dec

Download Submit
C:\Windows\System\QFBVXfp.exe

Filesize
3.1MB

MD5
7f6317b2e81cf960636c9f51810a9555

SHA1
8fb50f39c3d9d0896b9b8038f78c79eae3dbc2ed

SHA256
d630794c5e88cffc6c82637cbfce25aeffb9d8ff695877422a054e572a5b1a05

SHA512
af1c145aacad6d7a7a0d4b751752497fe150e0e08df40a0046973d23b215de35fe38d7edc99f9d1ec74966760041500229884ef00ccc247e24f4e414a6ee49a8

Download Submit
C:\Windows\System\SMTAfxB.exe

Filesize
3.1MB

MD5
f17fa1acf0b79b1660833519cb58f76b

SHA1
e6cebeeb4bd00a424f7fea1ab4275fa4970a5453

SHA256
679cd9b645bf6fa03f27e3416041efbc2dedda97e5784174c5f2b28e570d5cd5

SHA512
d4dc2bdecd8947021c3bdbf6913955404b442aa5f896cb5596cd8a11dad5c29fee99466ee4457ab045ec89fc5bb519eba9413879cc34bfc7c146de87de28579f

Download Submit
C:\Windows\System\SRUGZDG.exe

Filesize
3.1MB

MD5
533a78ef603b2fa57e9a597a9621dc72

SHA1
3df51f1c6c00572fc98a12281786bad553943f39

SHA256
e48d8611e89c0337395985c21bf674208964813717cfd4f092c6b020735b706a

SHA512
17683af0f52f1d184d822b9addcb2166ee0b7314bb57a634516c15a93022bdc082bcca7d05e7dc3abd4b4629b2dbf927fe7d405ebc646570d759f34dc646021d

Download Submit
C:\Windows\System\VUfSAGb.exe

Filesize
3.1MB

MD5
05ce312eaa00418db27522e5ac16119b

SHA1
097811ca8a7601a13b1e951f8cb29db9d98539a6

SHA256
2d76272a3244bb5b4197a365e863d494407aa976079457b587d56cc08cf28a50

SHA512
10ad777d6cb11b89b06a1ccc03bc24d8d9b0faf029d5f4f88c8dffc5ee4d15e8b3c1a5495b0490deb5524a656d6aa6ff2d30169cc3bccf5aa58d9f21fed8e522

Download Submit
C:\Windows\System\VrbaJia.exe

Filesize
3.1MB

MD5
5805c3fdf4291aaba8ecb29f0c8970ff

SHA1
5d8e29a669210ada0609b8c4ebd9573a3ae4c80e

SHA256
e02dc2edf5d7d1aff7de369889abe3ba42c7df2ed1622a1c57642ddbd43adb24

SHA512
725d21a4aef6b98bfebbb226234aee195e6dec43bd46c9e3a8172809aae4931d5713fb53794f26793ac58a0df54ed844a674fcf029c0c80b080665285053b847

Download Submit
C:\Windows\System\XVkIJtF.exe

Filesize
3.1MB

MD5
a59f9f287eda2da4899e079971e392a1

SHA1
d923f64b81be729dfff4a9f63546638524899103

SHA256
8d15737d1cfadb6b8db346202f468f017b6fab0028aa0d654623c3c6621f1438

SHA512
d4dc8cb8bb0ee05ed213c9cf3631d26f9c5ddb4671cc5de2c27a6b409a831c8a33bc11545ae7614c3d6097fbc2d212d234437b71662ebc981530427253e34cb1

Download Submit
C:\Windows\System\cAcqJWW.exe

Filesize
3.1MB

MD5
21fba03a10fddb0ee7bb5dc788415c79

SHA1
35e3c6bdaa266aa44d903449a079dded5ab94edc

SHA256
9dfb85e7f0d534906ed8053506c75555df79c257b80966e77d3e4012df8f60d6

SHA512
98d81249e59df038e5957a4335cbbeadfd572a3e5a30ea1ce6d5a4bcf97e9263c4707804991c502d7dc61cabc92beb9feae90020734ad7a1ac593730abbaa593

Download Submit
C:\Windows\System\dPezLkc.exe

Filesize
3.1MB

MD5
30f57577df070a9a57cec00c5f1082a9

SHA1
3f3c4e2e2e083ecbde41029747ec7074152b4269

SHA256
a1e26f2d34dd44385f8b3f6a486360acfbea51960f6d61e171c217c28fd17a63

SHA512
f84bc9538d63e992e1d31bd2aa2eb017c8860668879c177a0b10d8949d4afc7c5de790eb356a41158712260f4f78e579d37da3c20f4e9c479124c23db5a5e685

Download Submit
C:\Windows\System\dkHUjuu.exe

Filesize
3.1MB

MD5
1142501999359f8d9624a4c2717e4f38

SHA1
b08193fe66c78933db4991887b4a98b64b53808d

SHA256
0ba088b781f87a6e21b68ad8fe08fb31c068b036f6c2c16bb118c49ef3fcd700

SHA512
ec03af9d480ebc27c8473f5956d90d0fb468d089d8897723046c3014fda177b9a813e021d58f19a99b8fd8d6d39f9eabbeb33ee1f6589248b94132089645e74e

Download Submit
C:\Windows\System\hInKVlm.exe

Filesize
3.1MB

MD5
b2833f57a2640c84611525b765e453c0

SHA1
caeb0254c961367485198067f2ce0e53b6b951fd

SHA256
f9ef01f4aa1de995477d6c204bc0922fb8057e580263df7164c1f2d34ba3e945

SHA512
7345b03141eb7259109ae7555d774b332fa894fbd88377423f1ad69ec1afd28c8e0416613828c13dd97d40b26ac024915656fdde6a744df55ee070328dce16db

Download Submit
C:\Windows\System\jnBaQyF.exe

Filesize
3.1MB

MD5
7c647819b5d233f64119083da2010e36

SHA1
ed27e8e50231c68b0a0c73b972036b53c268fd9e

SHA256
93db939042cbff12b7d2e6d04ac069f44e4a67c4edbbd2c9038f730294955e41

SHA512
f3ea2a64671e1f615e271198990fb91954c6beba64597638a5c15a92242d5f6886f41f02aa2f7e5eab37d6480b48a5b11445a7b7629591d56567059b720eacdb

Download Submit
C:\Windows\System\mMIKPmu.exe

Filesize
3.1MB

MD5
b46ace44e4bf73d0bd5749c11a3843f2

SHA1
025a63422c7273ec78c77e44df99b220ee9402a2

SHA256
4e22734c41a530d06523b772ace418c50b1df8e420aa9b461168d02eaaeef129

SHA512
d6181b0a181d779dba25c114218a329d3d4d7ffee3d29402cd712ab716e69cb0b7c88eed12cd39ef00b66762e3d89c1fc22d00a84af24b71cd9fde3097bb999e

Download Submit
C:\Windows\System\oRxZPZI.exe

Filesize
3.1MB

MD5
677a9596184d600fa2ad87fe26153a74

SHA1
57765b448e81619a405562d445a9f3ec2ee81edc

SHA256
de32cfd4c03cbb1c98adf2dd66de1945a5d5f6307dc480ba440b9ab341076ae5

SHA512
063e6ec9b11325f8c21db54e5952ac9329390b61b8a6fa9673f74262ba21effe83b620a7320ef4f9606fafbdb3ff9a5e2caf802e5de2f33c5aee32bf718d11f8

Download Submit
C:\Windows\System\pAqLdXE.exe

Filesize
3.1MB

MD5
3bdda05bbec7ce14e11151e73f562920

SHA1
1ef27a7fd6d1377b95b4e8eaea5f7b4b717df0fd

SHA256
ae8acb06aa7ac55d0a7a87760b34c87d514447bad651a5b44a1f7bb600f9222d

SHA512
809b46a113c0029ac1457cb5bec01102b1979021c269800c4bb53d7dead271472117c072171490e4c31b99ffb937728c3729ccc88f1052413655f4504b959857

Download Submit
C:\Windows\System\pLwZkmH.exe

Filesize
3.1MB

MD5
608b7727920f2b4cf70ed3cb7f082da3

SHA1
fa65c58c4d8ec34a2df70b93c54c4726715fa1f4

SHA256
2c73959f46f87a89fa4d1f1b0a8cbfef5c664a1baf426822b2813f26fd1beaf1

SHA512
880b1e1e496e6ff8cb7ec6fc1b8889c08cd97fbc6d4ea028e9a322d1c50cd7c2566c23e7deabde54ba849b499a2027d8d1d77ff0495197c6ba1c614422e138d3

Download Submit
C:\Windows\System\plsJamS.exe

Filesize
8B

MD5
9cb4bf9fd9671df0839f651b7291ada1

SHA1
65a07e22b4bb88cf278eb1826c308150ded29593

SHA256
7188099eb9c8547d41ed9f4696ce901a0066852814ae83835a5ed6cbffc1cf40

SHA512
6f35a15b3248c656029fbcfa880774f447f590d87875077936e1e0e583b3b4b43f507832937ba7994137923090cc3abaa893880b066cf5189f7fd87f77593929

Download Submit
C:\Windows\System\qWLFscj.exe

Filesize
3.1MB

MD5
f4ea7d865c359a19150d6f50e4eeec73

SHA1
6d7fe083205fe351f027bf9ddb76e6a466345ed3

SHA256
5e9aed65708474a06e45115e4eb2d5f66c85b25fe082f3d8f85c1789c4028ae3

SHA512
c2dc5fd065abd7206b356bef54a2c8e98830bd90731b9bf2b7a8ef07f0d2b9584de058e0de770e3f42d5c2272a5bff53b35384427e89720d8672790209c21839

Download Submit
C:\Windows\System\qWQUpAX.exe

Filesize
3.1MB

MD5
f12711866982cf80bd41fdda02b1bf86

SHA1
5e79b9e640c95498eb6d072f9446b153fc844c29

SHA256
5c3e1c53922236aa3cb71d2f1e19a59b89c02dffd99095e5e3959853b3f5d585

SHA512
9e14663cfd213cfbec220176e8245a00817bd21a12d4b5637e2966193771fe1ee53db0048393d0e641fb1bfbc841e99b3eead433c0d4fa193bf21be726761910

Download Submit
C:\Windows\System\sHgCZOy.exe

Filesize
3.1MB

MD5
b879d3bcb38372203c487b215a4a2e99

SHA1
a979ca69ca52a0f8ad3b99d6e3a5afea2681510c

SHA256
d77df87b59ada0f546379a2618db89f1bc8fddb69f4e24f30d5523ac1617b46d

SHA512
4bd81c54f20cdf63dbe4439f06f30ee3e8bf85276adcf04621e91deb028f05e9599cc63526d5f9fbc27769fd6188bced39b163d5048f0132ede47bdf88980d34

Download Submit
C:\Windows\System\szbDKhX.exe

Filesize
3.1MB

MD5
38546c5c746fe811ea632342da9d4d7f

SHA1
d60ab22201aecda9faf8bdbe9ccb9e66159ef3f5

SHA256
6b299474a607be026ea507b91c730a4e0ce6e36f659a63c5d124638c069acfce

SHA512
d85750773096be567afb234bf6d515a38086b73e550c538b42c082f2f863e743f54d74740f68ec29317b7e2c18517d09f784b5f9812a7c9585c91a407d7bdd73

Download Submit
C:\Windows\System\vEILjpe.exe

Filesize
3.1MB

MD5
728e5ddf53523daca92087385b92cbe5

SHA1
54cadc843636310794624394be98d772a070e4ac

SHA256
d0a37bb59cf2139a5a759516649400e309c51d350a57f7277bf70d0f026af99f

SHA512
97a9faab830c7b44976e15c5256a95cf38aa96784ed39220f2133c713d8785d4f283abd5b23aeccaf15412e5409bee06ed035a74e8bd5fdf0c1622f296a993aa

Download Submit
C:\Windows\System\vTDAgDX.exe

Filesize
3.1MB

MD5
88da4173381246a76df767bb54a493a6

SHA1
a3a9b79d128fa4fa619da94ba6e55e042edb10d5

SHA256
4c37be453e8a9706b9f3c22fe15f57c107bf202b40f1fd052f541f1c8e2ca6b7

SHA512
0c0d8ee8e0c028d87a49aab80ba75d147f5147621b5bb799fd3bf090adf56f1658f26afbc207b8926667e9333a57dda41fc982e8a41a48cbc024bc023ffad6fc

Download Submit
C:\Windows\System\vlfdsDd.exe

Filesize
3.1MB

MD5
d66bc82867b6ccc6689c3e9c284a6c7f

SHA1
e2e79b88106690baed44ca321592cc00f59d189c

SHA256
0af1a47dde1b13902d5777719918b6f67d848d85c8a2284eae3180d5a8615063

SHA512
0ef17fa78faf9bf556cb734e89779afbeeb4c6015a84564cd17f1ac3073dfebf2656c44d1a7859cc7de78a3d3d210d1010ee9cc6ab2746cd536f9c328b80c525

Download Submit
C:\Windows\System\wngSCHl.exe

Filesize
3.1MB

MD5
a83b5c7fc75e745b47830d11ea9144be

SHA1
b6a20bc8790fa9801ad51a4ddf1229c48443821b

SHA256
3541bcfcb6342d715c805219eeb915e6dc29b60ac83a04b41873b9e12399d115

SHA512
b6b7acb1f34d25649eb40072222b1075646235ac21dfa0b96d2314953e724c21d8815d79f64e36c85f4f32edfab9ec0cbf2d0dd69af12a67209b288559f2cfcc

Download Submit
C:\Windows\System\xDcAdts.exe

Filesize
3.1MB

MD5
86b47c782f11d950364807e6ecaba992

SHA1
3a0e52d51a7544e051c3ddba76fb5360625ed5c5

SHA256
9c2abd8ecf0087318897048e666e2b51c82032c96d8f83de21c7c9cc3b51bbe5

SHA512
949c0e212eae9f6737418f00117885df73dc94535d5e105b9d337b790d71e24ecf7ca41ca409f250b3582b112a6cdc8431c71b80e43724497e7c178f39873385

Download Submit
memory/224-2117-0x00007FF6EC750000-0x00007FF6ECB46000-memory.dmp

Filesize
4.0MB

Download
memory/224-175-0x00007FF6EC750000-0x00007FF6ECB46000-memory.dmp

Filesize
4.0MB

Download
memory/440-179-0x00007FF73F4F0000-0x00007FF73F8E6000-memory.dmp

Filesize
4.0MB

Download
memory/440-2106-0x00007FF73F4F0000-0x00007FF73F8E6000-memory.dmp

Filesize
4.0MB

Download
memory/460-114-0x00007FF697850000-0x00007FF697C46000-memory.dmp

Filesize
4.0MB

Download
memory/460-2107-0x00007FF697850000-0x00007FF697C46000-memory.dmp

Filesize
4.0MB

Download
memory/652-2108-0x00007FF68A7A0000-0x00007FF68AB96000-memory.dmp

Filesize
4.0MB

Download
memory/652-134-0x00007FF68A7A0000-0x00007FF68AB96000-memory.dmp

Filesize
4.0MB

Download
memory/868-171-0x00007FF704570000-0x00007FF704966000-memory.dmp

Filesize
4.0MB

Download
memory/868-2126-0x00007FF704570000-0x00007FF704966000-memory.dmp

Filesize
4.0MB

Download
memory/1468-158-0x00007FF6B43D0000-0x00007FF6B47C6000-memory.dmp

Filesize
4.0MB

Download
memory/1468-2113-0x00007FF6B43D0000-0x00007FF6B47C6000-memory.dmp

Filesize
4.0MB

Download
memory/1760-167-0x00007FF7C8A50000-0x00007FF7C8E46000-memory.dmp

Filesize
4.0MB

Download
memory/1760-2114-0x00007FF7C8A50000-0x00007FF7C8E46000-memory.dmp

Filesize
4.0MB

Download
memory/1908-2105-0x00007FF66C3E0000-0x00007FF66C7D6000-memory.dmp

Filesize
4.0MB

Download
memory/1908-97-0x00007FF66C3E0000-0x00007FF66C7D6000-memory.dmp

Filesize
4.0MB

Download
memory/1996-2112-0x00007FF606D00000-0x00007FF6070F6000-memory.dmp

Filesize
4.0MB

Download
memory/1996-157-0x00007FF606D00000-0x00007FF6070F6000-memory.dmp

Filesize
4.0MB

Download
memory/2184-183-0x00007FF6075C0000-0x00007FF6079B6000-memory.dmp

Filesize
4.0MB

Download
memory/2184-2122-0x00007FF6075C0000-0x00007FF6079B6000-memory.dmp

Filesize
4.0MB

Download
memory/2268-2110-0x00007FF7A5890000-0x00007FF7A5C86000-memory.dmp

Filesize
4.0MB

Download
memory/2268-154-0x00007FF7A5890000-0x00007FF7A5C86000-memory.dmp

Filesize
4.0MB

Download
memory/2364-2124-0x00007FF7B7AC0000-0x00007FF7B7EB6000-memory.dmp

Filesize
4.0MB

Download
memory/2364-170-0x00007FF7B7AC0000-0x00007FF7B7EB6000-memory.dmp

Filesize
4.0MB

Download
memory/2744-176-0x00007FF7F1740000-0x00007FF7F1B36000-memory.dmp

Filesize
4.0MB

Download
memory/2744-2119-0x00007FF7F1740000-0x00007FF7F1B36000-memory.dmp

Filesize
4.0MB

Download
memory/3140-2103-0x00007FF683C80000-0x00007FF684076000-memory.dmp

Filesize
4.0MB

Download
memory/3140-17-0x00007FF683C80000-0x00007FF684076000-memory.dmp

Filesize
4.0MB

Download
memory/3220-181-0x00007FF7AE670000-0x00007FF7AEA66000-memory.dmp

Filesize
4.0MB

Download
memory/3220-2115-0x00007FF7AE670000-0x00007FF7AEA66000-memory.dmp

Filesize
4.0MB

Download
memory/3992-0-0x00007FF7F5CD0000-0x00007FF7F60C6000-memory.dmp

Filesize
4.0MB

Download
memory/3992-1-0x000001F9320F0000-0x000001F932100000-memory.dmp

Filesize
64KB

Download
memory/4088-172-0x00007FF704E70000-0x00007FF705266000-memory.dmp

Filesize
4.0MB

Download
memory/4088-2123-0x00007FF704E70000-0x00007FF705266000-memory.dmp

Filesize
4.0MB

Download
memory/4268-2109-0x00007FF614E00000-0x00007FF6151F6000-memory.dmp

Filesize
4.0MB

Download
memory/4268-118-0x00007FF614E00000-0x00007FF6151F6000-memory.dmp

Filesize
4.0MB

Download
memory/4444-173-0x00007FF6307E0000-0x00007FF630BD6000-memory.dmp

Filesize
4.0MB

Download
memory/4444-2125-0x00007FF6307E0000-0x00007FF630BD6000-memory.dmp

Filesize
4.0MB

Download
memory/4452-174-0x00007FF652660000-0x00007FF652A56000-memory.dmp

Filesize
4.0MB

Download
memory/4452-2116-0x00007FF652660000-0x00007FF652A56000-memory.dmp

Filesize
4.0MB

Download
memory/4576-185-0x000001CD00000000-0x000001CD007A6000-memory.dmp

Filesize
7.6MB

Download
memory/4576-75-0x00007FFA9F5F0000-0x00007FFAA00B1000-memory.dmp

Filesize
10.8MB

Download
memory/4576-2102-0x00007FFA9F5F3000-0x00007FFA9F5F5000-memory.dmp

Filesize
8KB

Download
memory/4576-2101-0x00007FFA9F5F0000-0x00007FFAA00B1000-memory.dmp

Filesize
10.8MB

Download
memory/4576-71-0x000001CCFF090000-0x000001CCFF0B2000-memory.dmp

Filesize
136KB

Download
memory/4576-47-0x00007FFA9F5F0000-0x00007FFAA00B1000-memory.dmp

Filesize
10.8MB

Download
memory/4576-18-0x00007FFA9F5F3000-0x00007FFA9F5F5000-memory.dmp

Filesize
8KB

Download
memory/4764-2121-0x00007FF627940000-0x00007FF627D36000-memory.dmp

Filesize
4.0MB

Download
memory/4764-182-0x00007FF627940000-0x00007FF627D36000-memory.dmp

Filesize
4.0MB

Download
memory/4792-2120-0x00007FF6B8140000-0x00007FF6B8536000-memory.dmp

Filesize
4.0MB

Download
memory/4792-184-0x00007FF6B8140000-0x00007FF6B8536000-memory.dmp

Filesize
4.0MB

Download
memory/4808-2111-0x00007FF72A300000-0x00007FF72A6F6000-memory.dmp

Filesize
4.0MB

Download
memory/4808-180-0x00007FF72A300000-0x00007FF72A6F6000-memory.dmp

Filesize
4.0MB

Download
memory/4972-177-0x00007FF6A9010000-0x00007FF6A9406000-memory.dmp

Filesize
4.0MB

Download
memory/4972-2118-0x00007FF6A9010000-0x00007FF6A9406000-memory.dmp

Filesize
4.0MB

Download
memory/4984-178-0x00007FF673790000-0x00007FF673B86000-memory.dmp

Filesize
4.0MB

Download
memory/4984-2104-0x00007FF673790000-0x00007FF673B86000-memory.dmp

Filesize
4.0MB

Download