xmrig | 929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c

Analysis

max time kernel
96s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
Size

3.3MB
MD5

43efe9b4ea703687fdfbf68953f92e7c
SHA1

98abc2bb8fcd7c21dc7ebed9182038f1e449eaf2
SHA256

929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c
SHA512

24690ce917c3d347a731130fe3fb5484d0dc9119c4372436ab5a3d474328860f130395d5111b1c4ef0063cb1df62dd44f3c77873d33843aad6be021ca472a30e
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWF:7bBeSFkh

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3124-0-0x00007FF695C10000-0x00007FF696006000-memory.dmp	xmrig
behavioral2/files/0x0007000000023442-8.dat	xmrig
behavioral2/files/0x0008000000023441-9.dat	xmrig
behavioral2/files/0x0007000000023444-22.dat	xmrig
behavioral2/files/0x000700000002344a-58.dat	xmrig
behavioral2/files/0x0007000000023450-96.dat	xmrig
behavioral2/memory/3376-113-0x00007FF7E0FF0000-0x00007FF7E13E6000-memory.dmp	xmrig
behavioral2/memory/2252-124-0x00007FF6FEA10000-0x00007FF6FEE06000-memory.dmp	xmrig
behavioral2/memory/4424-132-0x00007FF6B7E70000-0x00007FF6B8266000-memory.dmp	xmrig
behavioral2/memory/4056-135-0x00007FF72B0D0000-0x00007FF72B4C6000-memory.dmp	xmrig
behavioral2/memory/1180-139-0x00007FF69E400000-0x00007FF69E7F6000-memory.dmp	xmrig
behavioral2/memory/3436-141-0x00007FF6FAC30000-0x00007FF6FB026000-memory.dmp	xmrig
behavioral2/memory/3920-140-0x00007FF713280000-0x00007FF713676000-memory.dmp	xmrig
behavioral2/memory/1300-138-0x00007FF773100000-0x00007FF7734F6000-memory.dmp	xmrig
behavioral2/memory/3760-137-0x00007FF67B6E0000-0x00007FF67BAD6000-memory.dmp	xmrig
behavioral2/memory/1072-136-0x00007FF63E330000-0x00007FF63E726000-memory.dmp	xmrig
behavioral2/memory/3636-134-0x00007FF759D90000-0x00007FF75A186000-memory.dmp	xmrig
behavioral2/memory/728-133-0x00007FF6CEBA0000-0x00007FF6CEF96000-memory.dmp	xmrig
behavioral2/memory/2232-131-0x00007FF7B60C0000-0x00007FF7B64B6000-memory.dmp	xmrig
behavioral2/memory/1708-130-0x00007FF6E4A50000-0x00007FF6E4E46000-memory.dmp	xmrig
behavioral2/memory/224-129-0x00007FF786020000-0x00007FF786416000-memory.dmp	xmrig
behavioral2/files/0x0007000000023454-127.dat	xmrig
behavioral2/files/0x0007000000023453-125.dat	xmrig
behavioral2/memory/2804-123-0x00007FF7CC700000-0x00007FF7CCAF6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023452-121.dat	xmrig
behavioral2/files/0x0008000000023447-119.dat	xmrig
behavioral2/files/0x0007000000023451-114.dat	xmrig
behavioral2/files/0x0007000000023446-108.dat	xmrig
behavioral2/files/0x000700000002344c-104.dat	xmrig
behavioral2/memory/676-102-0x00007FF73D400000-0x00007FF73D7F6000-memory.dmp	xmrig
behavioral2/files/0x000700000002344f-97.dat	xmrig
behavioral2/files/0x000700000002344e-92.dat	xmrig
behavioral2/files/0x0008000000023448-84.dat	xmrig
behavioral2/files/0x000700000002344d-89.dat	xmrig
behavioral2/files/0x0007000000023449-68.dat	xmrig
behavioral2/files/0x000700000002344b-76.dat	xmrig
behavioral2/files/0x0007000000023445-59.dat	xmrig
behavioral2/memory/4480-53-0x00007FF73CC70000-0x00007FF73D066000-memory.dmp	xmrig
behavioral2/files/0x0007000000023443-29.dat	xmrig
behavioral2/memory/464-26-0x00007FF6444A0000-0x00007FF644896000-memory.dmp	xmrig
behavioral2/memory/1152-25-0x00007FF711E30000-0x00007FF712226000-memory.dmp	xmrig
behavioral2/memory/3404-24-0x00007FF7D4CE0000-0x00007FF7D50D6000-memory.dmp	xmrig
behavioral2/files/0x00090000000233db-10.dat	xmrig
behavioral2/files/0x0007000000023455-259.dat	xmrig
behavioral2/files/0x000800000002343f-274.dat	xmrig
behavioral2/files/0x000700000002347e-285.dat	xmrig
behavioral2/memory/4628-293-0x00007FF673950000-0x00007FF673D46000-memory.dmp	xmrig
behavioral2/files/0x0007000000023482-300.dat	xmrig
behavioral2/files/0x0007000000023483-310.dat	xmrig
behavioral2/files/0x0007000000023480-307.dat	xmrig
behavioral2/files/0x000700000002347d-288.dat	xmrig
behavioral2/memory/3528-282-0x00007FF7B1A50000-0x00007FF7B1E46000-memory.dmp	xmrig
behavioral2/memory/1516-278-0x00007FF6CC9B0000-0x00007FF6CCDA6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023489-323.dat	xmrig
behavioral2/files/0x0007000000023486-320.dat	xmrig
behavioral2/files/0x000700000002348a-336.dat	xmrig
behavioral2/files/0x000700000002348d-341.dat	xmrig
behavioral2/memory/3124-1496-0x00007FF695C10000-0x00007FF696006000-memory.dmp	xmrig
behavioral2/memory/4480-1840-0x00007FF73CC70000-0x00007FF73D066000-memory.dmp	xmrig
behavioral2/memory/464-2136-0x00007FF6444A0000-0x00007FF644896000-memory.dmp	xmrig
behavioral2/memory/1516-2396-0x00007FF6CC9B0000-0x00007FF6CCDA6000-memory.dmp	xmrig
behavioral2/memory/3528-2397-0x00007FF7B1A50000-0x00007FF7B1E46000-memory.dmp	xmrig
behavioral2/memory/676-2398-0x00007FF73D400000-0x00007FF73D7F6000-memory.dmp	xmrig
behavioral2/memory/3404-2399-0x00007FF7D4CE0000-0x00007FF7D50D6000-memory.dmp	xmrig

Blocklisted process makes network request 10 IoCs

flow	pid	Process
3	2580	powershell.exe
5	2580	powershell.exe
7	2580	powershell.exe
8	2580	powershell.exe
10	2580	powershell.exe
11	2580	powershell.exe
13	2580	powershell.exe
24	2580	powershell.exe
26	2580	powershell.exe
27	2580	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2580	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
676	uFyHkfd.exe
3404	niqhpSV.exe
1152	dZjafhu.exe
464	DeXcPir.exe
4480	MkyTHep.exe
3376	hulkXns.exe
1180	FQuaVUN.exe
2804	kNlrYat.exe
2252	pfgmpDy.exe
224	FOAtCPS.exe
1708	LahVwZQ.exe
2232	gYZlGdy.exe
4424	nSAgliG.exe
728	LPczHLr.exe
3636	TIVBiyv.exe
3920	bQTuGSC.exe
4056	ETnTDbD.exe
3436	VCTNQUi.exe
1072	NQXKzqI.exe
3760	cYrgehq.exe
1300	pBayNZS.exe
1516	iUspaES.exe
4628	RDvHwYw.exe
3528	FnJNNmf.exe
2052	jcHoXfQ.exe
2120	GWAWmKv.exe
4364	UgxRInl.exe
2796	UrasoRi.exe
4720	caKCZLu.exe
1980	xBWjWQj.exe
3676	giNTPzd.exe
3912	Ucklrlr.exe
1508	nyYaKuA.exe
4344	AGrojbI.exe
3660	HmCXArX.exe
2152	JidijTU.exe
2920	sqJnHMA.exe
1316	DLJfNwi.exe
4592	elHLniT.exe
1612	ELQGccc.exe
4212	QhAELsV.exe
5104	CbpkTbG.exe
2224	zsAQrNu.exe
3468	ZeQkySg.exe
928	VHnXCWF.exe
2492	thfMLdG.exe
2672	IQqTJvv.exe
1260	CXLbjYr.exe
1968	IgmUgzH.exe
4660	NXExDHi.exe
844	BusWejr.exe
4820	HdGCZYF.exe
4588	pMvuPZf.exe
5056	NKEFPWd.exe
2800	wFuBcpZ.exe
2760	jabDswN.exe
3080	itvWwLU.exe
4676	GzjJxrM.exe
3932	SQtTicj.exe
3720	HtnPMCA.exe
5036	gfOaaxm.exe
4416	BbwWOTx.exe
3656	FmDDVZy.exe
2572	fTKWXJG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3124-0-0x00007FF695C10000-0x00007FF696006000-memory.dmp	upx
behavioral2/files/0x0007000000023442-8.dat	upx
behavioral2/files/0x0008000000023441-9.dat	upx
behavioral2/files/0x0007000000023444-22.dat	upx
behavioral2/files/0x000700000002344a-58.dat	upx
behavioral2/files/0x0007000000023450-96.dat	upx
behavioral2/memory/3376-113-0x00007FF7E0FF0000-0x00007FF7E13E6000-memory.dmp	upx
behavioral2/memory/2252-124-0x00007FF6FEA10000-0x00007FF6FEE06000-memory.dmp	upx
behavioral2/memory/4424-132-0x00007FF6B7E70000-0x00007FF6B8266000-memory.dmp	upx
behavioral2/memory/4056-135-0x00007FF72B0D0000-0x00007FF72B4C6000-memory.dmp	upx
behavioral2/memory/1180-139-0x00007FF69E400000-0x00007FF69E7F6000-memory.dmp	upx
behavioral2/memory/3436-141-0x00007FF6FAC30000-0x00007FF6FB026000-memory.dmp	upx
behavioral2/memory/3920-140-0x00007FF713280000-0x00007FF713676000-memory.dmp	upx
behavioral2/memory/1300-138-0x00007FF773100000-0x00007FF7734F6000-memory.dmp	upx
behavioral2/memory/3760-137-0x00007FF67B6E0000-0x00007FF67BAD6000-memory.dmp	upx
behavioral2/memory/1072-136-0x00007FF63E330000-0x00007FF63E726000-memory.dmp	upx
behavioral2/memory/3636-134-0x00007FF759D90000-0x00007FF75A186000-memory.dmp	upx
behavioral2/memory/728-133-0x00007FF6CEBA0000-0x00007FF6CEF96000-memory.dmp	upx
behavioral2/memory/2232-131-0x00007FF7B60C0000-0x00007FF7B64B6000-memory.dmp	upx
behavioral2/memory/1708-130-0x00007FF6E4A50000-0x00007FF6E4E46000-memory.dmp	upx
behavioral2/memory/224-129-0x00007FF786020000-0x00007FF786416000-memory.dmp	upx
behavioral2/files/0x0007000000023454-127.dat	upx
behavioral2/files/0x0007000000023453-125.dat	upx
behavioral2/memory/2804-123-0x00007FF7CC700000-0x00007FF7CCAF6000-memory.dmp	upx
behavioral2/files/0x0007000000023452-121.dat	upx
behavioral2/files/0x0008000000023447-119.dat	upx
behavioral2/files/0x0007000000023451-114.dat	upx
behavioral2/files/0x0007000000023446-108.dat	upx
behavioral2/files/0x000700000002344c-104.dat	upx
behavioral2/memory/676-102-0x00007FF73D400000-0x00007FF73D7F6000-memory.dmp	upx
behavioral2/files/0x000700000002344f-97.dat	upx
behavioral2/files/0x000700000002344e-92.dat	upx
behavioral2/files/0x0008000000023448-84.dat	upx
behavioral2/files/0x000700000002344d-89.dat	upx
behavioral2/files/0x0007000000023449-68.dat	upx
behavioral2/files/0x000700000002344b-76.dat	upx
behavioral2/files/0x0007000000023445-59.dat	upx
behavioral2/memory/4480-53-0x00007FF73CC70000-0x00007FF73D066000-memory.dmp	upx
behavioral2/files/0x0007000000023443-29.dat	upx
behavioral2/memory/464-26-0x00007FF6444A0000-0x00007FF644896000-memory.dmp	upx
behavioral2/memory/1152-25-0x00007FF711E30000-0x00007FF712226000-memory.dmp	upx
behavioral2/memory/3404-24-0x00007FF7D4CE0000-0x00007FF7D50D6000-memory.dmp	upx
behavioral2/files/0x00090000000233db-10.dat	upx
behavioral2/files/0x0007000000023455-259.dat	upx
behavioral2/files/0x000800000002343f-274.dat	upx
behavioral2/files/0x000700000002347e-285.dat	upx
behavioral2/memory/4628-293-0x00007FF673950000-0x00007FF673D46000-memory.dmp	upx
behavioral2/files/0x0007000000023482-300.dat	upx
behavioral2/files/0x0007000000023483-310.dat	upx
behavioral2/files/0x0007000000023480-307.dat	upx
behavioral2/files/0x000700000002347d-288.dat	upx
behavioral2/memory/3528-282-0x00007FF7B1A50000-0x00007FF7B1E46000-memory.dmp	upx
behavioral2/memory/1516-278-0x00007FF6CC9B0000-0x00007FF6CCDA6000-memory.dmp	upx
behavioral2/files/0x0007000000023489-323.dat	upx
behavioral2/files/0x0007000000023486-320.dat	upx
behavioral2/files/0x000700000002348a-336.dat	upx
behavioral2/files/0x000700000002348d-341.dat	upx
behavioral2/memory/3124-1496-0x00007FF695C10000-0x00007FF696006000-memory.dmp	upx
behavioral2/memory/4480-1840-0x00007FF73CC70000-0x00007FF73D066000-memory.dmp	upx
behavioral2/memory/464-2136-0x00007FF6444A0000-0x00007FF644896000-memory.dmp	upx
behavioral2/memory/1516-2396-0x00007FF6CC9B0000-0x00007FF6CCDA6000-memory.dmp	upx
behavioral2/memory/3528-2397-0x00007FF7B1A50000-0x00007FF7B1E46000-memory.dmp	upx
behavioral2/memory/676-2398-0x00007FF73D400000-0x00007FF73D7F6000-memory.dmp	upx
behavioral2/memory/3404-2399-0x00007FF7D4CE0000-0x00007FF7D50D6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pfgmpDy.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\ShYkwgU.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\ZYygrJX.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\FoMDQaF.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\dKAXuva.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\dTIdguB.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\rMTLrAW.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\iJlhcrQ.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\lJcpIAb.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\wgCbUMS.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\jHKDOdO.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\KocPaDM.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\THedeHx.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\hMmTqsO.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\TvFHpbm.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\KzSlEIR.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\PlEawok.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\uoqkwSg.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\qCekDNF.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\XkfYhhK.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\JJSGfQt.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\pBVDIuH.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\OyZKWSY.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\NwhAKRu.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\PMQbRZc.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\AisbiTR.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\IKPVKFg.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\PoFDsPF.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\moOdMmI.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\YZqCoJW.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\mfuTiLy.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\fuXlZqe.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\hyzcyHm.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\MSVjxRy.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\UnDHbuh.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\zteQMUi.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\gLznoGw.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\ulusJrL.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\asiCHkk.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\wVGPQJK.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\aQXhuWP.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\ERBikJz.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\kHxvjuY.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\rPWlFWf.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\JsYJRTb.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\JdJqMXZ.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\BBtOpro.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\wVPethG.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\EbCKiTY.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\zNMMUTZ.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\IeefevG.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\XwqNzgQ.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\vbuUSWb.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\SlubXtp.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\zPXWuQh.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\mlAWXkN.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\sjvshFd.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\stIOhIl.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\BjdPTZJ.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\bzrUkEu.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\EIvpecy.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\UCTcBRs.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\ydcFPky.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
File created	C:\Windows\System\iVEstch.exe	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2580	powershell.exe
2580	powershell.exe
2580	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeLockMemoryPrivilege	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
Token: SeLockMemoryPrivilege	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 2580	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	84
PID 3124 wrote to memory of 2580	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	84
PID 3124 wrote to memory of 676	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	85
PID 3124 wrote to memory of 676	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	85
PID 3124 wrote to memory of 3404	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	86
PID 3124 wrote to memory of 3404	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	86
PID 3124 wrote to memory of 1152	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	87
PID 3124 wrote to memory of 1152	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	87
PID 3124 wrote to memory of 464	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	88
PID 3124 wrote to memory of 464	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	88
PID 3124 wrote to memory of 4480	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	89
PID 3124 wrote to memory of 4480	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	89
PID 3124 wrote to memory of 3376	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	90
PID 3124 wrote to memory of 3376	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	90
PID 3124 wrote to memory of 1180	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	91
PID 3124 wrote to memory of 1180	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	91
PID 3124 wrote to memory of 2804	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	92
PID 3124 wrote to memory of 2804	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	92
PID 3124 wrote to memory of 2252	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	93
PID 3124 wrote to memory of 2252	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	93
PID 3124 wrote to memory of 224	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	94
PID 3124 wrote to memory of 224	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	94
PID 3124 wrote to memory of 2232	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	95
PID 3124 wrote to memory of 2232	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	95
PID 3124 wrote to memory of 1708	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	96
PID 3124 wrote to memory of 1708	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	96
PID 3124 wrote to memory of 4424	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	97
PID 3124 wrote to memory of 4424	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	97
PID 3124 wrote to memory of 728	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	98
PID 3124 wrote to memory of 728	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	98
PID 3124 wrote to memory of 3636	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	99
PID 3124 wrote to memory of 3636	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	99
PID 3124 wrote to memory of 3920	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	100
PID 3124 wrote to memory of 3920	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	100
PID 3124 wrote to memory of 4056	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	101
PID 3124 wrote to memory of 4056	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	101
PID 3124 wrote to memory of 3436	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	102
PID 3124 wrote to memory of 3436	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	102
PID 3124 wrote to memory of 1072	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	103
PID 3124 wrote to memory of 1072	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	103
PID 3124 wrote to memory of 3760	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	104
PID 3124 wrote to memory of 3760	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	104
PID 3124 wrote to memory of 1300	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	105
PID 3124 wrote to memory of 1300	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	105
PID 3124 wrote to memory of 1516	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	106
PID 3124 wrote to memory of 1516	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	106
PID 3124 wrote to memory of 3528	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	107
PID 3124 wrote to memory of 3528	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	107
PID 3124 wrote to memory of 4628	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	108
PID 3124 wrote to memory of 4628	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	108
PID 3124 wrote to memory of 2052	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	109
PID 3124 wrote to memory of 2052	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	109
PID 3124 wrote to memory of 2120	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	110
PID 3124 wrote to memory of 2120	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	110
PID 3124 wrote to memory of 4364	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	111
PID 3124 wrote to memory of 4364	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	111
PID 3124 wrote to memory of 2796	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	113
PID 3124 wrote to memory of 2796	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	113
PID 3124 wrote to memory of 4720	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	114
PID 3124 wrote to memory of 4720	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	114
PID 3124 wrote to memory of 1980	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	115
PID 3124 wrote to memory of 1980	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	115
PID 3124 wrote to memory of 3676	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	116
PID 3124 wrote to memory of 3676	3124	929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe	116

C:\Users\Admin\AppData\Local\Temp\929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe
"C:\Users\Admin\AppData\Local\Temp\929c199e5947e3b2e4e6ef3a9a90c023066a5d2dd8d53c3093de1db0a520a94c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\System\uFyHkfd.exe
  C:\Windows\System\uFyHkfd.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\niqhpSV.exe
  C:\Windows\System\niqhpSV.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\dZjafhu.exe
  C:\Windows\System\dZjafhu.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\DeXcPir.exe
  C:\Windows\System\DeXcPir.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\MkyTHep.exe
  C:\Windows\System\MkyTHep.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\hulkXns.exe
  C:\Windows\System\hulkXns.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\FQuaVUN.exe
  C:\Windows\System\FQuaVUN.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\kNlrYat.exe
  C:\Windows\System\kNlrYat.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\pfgmpDy.exe
  C:\Windows\System\pfgmpDy.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\FOAtCPS.exe
  C:\Windows\System\FOAtCPS.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\gYZlGdy.exe
  C:\Windows\System\gYZlGdy.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\LahVwZQ.exe
  C:\Windows\System\LahVwZQ.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\nSAgliG.exe
  C:\Windows\System\nSAgliG.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\LPczHLr.exe
  C:\Windows\System\LPczHLr.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\TIVBiyv.exe
  C:\Windows\System\TIVBiyv.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\bQTuGSC.exe
  C:\Windows\System\bQTuGSC.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\ETnTDbD.exe
  C:\Windows\System\ETnTDbD.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\VCTNQUi.exe
  C:\Windows\System\VCTNQUi.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\NQXKzqI.exe
  C:\Windows\System\NQXKzqI.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\cYrgehq.exe
  C:\Windows\System\cYrgehq.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\pBayNZS.exe
  C:\Windows\System\pBayNZS.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\iUspaES.exe
  C:\Windows\System\iUspaES.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\FnJNNmf.exe
  C:\Windows\System\FnJNNmf.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\RDvHwYw.exe
  C:\Windows\System\RDvHwYw.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\jcHoXfQ.exe
  C:\Windows\System\jcHoXfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\GWAWmKv.exe
  C:\Windows\System\GWAWmKv.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\UgxRInl.exe
  C:\Windows\System\UgxRInl.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\UrasoRi.exe
  C:\Windows\System\UrasoRi.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\caKCZLu.exe
  C:\Windows\System\caKCZLu.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\xBWjWQj.exe
  C:\Windows\System\xBWjWQj.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\giNTPzd.exe
  C:\Windows\System\giNTPzd.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\Ucklrlr.exe
  C:\Windows\System\Ucklrlr.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\nyYaKuA.exe
  C:\Windows\System\nyYaKuA.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\AGrojbI.exe
  C:\Windows\System\AGrojbI.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\HmCXArX.exe
  C:\Windows\System\HmCXArX.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\JidijTU.exe
  C:\Windows\System\JidijTU.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\sqJnHMA.exe
  C:\Windows\System\sqJnHMA.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\DLJfNwi.exe
  C:\Windows\System\DLJfNwi.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\elHLniT.exe
  C:\Windows\System\elHLniT.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\ELQGccc.exe
  C:\Windows\System\ELQGccc.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\QhAELsV.exe
  C:\Windows\System\QhAELsV.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\CbpkTbG.exe
  C:\Windows\System\CbpkTbG.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\zsAQrNu.exe
  C:\Windows\System\zsAQrNu.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\ZeQkySg.exe
  C:\Windows\System\ZeQkySg.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\VHnXCWF.exe
  C:\Windows\System\VHnXCWF.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\thfMLdG.exe
  C:\Windows\System\thfMLdG.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\IQqTJvv.exe
  C:\Windows\System\IQqTJvv.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\CXLbjYr.exe
  C:\Windows\System\CXLbjYr.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\IgmUgzH.exe
  C:\Windows\System\IgmUgzH.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\NXExDHi.exe
  C:\Windows\System\NXExDHi.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\BusWejr.exe
  C:\Windows\System\BusWejr.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\HdGCZYF.exe
  C:\Windows\System\HdGCZYF.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\pMvuPZf.exe
  C:\Windows\System\pMvuPZf.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\NKEFPWd.exe
  C:\Windows\System\NKEFPWd.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\wFuBcpZ.exe
  C:\Windows\System\wFuBcpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\jabDswN.exe
  C:\Windows\System\jabDswN.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\itvWwLU.exe
  C:\Windows\System\itvWwLU.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\GzjJxrM.exe
  C:\Windows\System\GzjJxrM.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\SQtTicj.exe
  C:\Windows\System\SQtTicj.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\HtnPMCA.exe
  C:\Windows\System\HtnPMCA.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\gfOaaxm.exe
  C:\Windows\System\gfOaaxm.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\BbwWOTx.exe
  C:\Windows\System\BbwWOTx.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\FmDDVZy.exe
  C:\Windows\System\FmDDVZy.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\fTKWXJG.exe
  C:\Windows\System\fTKWXJG.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\EIcyiJS.exe
  C:\Windows\System\EIcyiJS.exe
  2⤵
  PID:868
- C:\Windows\System\ntTqItX.exe
  C:\Windows\System\ntTqItX.exe
  2⤵
  PID:1760
- C:\Windows\System\OFzAKGL.exe
  C:\Windows\System\OFzAKGL.exe
  2⤵
  PID:3456
- C:\Windows\System\crJSdnU.exe
  C:\Windows\System\crJSdnU.exe
  2⤵
  PID:3928
- C:\Windows\System\ZGxxMvV.exe
  C:\Windows\System\ZGxxMvV.exe
  2⤵
  PID:4956
- C:\Windows\System\bCXbRcn.exe
  C:\Windows\System\bCXbRcn.exe
  2⤵
  PID:2536
- C:\Windows\System\vbuUSWb.exe
  C:\Windows\System\vbuUSWb.exe
  2⤵
  PID:2372
- C:\Windows\System\UBUTYal.exe
  C:\Windows\System\UBUTYal.exe
  2⤵
  PID:1492
- C:\Windows\System\FMXMXhc.exe
  C:\Windows\System\FMXMXhc.exe
  2⤵
  PID:2820
- C:\Windows\System\xtVoPWB.exe
  C:\Windows\System\xtVoPWB.exe
  2⤵
  PID:1648
- C:\Windows\System\qrUNpHB.exe
  C:\Windows\System\qrUNpHB.exe
  2⤵
  PID:852
- C:\Windows\System\bBMWkFT.exe
  C:\Windows\System\bBMWkFT.exe
  2⤵
  PID:1960
- C:\Windows\System\oetSFnT.exe
  C:\Windows\System\oetSFnT.exe
  2⤵
  PID:3384
- C:\Windows\System\dFNvdjF.exe
  C:\Windows\System\dFNvdjF.exe
  2⤵
  PID:1524
- C:\Windows\System\sTMslZg.exe
  C:\Windows\System\sTMslZg.exe
  2⤵
  PID:4812
- C:\Windows\System\TVOkPVA.exe
  C:\Windows\System\TVOkPVA.exe
  2⤵
  PID:2724
- C:\Windows\System\UjUMAhY.exe
  C:\Windows\System\UjUMAhY.exe
  2⤵
  PID:3580
- C:\Windows\System\AtvDOtN.exe
  C:\Windows\System\AtvDOtN.exe
  2⤵
  PID:1484
- C:\Windows\System\uhaLAkY.exe
  C:\Windows\System\uhaLAkY.exe
  2⤵
  PID:1336
- C:\Windows\System\NZKKRPZ.exe
  C:\Windows\System\NZKKRPZ.exe
  2⤵
  PID:1340
- C:\Windows\System\kbEDNvZ.exe
  C:\Windows\System\kbEDNvZ.exe
  2⤵
  PID:3860
- C:\Windows\System\quZhnZU.exe
  C:\Windows\System\quZhnZU.exe
  2⤵
  PID:4220
- C:\Windows\System\OdzmGAq.exe
  C:\Windows\System\OdzmGAq.exe
  2⤵
  PID:1540
- C:\Windows\System\HvKLLXR.exe
  C:\Windows\System\HvKLLXR.exe
  2⤵
  PID:3848
- C:\Windows\System\qwNshJb.exe
  C:\Windows\System\qwNshJb.exe
  2⤵
  PID:5088
- C:\Windows\System\uGzuQdg.exe
  C:\Windows\System\uGzuQdg.exe
  2⤵
  PID:3672
- C:\Windows\System\KoBCAYO.exe
  C:\Windows\System\KoBCAYO.exe
  2⤵
  PID:396
- C:\Windows\System\fpSQfiG.exe
  C:\Windows\System\fpSQfiG.exe
  2⤵
  PID:2244
- C:\Windows\System\fyCUgaE.exe
  C:\Windows\System\fyCUgaE.exe
  2⤵
  PID:3856
- C:\Windows\System\WpAFbJq.exe
  C:\Windows\System\WpAFbJq.exe
  2⤵
  PID:408
- C:\Windows\System\wnYTdma.exe
  C:\Windows\System\wnYTdma.exe
  2⤵
  PID:4708
- C:\Windows\System\ukqffhT.exe
  C:\Windows\System\ukqffhT.exe
  2⤵
  PID:5144
- C:\Windows\System\nSqaAqr.exe
  C:\Windows\System\nSqaAqr.exe
  2⤵
  PID:5176
- C:\Windows\System\fvtbrcp.exe
  C:\Windows\System\fvtbrcp.exe
  2⤵
  PID:5204
- C:\Windows\System\WDEsHUf.exe
  C:\Windows\System\WDEsHUf.exe
  2⤵
  PID:5232
- C:\Windows\System\wVPethG.exe
  C:\Windows\System\wVPethG.exe
  2⤵
  PID:5264
- C:\Windows\System\CoAZOqx.exe
  C:\Windows\System\CoAZOqx.exe
  2⤵
  PID:5300
- C:\Windows\System\PEbXKEC.exe
  C:\Windows\System\PEbXKEC.exe
  2⤵
  PID:5336
- C:\Windows\System\oYjlxzF.exe
  C:\Windows\System\oYjlxzF.exe
  2⤵
  PID:5368
- C:\Windows\System\EodkYME.exe
  C:\Windows\System\EodkYME.exe
  2⤵
  PID:5400
- C:\Windows\System\MBFFjZf.exe
  C:\Windows\System\MBFFjZf.exe
  2⤵
  PID:5432
- C:\Windows\System\TiWEGjy.exe
  C:\Windows\System\TiWEGjy.exe
  2⤵
  PID:5448
- C:\Windows\System\anvAshn.exe
  C:\Windows\System\anvAshn.exe
  2⤵
  PID:5492
- C:\Windows\System\ZYygrJX.exe
  C:\Windows\System\ZYygrJX.exe
  2⤵
  PID:5508
- C:\Windows\System\GVywfdR.exe
  C:\Windows\System\GVywfdR.exe
  2⤵
  PID:5552
- C:\Windows\System\UCTcBRs.exe
  C:\Windows\System\UCTcBRs.exe
  2⤵
  PID:5584
- C:\Windows\System\wVGPQJK.exe
  C:\Windows\System\wVGPQJK.exe
  2⤵
  PID:5604
- C:\Windows\System\TUtunQN.exe
  C:\Windows\System\TUtunQN.exe
  2⤵
  PID:5644
- C:\Windows\System\rhQqcTW.exe
  C:\Windows\System\rhQqcTW.exe
  2⤵
  PID:5664
- C:\Windows\System\ngXxVHo.exe
  C:\Windows\System\ngXxVHo.exe
  2⤵
  PID:5680
- C:\Windows\System\ydcFPky.exe
  C:\Windows\System\ydcFPky.exe
  2⤵
  PID:5704
- C:\Windows\System\KzSlEIR.exe
  C:\Windows\System\KzSlEIR.exe
  2⤵
  PID:5748
- C:\Windows\System\VJFABIc.exe
  C:\Windows\System\VJFABIc.exe
  2⤵
  PID:5792
- C:\Windows\System\OEyPvRp.exe
  C:\Windows\System\OEyPvRp.exe
  2⤵
  PID:5820
- C:\Windows\System\GqTBmwA.exe
  C:\Windows\System\GqTBmwA.exe
  2⤵
  PID:5860
- C:\Windows\System\dTIdguB.exe
  C:\Windows\System\dTIdguB.exe
  2⤵
  PID:5888
- C:\Windows\System\lEtyXKL.exe
  C:\Windows\System\lEtyXKL.exe
  2⤵
  PID:5928
- C:\Windows\System\nDNawvy.exe
  C:\Windows\System\nDNawvy.exe
  2⤵
  PID:5960
- C:\Windows\System\RgQxALh.exe
  C:\Windows\System\RgQxALh.exe
  2⤵
  PID:5988
- C:\Windows\System\qaiyhKf.exe
  C:\Windows\System\qaiyhKf.exe
  2⤵
  PID:6024
- C:\Windows\System\DKEvGrH.exe
  C:\Windows\System\DKEvGrH.exe
  2⤵
  PID:6052
- C:\Windows\System\fCohYMg.exe
  C:\Windows\System\fCohYMg.exe
  2⤵
  PID:6084
- C:\Windows\System\vEfdCeN.exe
  C:\Windows\System\vEfdCeN.exe
  2⤵
  PID:6112
- C:\Windows\System\BDAJtKT.exe
  C:\Windows\System\BDAJtKT.exe
  2⤵
  PID:5128
- C:\Windows\System\bNDQbHP.exe
  C:\Windows\System\bNDQbHP.exe
  2⤵
  PID:5164
- C:\Windows\System\WAbUghj.exe
  C:\Windows\System\WAbUghj.exe
  2⤵
  PID:5292
- C:\Windows\System\RskEvKO.exe
  C:\Windows\System\RskEvKO.exe
  2⤵
  PID:5328
- C:\Windows\System\ZXobKbU.exe
  C:\Windows\System\ZXobKbU.exe
  2⤵
  PID:5396
- C:\Windows\System\EYhcaKP.exe
  C:\Windows\System\EYhcaKP.exe
  2⤵
  PID:5472
- C:\Windows\System\oEuEhed.exe
  C:\Windows\System\oEuEhed.exe
  2⤵
  PID:5544
- C:\Windows\System\CodxdvV.exe
  C:\Windows\System\CodxdvV.exe
  2⤵
  PID:5592
- C:\Windows\System\vJiDwBY.exe
  C:\Windows\System\vJiDwBY.exe
  2⤵
  PID:5656
- C:\Windows\System\ZUDEYGV.exe
  C:\Windows\System\ZUDEYGV.exe
  2⤵
  PID:5744
- C:\Windows\System\EQzchze.exe
  C:\Windows\System\EQzchze.exe
  2⤵
  PID:5804
- C:\Windows\System\rxjORHX.exe
  C:\Windows\System\rxjORHX.exe
  2⤵
  PID:5868
- C:\Windows\System\AnKqHUB.exe
  C:\Windows\System\AnKqHUB.exe
  2⤵
  PID:5952
- C:\Windows\System\sjytqBy.exe
  C:\Windows\System\sjytqBy.exe
  2⤵
  PID:6000
- C:\Windows\System\IEAStTf.exe
  C:\Windows\System\IEAStTf.exe
  2⤵
  PID:2024
- C:\Windows\System\mVhtqhd.exe
  C:\Windows\System\mVhtqhd.exe
  2⤵
  PID:6128
- C:\Windows\System\hGFUxqe.exe
  C:\Windows\System\hGFUxqe.exe
  2⤵
  PID:5212
- C:\Windows\System\ZGHrwOI.exe
  C:\Windows\System\ZGHrwOI.exe
  2⤵
  PID:5364
- C:\Windows\System\GYoFBgd.exe
  C:\Windows\System\GYoFBgd.exe
  2⤵
  PID:5568
- C:\Windows\System\RnsktMV.exe
  C:\Windows\System\RnsktMV.exe
  2⤵
  PID:5696
- C:\Windows\System\bMfPmSX.exe
  C:\Windows\System\bMfPmSX.exe
  2⤵
  PID:5848
- C:\Windows\System\BASFFoi.exe
  C:\Windows\System\BASFFoi.exe
  2⤵
  PID:6036
- C:\Windows\System\aRgQGvC.exe
  C:\Windows\System\aRgQGvC.exe
  2⤵
  PID:6120
- C:\Windows\System\PomShLd.exe
  C:\Windows\System\PomShLd.exe
  2⤵
  PID:5440
- C:\Windows\System\MjMbCIQ.exe
  C:\Windows\System\MjMbCIQ.exe
  2⤵
  PID:5672
- C:\Windows\System\JSGEyQR.exe
  C:\Windows\System\JSGEyQR.exe
  2⤵
  PID:6080
- C:\Windows\System\FBBDGOi.exe
  C:\Windows\System\FBBDGOi.exe
  2⤵
  PID:5360
- C:\Windows\System\eHEMIQd.exe
  C:\Windows\System\eHEMIQd.exe
  2⤵
  PID:5976
- C:\Windows\System\TlkGKDJ.exe
  C:\Windows\System\TlkGKDJ.exe
  2⤵
  PID:6148
- C:\Windows\System\unjsETL.exe
  C:\Windows\System\unjsETL.exe
  2⤵
  PID:6172
- C:\Windows\System\wPbfOas.exe
  C:\Windows\System\wPbfOas.exe
  2⤵
  PID:6204
- C:\Windows\System\UaADxJK.exe
  C:\Windows\System\UaADxJK.exe
  2⤵
  PID:6244
- C:\Windows\System\CkXqgoa.exe
  C:\Windows\System\CkXqgoa.exe
  2⤵
  PID:6276
- C:\Windows\System\QQHCwmt.exe
  C:\Windows\System\QQHCwmt.exe
  2⤵
  PID:6304
- C:\Windows\System\FQUYbsY.exe
  C:\Windows\System\FQUYbsY.exe
  2⤵
  PID:6340
- C:\Windows\System\NsSecKg.exe
  C:\Windows\System\NsSecKg.exe
  2⤵
  PID:6372
- C:\Windows\System\ANLNBsw.exe
  C:\Windows\System\ANLNBsw.exe
  2⤵
  PID:6408
- C:\Windows\System\fXrNSOT.exe
  C:\Windows\System\fXrNSOT.exe
  2⤵
  PID:6432
- C:\Windows\System\PEQWSjW.exe
  C:\Windows\System\PEQWSjW.exe
  2⤵
  PID:6468
- C:\Windows\System\rUoZaBP.exe
  C:\Windows\System\rUoZaBP.exe
  2⤵
  PID:6492
- C:\Windows\System\qiJHxZh.exe
  C:\Windows\System\qiJHxZh.exe
  2⤵
  PID:6528
- C:\Windows\System\swUVhLA.exe
  C:\Windows\System\swUVhLA.exe
  2⤵
  PID:6552
- C:\Windows\System\bxDkbqY.exe
  C:\Windows\System\bxDkbqY.exe
  2⤵
  PID:6584
- C:\Windows\System\ASRSbah.exe
  C:\Windows\System\ASRSbah.exe
  2⤵
  PID:6604
- C:\Windows\System\SlubXtp.exe
  C:\Windows\System\SlubXtp.exe
  2⤵
  PID:6640
- C:\Windows\System\tooqEPr.exe
  C:\Windows\System\tooqEPr.exe
  2⤵
  PID:6660
- C:\Windows\System\PZxryxG.exe
  C:\Windows\System\PZxryxG.exe
  2⤵
  PID:6692
- C:\Windows\System\EcweVat.exe
  C:\Windows\System\EcweVat.exe
  2⤵
  PID:6716
- C:\Windows\System\SdwPHmE.exe
  C:\Windows\System\SdwPHmE.exe
  2⤵
  PID:6744
- C:\Windows\System\KJDXXTA.exe
  C:\Windows\System\KJDXXTA.exe
  2⤵
  PID:6776
- C:\Windows\System\ERBikJz.exe
  C:\Windows\System\ERBikJz.exe
  2⤵
  PID:6800
- C:\Windows\System\VtwRoQe.exe
  C:\Windows\System\VtwRoQe.exe
  2⤵
  PID:6828
- C:\Windows\System\yHsQphp.exe
  C:\Windows\System\yHsQphp.exe
  2⤵
  PID:6860
- C:\Windows\System\vvXKjix.exe
  C:\Windows\System\vvXKjix.exe
  2⤵
  PID:6888
- C:\Windows\System\clOwKtw.exe
  C:\Windows\System\clOwKtw.exe
  2⤵
  PID:6916
- C:\Windows\System\HBoMDyf.exe
  C:\Windows\System\HBoMDyf.exe
  2⤵
  PID:6948
- C:\Windows\System\qtcwXuu.exe
  C:\Windows\System\qtcwXuu.exe
  2⤵
  PID:6976
- C:\Windows\System\xZsxtwt.exe
  C:\Windows\System\xZsxtwt.exe
  2⤵
  PID:7000
- C:\Windows\System\XyzbVlp.exe
  C:\Windows\System\XyzbVlp.exe
  2⤵
  PID:7036
- C:\Windows\System\OTQvHUl.exe
  C:\Windows\System\OTQvHUl.exe
  2⤵
  PID:7060
- C:\Windows\System\ulusJrL.exe
  C:\Windows\System\ulusJrL.exe
  2⤵
  PID:7084
- C:\Windows\System\RxupqDx.exe
  C:\Windows\System\RxupqDx.exe
  2⤵
  PID:7116
- C:\Windows\System\pLWqhhT.exe
  C:\Windows\System\pLWqhhT.exe
  2⤵
  PID:7144
- C:\Windows\System\CJYySEP.exe
  C:\Windows\System\CJYySEP.exe
  2⤵
  PID:5640
- C:\Windows\System\GTxVHWi.exe
  C:\Windows\System\GTxVHWi.exe
  2⤵
  PID:6168
- C:\Windows\System\CUERjdf.exe
  C:\Windows\System\CUERjdf.exe
  2⤵
  PID:6240
- C:\Windows\System\LDfXoUZ.exe
  C:\Windows\System\LDfXoUZ.exe
  2⤵
  PID:6320
- C:\Windows\System\aAEgHUe.exe
  C:\Windows\System\aAEgHUe.exe
  2⤵
  PID:6360
- C:\Windows\System\zkBYmEX.exe
  C:\Windows\System\zkBYmEX.exe
  2⤵
  PID:6428
- C:\Windows\System\GjzEwva.exe
  C:\Windows\System\GjzEwva.exe
  2⤵
  PID:6480
- C:\Windows\System\rALppry.exe
  C:\Windows\System\rALppry.exe
  2⤵
  PID:6544
- C:\Windows\System\tgllMpj.exe
  C:\Windows\System\tgllMpj.exe
  2⤵
  PID:6600
- C:\Windows\System\QVoRNlw.exe
  C:\Windows\System\QVoRNlw.exe
  2⤵
  PID:6680
- C:\Windows\System\SJYAQkv.exe
  C:\Windows\System\SJYAQkv.exe
  2⤵
  PID:6728
- C:\Windows\System\ZGzpATB.exe
  C:\Windows\System\ZGzpATB.exe
  2⤵
  PID:6796
- C:\Windows\System\GsZsiWa.exe
  C:\Windows\System\GsZsiWa.exe
  2⤵
  PID:6852
- C:\Windows\System\VKRkYIz.exe
  C:\Windows\System\VKRkYIz.exe
  2⤵
  PID:6936
- C:\Windows\System\HsGanCT.exe
  C:\Windows\System\HsGanCT.exe
  2⤵
  PID:7012
- C:\Windows\System\zmMhzvU.exe
  C:\Windows\System\zmMhzvU.exe
  2⤵
  PID:7076
- C:\Windows\System\VpQyvQF.exe
  C:\Windows\System\VpQyvQF.exe
  2⤵
  PID:7132
- C:\Windows\System\qXDlQJT.exe
  C:\Windows\System\qXDlQJT.exe
  2⤵
  PID:6164
- C:\Windows\System\qyYiKlh.exe
  C:\Windows\System\qyYiKlh.exe
  2⤵
  PID:6264
- C:\Windows\System\ODQYoFH.exe
  C:\Windows\System\ODQYoFH.exe
  2⤵
  PID:6456
- C:\Windows\System\ccirLjg.exe
  C:\Windows\System\ccirLjg.exe
  2⤵
  PID:6648
- C:\Windows\System\xNNEXRB.exe
  C:\Windows\System\xNNEXRB.exe
  2⤵
  PID:6708
- C:\Windows\System\kicURzN.exe
  C:\Windows\System\kicURzN.exe
  2⤵
  PID:6912
- C:\Windows\System\avQfgAQ.exe
  C:\Windows\System\avQfgAQ.exe
  2⤵
  PID:7052
- C:\Windows\System\eCKJDBU.exe
  C:\Windows\System\eCKJDBU.exe
  2⤵
  PID:6188
- C:\Windows\System\MiOpLrs.exe
  C:\Windows\System\MiOpLrs.exe
  2⤵
  PID:6880
- C:\Windows\System\BjQilDD.exe
  C:\Windows\System\BjQilDD.exe
  2⤵
  PID:6884
- C:\Windows\System\ydHdJpq.exe
  C:\Windows\System\ydHdJpq.exe
  2⤵
  PID:6356
- C:\Windows\System\NfzfJaZ.exe
  C:\Windows\System\NfzfJaZ.exe
  2⤵
  PID:7164
- C:\Windows\System\QjHkGAc.exe
  C:\Windows\System\QjHkGAc.exe
  2⤵
  PID:6784
- C:\Windows\System\bsjAIew.exe
  C:\Windows\System\bsjAIew.exe
  2⤵
  PID:7200
- C:\Windows\System\yvbJlTj.exe
  C:\Windows\System\yvbJlTj.exe
  2⤵
  PID:7224
- C:\Windows\System\pESRIpj.exe
  C:\Windows\System\pESRIpj.exe
  2⤵
  PID:7256
- C:\Windows\System\QgECNAZ.exe
  C:\Windows\System\QgECNAZ.exe
  2⤵
  PID:7284
- C:\Windows\System\dcJsDKI.exe
  C:\Windows\System\dcJsDKI.exe
  2⤵
  PID:7312
- C:\Windows\System\uVWWDxh.exe
  C:\Windows\System\uVWWDxh.exe
  2⤵
  PID:7344
- C:\Windows\System\OWgRFAI.exe
  C:\Windows\System\OWgRFAI.exe
  2⤵
  PID:7380
- C:\Windows\System\EwxHozu.exe
  C:\Windows\System\EwxHozu.exe
  2⤵
  PID:7396
- C:\Windows\System\OpmlzgD.exe
  C:\Windows\System\OpmlzgD.exe
  2⤵
  PID:7424
- C:\Windows\System\sltINqJ.exe
  C:\Windows\System\sltINqJ.exe
  2⤵
  PID:7456
- C:\Windows\System\ebzNWSJ.exe
  C:\Windows\System\ebzNWSJ.exe
  2⤵
  PID:7480
- C:\Windows\System\iUpjapI.exe
  C:\Windows\System\iUpjapI.exe
  2⤵
  PID:7508
- C:\Windows\System\SZgkudR.exe
  C:\Windows\System\SZgkudR.exe
  2⤵
  PID:7540
- C:\Windows\System\aUkmwDT.exe
  C:\Windows\System\aUkmwDT.exe
  2⤵
  PID:7568
- C:\Windows\System\hpPESyB.exe
  C:\Windows\System\hpPESyB.exe
  2⤵
  PID:7600
- C:\Windows\System\wzMlKdn.exe
  C:\Windows\System\wzMlKdn.exe
  2⤵
  PID:7624
- C:\Windows\System\PXKFpvG.exe
  C:\Windows\System\PXKFpvG.exe
  2⤵
  PID:7656
- C:\Windows\System\SRoAmFf.exe
  C:\Windows\System\SRoAmFf.exe
  2⤵
  PID:7680
- C:\Windows\System\NNrJdPP.exe
  C:\Windows\System\NNrJdPP.exe
  2⤵
  PID:7708
- C:\Windows\System\YSSUsSK.exe
  C:\Windows\System\YSSUsSK.exe
  2⤵
  PID:7732
- C:\Windows\System\JCBkwby.exe
  C:\Windows\System\JCBkwby.exe
  2⤵
  PID:7764
- C:\Windows\System\TubYAVM.exe
  C:\Windows\System\TubYAVM.exe
  2⤵
  PID:7788
- C:\Windows\System\SEgXDKH.exe
  C:\Windows\System\SEgXDKH.exe
  2⤵
  PID:7816
- C:\Windows\System\bxTKgtd.exe
  C:\Windows\System\bxTKgtd.exe
  2⤵
  PID:7844
- C:\Windows\System\MgNymul.exe
  C:\Windows\System\MgNymul.exe
  2⤵
  PID:7872
- C:\Windows\System\vwrsXgg.exe
  C:\Windows\System\vwrsXgg.exe
  2⤵
  PID:7900
- C:\Windows\System\eqwfGtl.exe
  C:\Windows\System\eqwfGtl.exe
  2⤵
  PID:7928
- C:\Windows\System\pHTFAMO.exe
  C:\Windows\System\pHTFAMO.exe
  2⤵
  PID:7960
- C:\Windows\System\qcVPZvb.exe
  C:\Windows\System\qcVPZvb.exe
  2⤵
  PID:7984
- C:\Windows\System\lOVWGxG.exe
  C:\Windows\System\lOVWGxG.exe
  2⤵
  PID:8016
- C:\Windows\System\mfuTiLy.exe
  C:\Windows\System\mfuTiLy.exe
  2⤵
  PID:8048
- C:\Windows\System\rmcZfYJ.exe
  C:\Windows\System\rmcZfYJ.exe
  2⤵
  PID:8076
- C:\Windows\System\BAgRfRl.exe
  C:\Windows\System\BAgRfRl.exe
  2⤵
  PID:8096
- C:\Windows\System\gLmHlux.exe
  C:\Windows\System\gLmHlux.exe
  2⤵
  PID:8124
- C:\Windows\System\ZbDGoRh.exe
  C:\Windows\System\ZbDGoRh.exe
  2⤵
  PID:8152
- C:\Windows\System\KXGdjvv.exe
  C:\Windows\System\KXGdjvv.exe
  2⤵
  PID:8184
- C:\Windows\System\xpDBFDj.exe
  C:\Windows\System\xpDBFDj.exe
  2⤵
  PID:7216
- C:\Windows\System\DSjXVNs.exe
  C:\Windows\System\DSjXVNs.exe
  2⤵
  PID:7272
- C:\Windows\System\fvDGlcY.exe
  C:\Windows\System\fvDGlcY.exe
  2⤵
  PID:3396
- C:\Windows\System\msEkQkX.exe
  C:\Windows\System\msEkQkX.exe
  2⤵
  PID:1060
- C:\Windows\System\nGqJXSW.exe
  C:\Windows\System\nGqJXSW.exe
  2⤵
  PID:2288
- C:\Windows\System\yKWhvAr.exe
  C:\Windows\System\yKWhvAr.exe
  2⤵
  PID:5876
- C:\Windows\System\khfwdqw.exe
  C:\Windows\System\khfwdqw.exe
  2⤵
  PID:7392
- C:\Windows\System\gVqnTsN.exe
  C:\Windows\System\gVqnTsN.exe
  2⤵
  PID:7448
- C:\Windows\System\kNMjCyb.exe
  C:\Windows\System\kNMjCyb.exe
  2⤵
  PID:7532
- C:\Windows\System\KxADPNN.exe
  C:\Windows\System\KxADPNN.exe
  2⤵
  PID:7608
- C:\Windows\System\UjLXLWO.exe
  C:\Windows\System\UjLXLWO.exe
  2⤵
  PID:7668
- C:\Windows\System\HUlOEMt.exe
  C:\Windows\System\HUlOEMt.exe
  2⤵
  PID:7724
- C:\Windows\System\QZhPNdZ.exe
  C:\Windows\System\QZhPNdZ.exe
  2⤵
  PID:7784
- C:\Windows\System\jmeaAsx.exe
  C:\Windows\System\jmeaAsx.exe
  2⤵
  PID:7868
- C:\Windows\System\ZfQyikR.exe
  C:\Windows\System\ZfQyikR.exe
  2⤵
  PID:7920
- C:\Windows\System\ttVrsGh.exe
  C:\Windows\System\ttVrsGh.exe
  2⤵
  PID:7980
- C:\Windows\System\AhikyDl.exe
  C:\Windows\System\AhikyDl.exe
  2⤵
  PID:8056
- C:\Windows\System\IuDRogH.exe
  C:\Windows\System\IuDRogH.exe
  2⤵
  PID:8116
- C:\Windows\System\VCrjuUo.exe
  C:\Windows\System\VCrjuUo.exe
  2⤵
  PID:8176
- C:\Windows\System\gIZziXm.exe
  C:\Windows\System\gIZziXm.exe
  2⤵
  PID:7264
- C:\Windows\System\aXZlSzx.exe
  C:\Windows\System\aXZlSzx.exe
  2⤵
  PID:4276
- C:\Windows\System\MPacJJZ.exe
  C:\Windows\System\MPacJJZ.exe
  2⤵
  PID:4512
- C:\Windows\System\omYHAwi.exe
  C:\Windows\System\omYHAwi.exe
  2⤵
  PID:7504
- C:\Windows\System\HuIgHkG.exe
  C:\Windows\System\HuIgHkG.exe
  2⤵
  PID:7688
- C:\Windows\System\aRfsjOl.exe
  C:\Windows\System\aRfsjOl.exe
  2⤵
  PID:7836
- C:\Windows\System\KVwlICE.exe
  C:\Windows\System\KVwlICE.exe
  2⤵
  PID:8004
- C:\Windows\System\erufePf.exe
  C:\Windows\System\erufePf.exe
  2⤵
  PID:8136
- C:\Windows\System\xjIsSNG.exe
  C:\Windows\System\xjIsSNG.exe
  2⤵
  PID:7352
- C:\Windows\System\vxqOlUr.exe
  C:\Windows\System\vxqOlUr.exe
  2⤵
  PID:7640
- C:\Windows\System\BWKNNYE.exe
  C:\Windows\System\BWKNNYE.exe
  2⤵
  PID:7912
- C:\Windows\System\jTqHqAP.exe
  C:\Windows\System\jTqHqAP.exe
  2⤵
  PID:7248
- C:\Windows\System\RstvSnP.exe
  C:\Windows\System\RstvSnP.exe
  2⤵
  PID:8032
- C:\Windows\System\zrcKIPh.exe
  C:\Windows\System\zrcKIPh.exe
  2⤵
  PID:7752
- C:\Windows\System\aebgVRz.exe
  C:\Windows\System\aebgVRz.exe
  2⤵
  PID:8212
- C:\Windows\System\RcmKPvB.exe
  C:\Windows\System\RcmKPvB.exe
  2⤵
  PID:8240
- C:\Windows\System\lQhdaZn.exe
  C:\Windows\System\lQhdaZn.exe
  2⤵
  PID:8272
- C:\Windows\System\EQsTAYs.exe
  C:\Windows\System\EQsTAYs.exe
  2⤵
  PID:8308
- C:\Windows\System\hEBuiSQ.exe
  C:\Windows\System\hEBuiSQ.exe
  2⤵
  PID:8324
- C:\Windows\System\GbkTAIW.exe
  C:\Windows\System\GbkTAIW.exe
  2⤵
  PID:8360
- C:\Windows\System\ViMsYGI.exe
  C:\Windows\System\ViMsYGI.exe
  2⤵
  PID:8384
- C:\Windows\System\ETqTpbh.exe
  C:\Windows\System\ETqTpbh.exe
  2⤵
  PID:8412
- C:\Windows\System\IPwMRhw.exe
  C:\Windows\System\IPwMRhw.exe
  2⤵
  PID:8440
- C:\Windows\System\MbFUBsW.exe
  C:\Windows\System\MbFUBsW.exe
  2⤵
  PID:8472
- C:\Windows\System\yEPLPhg.exe
  C:\Windows\System\yEPLPhg.exe
  2⤵
  PID:8496
- C:\Windows\System\zijNDUT.exe
  C:\Windows\System\zijNDUT.exe
  2⤵
  PID:8524
- C:\Windows\System\SMRuVSP.exe
  C:\Windows\System\SMRuVSP.exe
  2⤵
  PID:8552
- C:\Windows\System\fsBGbZN.exe
  C:\Windows\System\fsBGbZN.exe
  2⤵
  PID:8580
- C:\Windows\System\FznTyws.exe
  C:\Windows\System\FznTyws.exe
  2⤵
  PID:8608
- C:\Windows\System\muAHUXE.exe
  C:\Windows\System\muAHUXE.exe
  2⤵
  PID:8652
- C:\Windows\System\VfNfdnD.exe
  C:\Windows\System\VfNfdnD.exe
  2⤵
  PID:8680
- C:\Windows\System\TIsdVlP.exe
  C:\Windows\System\TIsdVlP.exe
  2⤵
  PID:8708
- C:\Windows\System\EVMfmOE.exe
  C:\Windows\System\EVMfmOE.exe
  2⤵
  PID:8736
- C:\Windows\System\sOWjCQq.exe
  C:\Windows\System\sOWjCQq.exe
  2⤵
  PID:8764
- C:\Windows\System\PFqLDgr.exe
  C:\Windows\System\PFqLDgr.exe
  2⤵
  PID:8792
- C:\Windows\System\RZtYwMj.exe
  C:\Windows\System\RZtYwMj.exe
  2⤵
  PID:8820
- C:\Windows\System\HBjKxFS.exe
  C:\Windows\System\HBjKxFS.exe
  2⤵
  PID:8848
- C:\Windows\System\bBXENik.exe
  C:\Windows\System\bBXENik.exe
  2⤵
  PID:8876
- C:\Windows\System\qHKSAgE.exe
  C:\Windows\System\qHKSAgE.exe
  2⤵
  PID:8904
- C:\Windows\System\xHhwKJB.exe
  C:\Windows\System\xHhwKJB.exe
  2⤵
  PID:8932
- C:\Windows\System\FKkVAdQ.exe
  C:\Windows\System\FKkVAdQ.exe
  2⤵
  PID:8960
- C:\Windows\System\JntFsFm.exe
  C:\Windows\System\JntFsFm.exe
  2⤵
  PID:8988
- C:\Windows\System\rMTLrAW.exe
  C:\Windows\System\rMTLrAW.exe
  2⤵
  PID:9016
- C:\Windows\System\JMfRVzz.exe
  C:\Windows\System\JMfRVzz.exe
  2⤵
  PID:9044
- C:\Windows\System\VfKPjnl.exe
  C:\Windows\System\VfKPjnl.exe
  2⤵
  PID:9072
- C:\Windows\System\CRIcFlj.exe
  C:\Windows\System\CRIcFlj.exe
  2⤵
  PID:9100
- C:\Windows\System\GZCNqTd.exe
  C:\Windows\System\GZCNqTd.exe
  2⤵
  PID:9128
- C:\Windows\System\SvzVTzI.exe
  C:\Windows\System\SvzVTzI.exe
  2⤵
  PID:9156
- C:\Windows\System\dKoHNBW.exe
  C:\Windows\System\dKoHNBW.exe
  2⤵
  PID:9184
- C:\Windows\System\issnrbp.exe
  C:\Windows\System\issnrbp.exe
  2⤵
  PID:9212
- C:\Windows\System\OXawMWs.exe
  C:\Windows\System\OXawMWs.exe
  2⤵
  PID:8252
- C:\Windows\System\wZmukcJ.exe
  C:\Windows\System\wZmukcJ.exe
  2⤵
  PID:3004
- C:\Windows\System\KdPPVYE.exe
  C:\Windows\System\KdPPVYE.exe
  2⤵
  PID:8368
- C:\Windows\System\KXFhLoD.exe
  C:\Windows\System\KXFhLoD.exe
  2⤵
  PID:8428
- C:\Windows\System\AFQWzZX.exe
  C:\Windows\System\AFQWzZX.exe
  2⤵
  PID:8492
- C:\Windows\System\YSsLZho.exe
  C:\Windows\System\YSsLZho.exe
  2⤵
  PID:8564
- C:\Windows\System\ucXziUa.exe
  C:\Windows\System\ucXziUa.exe
  2⤵
  PID:8644
- C:\Windows\System\IiJWsqF.exe
  C:\Windows\System\IiJWsqF.exe
  2⤵
  PID:8704
- C:\Windows\System\wgCbUMS.exe
  C:\Windows\System\wgCbUMS.exe
  2⤵
  PID:8776
- C:\Windows\System\tkCZHfJ.exe
  C:\Windows\System\tkCZHfJ.exe
  2⤵
  PID:8840
- C:\Windows\System\DKySUFt.exe
  C:\Windows\System\DKySUFt.exe
  2⤵
  PID:8900
- C:\Windows\System\eOyhmFQ.exe
  C:\Windows\System\eOyhmFQ.exe
  2⤵
  PID:8972
- C:\Windows\System\KhHapWo.exe
  C:\Windows\System\KhHapWo.exe
  2⤵
  PID:9036
- C:\Windows\System\UMFABSS.exe
  C:\Windows\System\UMFABSS.exe
  2⤵
  PID:9096
- C:\Windows\System\TRXSnyz.exe
  C:\Windows\System\TRXSnyz.exe
  2⤵
  PID:9168
- C:\Windows\System\XVuCYmL.exe
  C:\Windows\System\XVuCYmL.exe
  2⤵
  PID:8232
- C:\Windows\System\xlOVgDt.exe
  C:\Windows\System\xlOVgDt.exe
  2⤵
  PID:8348
- C:\Windows\System\QFYwbTo.exe
  C:\Windows\System\QFYwbTo.exe
  2⤵
  PID:8520
- C:\Windows\System\ITJcNru.exe
  C:\Windows\System\ITJcNru.exe
  2⤵
  PID:8692
- C:\Windows\System\XtNUnJa.exe
  C:\Windows\System\XtNUnJa.exe
  2⤵
  PID:8832
- C:\Windows\System\suxtgxn.exe
  C:\Windows\System\suxtgxn.exe
  2⤵
  PID:8408
- C:\Windows\System\jzAtwZr.exe
  C:\Windows\System\jzAtwZr.exe
  2⤵
  PID:9124
- C:\Windows\System\HarIciV.exe
  C:\Windows\System\HarIciV.exe
  2⤵
  PID:8320
- C:\Windows\System\yWRxjjH.exe
  C:\Windows\System\yWRxjjH.exe
  2⤵
  PID:8672
- C:\Windows\System\RiCgZZy.exe
  C:\Windows\System\RiCgZZy.exe
  2⤵
  PID:9084
- C:\Windows\System\hRTQWEW.exe
  C:\Windows\System\hRTQWEW.exe
  2⤵
  PID:8628
- C:\Windows\System\hICpwgi.exe
  C:\Windows\System\hICpwgi.exe
  2⤵
  PID:8952
- C:\Windows\System\iLhrwTP.exe
  C:\Windows\System\iLhrwTP.exe
  2⤵
  PID:9236
- C:\Windows\System\YAAcyPr.exe
  C:\Windows\System\YAAcyPr.exe
  2⤵
  PID:9264
- C:\Windows\System\IdrvlEr.exe
  C:\Windows\System\IdrvlEr.exe
  2⤵
  PID:9292
- C:\Windows\System\DzSheYU.exe
  C:\Windows\System\DzSheYU.exe
  2⤵
  PID:9320
- C:\Windows\System\EbCKiTY.exe
  C:\Windows\System\EbCKiTY.exe
  2⤵
  PID:9348
- C:\Windows\System\HaiGGhD.exe
  C:\Windows\System\HaiGGhD.exe
  2⤵
  PID:9376
- C:\Windows\System\zKOZFyH.exe
  C:\Windows\System\zKOZFyH.exe
  2⤵
  PID:9404
- C:\Windows\System\LsDfzqS.exe
  C:\Windows\System\LsDfzqS.exe
  2⤵
  PID:9432
- C:\Windows\System\yYaEnRl.exe
  C:\Windows\System\yYaEnRl.exe
  2⤵
  PID:9448
- C:\Windows\System\IeoQPaf.exe
  C:\Windows\System\IeoQPaf.exe
  2⤵
  PID:9488
- C:\Windows\System\aTOxqjZ.exe
  C:\Windows\System\aTOxqjZ.exe
  2⤵
  PID:9516
- C:\Windows\System\xbQHCxN.exe
  C:\Windows\System\xbQHCxN.exe
  2⤵
  PID:9544
- C:\Windows\System\SRJqGom.exe
  C:\Windows\System\SRJqGom.exe
  2⤵
  PID:9572
- C:\Windows\System\fBfqaOo.exe
  C:\Windows\System\fBfqaOo.exe
  2⤵
  PID:9600
- C:\Windows\System\WSfGMiq.exe
  C:\Windows\System\WSfGMiq.exe
  2⤵
  PID:9628
- C:\Windows\System\QVNWooB.exe
  C:\Windows\System\QVNWooB.exe
  2⤵
  PID:9656
- C:\Windows\System\aUFuLUt.exe
  C:\Windows\System\aUFuLUt.exe
  2⤵
  PID:9684
- C:\Windows\System\alOLOYL.exe
  C:\Windows\System\alOLOYL.exe
  2⤵
  PID:9712
- C:\Windows\System\NQCpdvI.exe
  C:\Windows\System\NQCpdvI.exe
  2⤵
  PID:9740
- C:\Windows\System\ZXygDrv.exe
  C:\Windows\System\ZXygDrv.exe
  2⤵
  PID:9768
- C:\Windows\System\GwLhics.exe
  C:\Windows\System\GwLhics.exe
  2⤵
  PID:9796
- C:\Windows\System\TAmqKLV.exe
  C:\Windows\System\TAmqKLV.exe
  2⤵
  PID:9824
- C:\Windows\System\ZuLVFvF.exe
  C:\Windows\System\ZuLVFvF.exe
  2⤵
  PID:9852
- C:\Windows\System\rbuBrXZ.exe
  C:\Windows\System\rbuBrXZ.exe
  2⤵
  PID:9880
- C:\Windows\System\IpPUSSZ.exe
  C:\Windows\System\IpPUSSZ.exe
  2⤵
  PID:9908
- C:\Windows\System\GjfLSAg.exe
  C:\Windows\System\GjfLSAg.exe
  2⤵
  PID:9936
- C:\Windows\System\zPXWuQh.exe
  C:\Windows\System\zPXWuQh.exe
  2⤵
  PID:9956
- C:\Windows\System\XHZJvKe.exe
  C:\Windows\System\XHZJvKe.exe
  2⤵
  PID:9976
- C:\Windows\System\OmSPSwB.exe
  C:\Windows\System\OmSPSwB.exe
  2⤵
  PID:10000
- C:\Windows\System\XUKOLtH.exe
  C:\Windows\System\XUKOLtH.exe
  2⤵
  PID:10024
- C:\Windows\System\OXBTxYd.exe
  C:\Windows\System\OXBTxYd.exe
  2⤵
  PID:10040
- C:\Windows\System\qkLePlZ.exe
  C:\Windows\System\qkLePlZ.exe
  2⤵
  PID:10064
- C:\Windows\System\LuuPRsO.exe
  C:\Windows\System\LuuPRsO.exe
  2⤵
  PID:10084
- C:\Windows\System\zNRDpkY.exe
  C:\Windows\System\zNRDpkY.exe
  2⤵
  PID:10132
- C:\Windows\System\THedeHx.exe
  C:\Windows\System\THedeHx.exe
  2⤵
  PID:10176
- C:\Windows\System\pZuJJuJ.exe
  C:\Windows\System\pZuJJuJ.exe
  2⤵
  PID:10204
- C:\Windows\System\wbazLfV.exe
  C:\Windows\System\wbazLfV.exe
  2⤵
  PID:9220
- C:\Windows\System\mlAWXkN.exe
  C:\Windows\System\mlAWXkN.exe
  2⤵
  PID:9284
- C:\Windows\System\dbDwWaC.exe
  C:\Windows\System\dbDwWaC.exe
  2⤵
  PID:9372
- C:\Windows\System\zNMMUTZ.exe
  C:\Windows\System\zNMMUTZ.exe
  2⤵
  PID:9416
- C:\Windows\System\hbLOaWz.exe
  C:\Windows\System\hbLOaWz.exe
  2⤵
  PID:9504
- C:\Windows\System\aYIajbL.exe
  C:\Windows\System\aYIajbL.exe
  2⤵
  PID:9564
- C:\Windows\System\vZJxnWo.exe
  C:\Windows\System\vZJxnWo.exe
  2⤵
  PID:9640
- C:\Windows\System\RiDTbAf.exe
  C:\Windows\System\RiDTbAf.exe
  2⤵
  PID:9704
- C:\Windows\System\yXfynVC.exe
  C:\Windows\System\yXfynVC.exe
  2⤵
  PID:9764
- C:\Windows\System\BsDuSkC.exe
  C:\Windows\System\BsDuSkC.exe
  2⤵
  PID:9836
- C:\Windows\System\uKVPwzU.exe
  C:\Windows\System\uKVPwzU.exe
  2⤵
  PID:9900
- C:\Windows\System\IfvjAey.exe
  C:\Windows\System\IfvjAey.exe
  2⤵
  PID:9992
- C:\Windows\System\GFHZwkT.exe
  C:\Windows\System\GFHZwkT.exe
  2⤵
  PID:10052
- C:\Windows\System\eZCpCdv.exe
  C:\Windows\System\eZCpCdv.exe
  2⤵
  PID:10036
- C:\Windows\System\GVBqZvW.exe
  C:\Windows\System\GVBqZvW.exe
  2⤵
  PID:10144
- C:\Windows\System\noSAfhD.exe
  C:\Windows\System\noSAfhD.exe
  2⤵
  PID:10224
- C:\Windows\System\vbbBjTq.exe
  C:\Windows\System\vbbBjTq.exe
  2⤵
  PID:9344
- C:\Windows\System\oRLJehK.exe
  C:\Windows\System\oRLJehK.exe
  2⤵
  PID:9460
- C:\Windows\System\AdicxCy.exe
  C:\Windows\System\AdicxCy.exe
  2⤵
  PID:9620
- C:\Windows\System\MfqdnJT.exe
  C:\Windows\System\MfqdnJT.exe
  2⤵
  PID:9792
- C:\Windows\System\hYgUSYD.exe
  C:\Windows\System\hYgUSYD.exe
  2⤵
  PID:9988
- C:\Windows\System\JWarNDU.exe
  C:\Windows\System\JWarNDU.exe
  2⤵
  PID:10072
- C:\Windows\System\lrioPFk.exe
  C:\Windows\System\lrioPFk.exe
  2⤵
  PID:10200
- C:\Windows\System\tyLHFzK.exe
  C:\Windows\System\tyLHFzK.exe
  2⤵
  PID:9596
- C:\Windows\System\jHEVRNV.exe
  C:\Windows\System\jHEVRNV.exe
  2⤵
  PID:9892
- C:\Windows\System\BRwTzDb.exe
  C:\Windows\System\BRwTzDb.exe
  2⤵
  PID:10192
- C:\Windows\System\whSTREa.exe
  C:\Windows\System\whSTREa.exe
  2⤵
  PID:9968
- C:\Windows\System\PhSJvrf.exe
  C:\Windows\System\PhSJvrf.exe
  2⤵
  PID:9864
- C:\Windows\System\ZKkTDMc.exe
  C:\Windows\System\ZKkTDMc.exe
  2⤵
  PID:10264
- C:\Windows\System\sZVBxnM.exe
  C:\Windows\System\sZVBxnM.exe
  2⤵
  PID:10292
- C:\Windows\System\EvfCsoP.exe
  C:\Windows\System\EvfCsoP.exe
  2⤵
  PID:10320
- C:\Windows\System\dMkVtLA.exe
  C:\Windows\System\dMkVtLA.exe
  2⤵
  PID:10348
- C:\Windows\System\UevKlfA.exe
  C:\Windows\System\UevKlfA.exe
  2⤵
  PID:10376
- C:\Windows\System\uhcmpxN.exe
  C:\Windows\System\uhcmpxN.exe
  2⤵
  PID:10404
- C:\Windows\System\gzimssr.exe
  C:\Windows\System\gzimssr.exe
  2⤵
  PID:10432
- C:\Windows\System\vKeOOkC.exe
  C:\Windows\System\vKeOOkC.exe
  2⤵
  PID:10460
- C:\Windows\System\trnNMAd.exe
  C:\Windows\System\trnNMAd.exe
  2⤵
  PID:10488
- C:\Windows\System\TJjFKRX.exe
  C:\Windows\System\TJjFKRX.exe
  2⤵
  PID:10516
- C:\Windows\System\yiXTuxG.exe
  C:\Windows\System\yiXTuxG.exe
  2⤵
  PID:10544
- C:\Windows\System\VovLpme.exe
  C:\Windows\System\VovLpme.exe
  2⤵
  PID:10572
- C:\Windows\System\YcdUmeq.exe
  C:\Windows\System\YcdUmeq.exe
  2⤵
  PID:10600
- C:\Windows\System\lwvxxTc.exe
  C:\Windows\System\lwvxxTc.exe
  2⤵
  PID:10628
- C:\Windows\System\dFnCrMn.exe
  C:\Windows\System\dFnCrMn.exe
  2⤵
  PID:10656
- C:\Windows\System\WSBXfLn.exe
  C:\Windows\System\WSBXfLn.exe
  2⤵
  PID:10684
- C:\Windows\System\EQfUUgu.exe
  C:\Windows\System\EQfUUgu.exe
  2⤵
  PID:10712
- C:\Windows\System\pGnAvmx.exe
  C:\Windows\System\pGnAvmx.exe
  2⤵
  PID:10740
- C:\Windows\System\PEBJhTS.exe
  C:\Windows\System\PEBJhTS.exe
  2⤵
  PID:10768
- C:\Windows\System\wYaHTgV.exe
  C:\Windows\System\wYaHTgV.exe
  2⤵
  PID:10796
- C:\Windows\System\fKHxTCQ.exe
  C:\Windows\System\fKHxTCQ.exe
  2⤵
  PID:10824
- C:\Windows\System\wpYbLvj.exe
  C:\Windows\System\wpYbLvj.exe
  2⤵
  PID:10852
- C:\Windows\System\RGftQOi.exe
  C:\Windows\System\RGftQOi.exe
  2⤵
  PID:10880
- C:\Windows\System\WZYVNYZ.exe
  C:\Windows\System\WZYVNYZ.exe
  2⤵
  PID:10908
- C:\Windows\System\nmxALZK.exe
  C:\Windows\System\nmxALZK.exe
  2⤵
  PID:10936
- C:\Windows\System\djPZpfu.exe
  C:\Windows\System\djPZpfu.exe
  2⤵
  PID:10964
- C:\Windows\System\DQBFDtz.exe
  C:\Windows\System\DQBFDtz.exe
  2⤵
  PID:10992
- C:\Windows\System\NCYHZAT.exe
  C:\Windows\System\NCYHZAT.exe
  2⤵
  PID:11020
- C:\Windows\System\PZvJxpa.exe
  C:\Windows\System\PZvJxpa.exe
  2⤵
  PID:11052
- C:\Windows\System\ohfcPGs.exe
  C:\Windows\System\ohfcPGs.exe
  2⤵
  PID:11076
- C:\Windows\System\bAdQHSm.exe
  C:\Windows\System\bAdQHSm.exe
  2⤵
  PID:11104
- C:\Windows\System\RceSctv.exe
  C:\Windows\System\RceSctv.exe
  2⤵
  PID:11132
- C:\Windows\System\sSlEjCl.exe
  C:\Windows\System\sSlEjCl.exe
  2⤵
  PID:11160
- C:\Windows\System\bYkTPHQ.exe
  C:\Windows\System\bYkTPHQ.exe
  2⤵
  PID:11184
- C:\Windows\System\rTsSZOY.exe
  C:\Windows\System\rTsSZOY.exe
  2⤵
  PID:11216
- C:\Windows\System\KntWPDr.exe
  C:\Windows\System\KntWPDr.exe
  2⤵
  PID:11244
- C:\Windows\System\sCffkNm.exe
  C:\Windows\System\sCffkNm.exe
  2⤵
  PID:10260
- C:\Windows\System\HWvDhJd.exe
  C:\Windows\System\HWvDhJd.exe
  2⤵
  PID:10332
- C:\Windows\System\rjygnIa.exe
  C:\Windows\System\rjygnIa.exe
  2⤵
  PID:10396
- C:\Windows\System\PlEawok.exe
  C:\Windows\System\PlEawok.exe
  2⤵
  PID:10456
- C:\Windows\System\odPqMhr.exe
  C:\Windows\System\odPqMhr.exe
  2⤵
  PID:10528
- C:\Windows\System\SXTIsXE.exe
  C:\Windows\System\SXTIsXE.exe
  2⤵
  PID:10592
- C:\Windows\System\VwCbTBx.exe
  C:\Windows\System\VwCbTBx.exe
  2⤵
  PID:10652
- C:\Windows\System\NaUXzdf.exe
  C:\Windows\System\NaUXzdf.exe
  2⤵
  PID:10724
- C:\Windows\System\nhSeXGt.exe
  C:\Windows\System\nhSeXGt.exe
  2⤵
  PID:10788
- C:\Windows\System\TWKpnFZ.exe
  C:\Windows\System\TWKpnFZ.exe
  2⤵
  PID:10864
- C:\Windows\System\XmaQXXv.exe
  C:\Windows\System\XmaQXXv.exe
  2⤵
  PID:10928
- C:\Windows\System\HpkUSmJ.exe
  C:\Windows\System\HpkUSmJ.exe
  2⤵
  PID:10988
- C:\Windows\System\dGThoeu.exe
  C:\Windows\System\dGThoeu.exe
  2⤵
  PID:11060
- C:\Windows\System\ctMpIvg.exe
  C:\Windows\System\ctMpIvg.exe
  2⤵
  PID:9528
- C:\Windows\System\DjSaNSY.exe
  C:\Windows\System\DjSaNSY.exe
  2⤵
  PID:11168
- C:\Windows\System\cmHxaks.exe
  C:\Windows\System\cmHxaks.exe
  2⤵
  PID:11240
- C:\Windows\System\hZHRuTb.exe
  C:\Windows\System\hZHRuTb.exe
  2⤵
  PID:10372
- C:\Windows\System\zPysnOO.exe
  C:\Windows\System\zPysnOO.exe
  2⤵
  PID:10508
- C:\Windows\System\RshHRdP.exe
  C:\Windows\System\RshHRdP.exe
  2⤵
  PID:10648
- C:\Windows\System\KnyLxoy.exe
  C:\Windows\System\KnyLxoy.exe
  2⤵
  PID:10816
- C:\Windows\System\AQsXYob.exe
  C:\Windows\System\AQsXYob.exe
  2⤵
  PID:10976
- C:\Windows\System\FyqmWTf.exe
  C:\Windows\System\FyqmWTf.exe
  2⤵
  PID:11116
- C:\Windows\System\rQoDCwb.exe
  C:\Windows\System\rQoDCwb.exe
  2⤵
  PID:10256
- C:\Windows\System\YlhlYwY.exe
  C:\Windows\System\YlhlYwY.exe
  2⤵
  PID:10620
- C:\Windows\System\mBnaksg.exe
  C:\Windows\System\mBnaksg.exe
  2⤵
  PID:10956
- C:\Windows\System\KKDQrgY.exe
  C:\Windows\System\KKDQrgY.exe
  2⤵
  PID:10428
- C:\Windows\System\cjXimQk.exe
  C:\Windows\System\cjXimQk.exe
  2⤵
  PID:11228
- C:\Windows\System\gKpynkZ.exe
  C:\Windows\System\gKpynkZ.exe
  2⤵
  PID:11272
- C:\Windows\System\JyJmkME.exe
  C:\Windows\System\JyJmkME.exe
  2⤵
  PID:11300
- C:\Windows\System\wrCXoNb.exe
  C:\Windows\System\wrCXoNb.exe
  2⤵
  PID:11328
- C:\Windows\System\cdMxstl.exe
  C:\Windows\System\cdMxstl.exe
  2⤵
  PID:11356
- C:\Windows\System\Pfsrqyc.exe
  C:\Windows\System\Pfsrqyc.exe
  2⤵
  PID:11384
- C:\Windows\System\pBVDIuH.exe
  C:\Windows\System\pBVDIuH.exe
  2⤵
  PID:11412
- C:\Windows\System\JvBBCFr.exe
  C:\Windows\System\JvBBCFr.exe
  2⤵
  PID:11440
- C:\Windows\System\eODSTGP.exe
  C:\Windows\System\eODSTGP.exe
  2⤵
  PID:11468
- C:\Windows\System\GxETGgj.exe
  C:\Windows\System\GxETGgj.exe
  2⤵
  PID:11496
- C:\Windows\System\hZepDed.exe
  C:\Windows\System\hZepDed.exe
  2⤵
  PID:11524
- C:\Windows\System\AhLHWHp.exe
  C:\Windows\System\AhLHWHp.exe
  2⤵
  PID:11552
- C:\Windows\System\BpbOUxg.exe
  C:\Windows\System\BpbOUxg.exe
  2⤵
  PID:11568
- C:\Windows\System\dLDWGiK.exe
  C:\Windows\System\dLDWGiK.exe
  2⤵
  PID:11592
- C:\Windows\System\oEuMCjk.exe
  C:\Windows\System\oEuMCjk.exe
  2⤵
  PID:11612
- C:\Windows\System\jmxHAzz.exe
  C:\Windows\System\jmxHAzz.exe
  2⤵
  PID:11644
- C:\Windows\System\QmJZOek.exe
  C:\Windows\System\QmJZOek.exe
  2⤵
  PID:11664
- C:\Windows\System\XwqhTTP.exe
  C:\Windows\System\XwqhTTP.exe
  2⤵
  PID:11696
- C:\Windows\System\mnbUMVn.exe
  C:\Windows\System\mnbUMVn.exe
  2⤵
  PID:11720
- C:\Windows\System\XsnLNvk.exe
  C:\Windows\System\XsnLNvk.exe
  2⤵
  PID:11776
- C:\Windows\System\rgvXSte.exe
  C:\Windows\System\rgvXSte.exe
  2⤵
  PID:11800
- C:\Windows\System\jLYNBZD.exe
  C:\Windows\System\jLYNBZD.exe
  2⤵
  PID:11820
- C:\Windows\System\OsTdkyu.exe
  C:\Windows\System\OsTdkyu.exe
  2⤵
  PID:11848
- C:\Windows\System\JkcYrrB.exe
  C:\Windows\System\JkcYrrB.exe
  2⤵
  PID:12064
- C:\Windows\System\OfhIuFj.exe
  C:\Windows\System\OfhIuFj.exe
  2⤵
  PID:12096
- C:\Windows\System\kQrFUaP.exe
  C:\Windows\System\kQrFUaP.exe
  2⤵
  PID:12116
- C:\Windows\System\WWIaGES.exe
  C:\Windows\System\WWIaGES.exe
  2⤵
  PID:12140
- C:\Windows\System\CMDIhnZ.exe
  C:\Windows\System\CMDIhnZ.exe
  2⤵
  PID:12172
- C:\Windows\System\Foaetlz.exe
  C:\Windows\System\Foaetlz.exe
  2⤵
  PID:12216
- C:\Windows\System\NkVdudg.exe
  C:\Windows\System\NkVdudg.exe
  2⤵
  PID:12252
- C:\Windows\System\SNbZYDU.exe
  C:\Windows\System\SNbZYDU.exe
  2⤵
  PID:12280
- C:\Windows\System\ZVxtFYl.exe
  C:\Windows\System\ZVxtFYl.exe
  2⤵
  PID:11312
- C:\Windows\System\RrydAce.exe
  C:\Windows\System\RrydAce.exe
  2⤵
  PID:11348
- C:\Windows\System\IBGzKbO.exe
  C:\Windows\System\IBGzKbO.exe
  2⤵
  PID:11432
- C:\Windows\System\rPzhbZf.exe
  C:\Windows\System\rPzhbZf.exe
  2⤵
  PID:11488
- C:\Windows\System\KceHbNR.exe
  C:\Windows\System\KceHbNR.exe
  2⤵
  PID:11564
- C:\Windows\System\SjOYNWt.exe
  C:\Windows\System\SjOYNWt.exe
  2⤵
  PID:11684
- C:\Windows\System\roOyAMZ.exe
  C:\Windows\System\roOyAMZ.exe
  2⤵
  PID:11708
- C:\Windows\System\XCIRSQu.exe
  C:\Windows\System\XCIRSQu.exe
  2⤵
  PID:3624
- C:\Windows\System\QhYLRrA.exe
  C:\Windows\System\QhYLRrA.exe
  2⤵
  PID:4384
- C:\Windows\System\VNSEziW.exe
  C:\Windows\System\VNSEziW.exe
  2⤵
  PID:11888
- C:\Windows\System\pCRxoPc.exe
  C:\Windows\System\pCRxoPc.exe
  2⤵
  PID:11904
- C:\Windows\System\kRNRtbq.exe
  C:\Windows\System\kRNRtbq.exe
  2⤵
  PID:11932
- C:\Windows\System\xnuWiBj.exe
  C:\Windows\System\xnuWiBj.exe
  2⤵
  PID:11960
- C:\Windows\System\SEKryGx.exe
  C:\Windows\System\SEKryGx.exe
  2⤵
  PID:11988
- C:\Windows\System\FEnlFNz.exe
  C:\Windows\System\FEnlFNz.exe
  2⤵
  PID:12020
- C:\Windows\System\PqMMXdu.exe
  C:\Windows\System\PqMMXdu.exe
  2⤵
  PID:12048
- C:\Windows\System\NnnjjaB.exe
  C:\Windows\System\NnnjjaB.exe
  2⤵
  PID:11864
- C:\Windows\System\dpxUEbK.exe
  C:\Windows\System\dpxUEbK.exe
  2⤵
  PID:12136
- C:\Windows\System\VXECUkR.exe
  C:\Windows\System\VXECUkR.exe
  2⤵
  PID:10836
- C:\Windows\System\OpznARw.exe
  C:\Windows\System\OpznARw.exe
  2⤵
  PID:11628
- C:\Windows\System\KkOKfXW.exe
  C:\Windows\System\KkOKfXW.exe
  2⤵
  PID:11292
- C:\Windows\System\TySiDoT.exe
  C:\Windows\System\TySiDoT.exe
  2⤵
  PID:11464
- C:\Windows\System\tKZJofj.exe
  C:\Windows\System\tKZJofj.exe
  2⤵
  PID:11520
- C:\Windows\System\irjWCAu.exe
  C:\Windows\System\irjWCAu.exe
  2⤵
  PID:2352
- C:\Windows\System\TTyuOox.exe
  C:\Windows\System\TTyuOox.exe
  2⤵
  PID:11836
- C:\Windows\System\yItiNks.exe
  C:\Windows\System\yItiNks.exe
  2⤵
  PID:11924
- C:\Windows\System\nwKbdGb.exe
  C:\Windows\System\nwKbdGb.exe
  2⤵
  PID:11984
- C:\Windows\System\nfGJwfH.exe
  C:\Windows\System\nfGJwfH.exe
  2⤵
  PID:12060
- C:\Windows\System\jvCOEsP.exe
  C:\Windows\System\jvCOEsP.exe
  2⤵
  PID:12156
- C:\Windows\System\ngJUGdr.exe
  C:\Windows\System\ngJUGdr.exe
  2⤵
  PID:11340
- C:\Windows\System\AxYWyyx.exe
  C:\Windows\System\AxYWyyx.exe
  2⤵
  PID:11652
- C:\Windows\System\FehRkGG.exe
  C:\Windows\System\FehRkGG.exe
  2⤵
  PID:11900
- C:\Windows\System\scsJLWI.exe
  C:\Windows\System\scsJLWI.exe
  2⤵
  PID:12044
- C:\Windows\System\AbZwrQH.exe
  C:\Windows\System\AbZwrQH.exe
  2⤵
  PID:12264
- C:\Windows\System\YOEPPHx.exe
  C:\Windows\System\YOEPPHx.exe
  2⤵
  PID:11972
- C:\Windows\System\mdvwYVR.exe
  C:\Windows\System\mdvwYVR.exe
  2⤵
  PID:11784
- C:\Windows\System\mFqPYSX.exe
  C:\Windows\System\mFqPYSX.exe
  2⤵
  PID:12296
- C:\Windows\System\mkoWsxQ.exe
  C:\Windows\System\mkoWsxQ.exe
  2⤵
  PID:12328
- C:\Windows\System\bwKZKms.exe
  C:\Windows\System\bwKZKms.exe
  2⤵
  PID:12356
- C:\Windows\System\uUlhkvD.exe
  C:\Windows\System\uUlhkvD.exe
  2⤵
  PID:12384
- C:\Windows\System\FfqXKxJ.exe
  C:\Windows\System\FfqXKxJ.exe
  2⤵
  PID:12412
- C:\Windows\System\QXOeDRX.exe
  C:\Windows\System\QXOeDRX.exe
  2⤵
  PID:12440
- C:\Windows\System\QriEiGK.exe
  C:\Windows\System\QriEiGK.exe
  2⤵
  PID:12468
- C:\Windows\System\tQrvRYP.exe
  C:\Windows\System\tQrvRYP.exe
  2⤵
  PID:12496
- C:\Windows\System\YFhSKKV.exe
  C:\Windows\System\YFhSKKV.exe
  2⤵
  PID:12524
- C:\Windows\System\LprKaEM.exe
  C:\Windows\System\LprKaEM.exe
  2⤵
  PID:12552
- C:\Windows\System\mkZIGSy.exe
  C:\Windows\System\mkZIGSy.exe
  2⤵
  PID:12580
- C:\Windows\System\zbiQWVn.exe
  C:\Windows\System\zbiQWVn.exe
  2⤵
  PID:12608
- C:\Windows\System\xVcBFEa.exe
  C:\Windows\System\xVcBFEa.exe
  2⤵
  PID:12636
- C:\Windows\System\FetvaIN.exe
  C:\Windows\System\FetvaIN.exe
  2⤵
  PID:12664
- C:\Windows\System\GeeUrOo.exe
  C:\Windows\System\GeeUrOo.exe
  2⤵
  PID:12692
- C:\Windows\System\FHwETWX.exe
  C:\Windows\System\FHwETWX.exe
  2⤵
  PID:12720
- C:\Windows\System\YuHWoqd.exe
  C:\Windows\System\YuHWoqd.exe
  2⤵
  PID:12748
- C:\Windows\System\GUhWLZY.exe
  C:\Windows\System\GUhWLZY.exe
  2⤵
  PID:12776
- C:\Windows\System\qvTfCvt.exe
  C:\Windows\System\qvTfCvt.exe
  2⤵
  PID:12804
- C:\Windows\System\XlAfRnO.exe
  C:\Windows\System\XlAfRnO.exe
  2⤵
  PID:13164
- C:\Windows\System\vmKGvpO.exe
  C:\Windows\System\vmKGvpO.exe
  2⤵
  PID:13188
- C:\Windows\System\MSVjxRy.exe
  C:\Windows\System\MSVjxRy.exe
  2⤵
  PID:13204
- C:\Windows\System\bqmTiYx.exe
  C:\Windows\System\bqmTiYx.exe
  2⤵
  PID:13244
- C:\Windows\System\NhHjIsq.exe
  C:\Windows\System\NhHjIsq.exe
  2⤵
  PID:13272
- C:\Windows\System\LkfVWFk.exe
  C:\Windows\System\LkfVWFk.exe
  2⤵
  PID:13304
- C:\Windows\System\PNAvRir.exe
  C:\Windows\System\PNAvRir.exe
  2⤵
  PID:12340
- C:\Windows\System\ihTdEeZ.exe
  C:\Windows\System\ihTdEeZ.exe
  2⤵
  PID:12404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rkf2rmyj.uhs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DeXcPir.exe

Filesize
3.3MB

MD5
c3482c58a1d420dd66b68478186d32e9

SHA1
ecd7368227afd2e1fa04019dd77239148ed7ef66

SHA256
643cbc901470c1b8aad4efc6d014eb3c7aa05ec812b22e2f9d1b6332cbc82582

SHA512
d26920929553763c3926237d402f4bcdaee1ad3a5bac863b4aa310fe04bfa9151e15b760ba322c1305085802fe8460ce4f5e0fc46521f60448c641ceecd86235

Download Submit
C:\Windows\System\ETnTDbD.exe

Filesize
3.3MB

MD5
f4bb98cb86091487c5c2dc8b96fdd33d

SHA1
9a2333dbef46f4c74dcd15f5acf43966fb902374

SHA256
fbc7af87962271495c80aa3f567c52e2cd45a6ffb4b7aeebc4fab711c7248ffb

SHA512
86be1742eee187384e6be972b8106ac96208897ee2e1f334d94f9e962fd84b0f1033dfe118e84477071fbfc5f46429906843d11ed6b4cb72fd51483098d94b09

Download Submit
C:\Windows\System\FOAtCPS.exe

Filesize
3.3MB

MD5
247de59bfb6c0d9f94cf5bda259737c9

SHA1
e5018bf944e96e0c4143c2fec5e00aea12c8a802

SHA256
7e86ee46e02ecdb2ab007d0f6885f237aeb763f12673dc8d6625515a78315dd9

SHA512
617f295a4a60cd36dfa046c3d3f25c2f87983a8f0ec22353aaf7b3b1d5a1e25d6f0afff561dd48271f7c176a3ec85b5a442a784025e4621bf4635d0d0847d3f7

Download Submit
C:\Windows\System\FQuaVUN.exe

Filesize
3.3MB

MD5
c553990bb11c596c241759c026dd28fb

SHA1
a9a09520c87428fa9a3155abdd7cc6481a1f9c8b

SHA256
0f24fc5757f006605144b585fa47f75e11cbe32c313d7ca802567c4b7d0ad05f

SHA512
427b5e23d7ed0f6275a524d9fd94006f6ccf3c0986e6c5d25906c17f4b76d52e67fae1df495f9602ceaac97688b3631ab7ad3605411fe96835513f61fdfd050b

Download Submit
C:\Windows\System\FnJNNmf.exe

Filesize
3.3MB

MD5
ffebd4574b3c23f63aff9021a066ed4d

SHA1
33d172ab10abbdd511ad18a56b88605e4fd08d1a

SHA256
442233049b1121b5014a798e1b725dfbad9a35e571b8be31e94781d8ff7fb937

SHA512
fad671bd94f4bd19d95e4898eec37997f7e7e6b3b78d12d2160420648d0668e0dcdc1c05180ab431d5e6a493550c09be4d6dd15c3db65f2f194b3f0f2f56ad02

Download Submit
C:\Windows\System\GWAWmKv.exe

Filesize
3.3MB

MD5
f3f9a875e0e9df38319f20159845c811

SHA1
a9d9aa79ac076a77bfde1fb41bef906d40200b2e

SHA256
40b0f9e6fcd750d4e2286dde6df302016cd1c448d3fdcf8bac0b3823d0379715

SHA512
dd831be8a7e061646b199c256ee8834929bf13a4590e0177c2847b5dd8ca0181534b1be83197daf7db57f3d5a80e89262311434961cd11fe3ba9f0f5332e871a

Download Submit
C:\Windows\System\KbEIeGv.exe

Filesize
8B

MD5
890903962eda8433c4bf90d771684f99

SHA1
7f8f7b02a55d2698a8af5512bf4728ece5f696b2

SHA256
18444e5be4d3a7890d1803adf8c67a414e46a3f9e70d9f0195de9d987e04c441

SHA512
b9a46107f280cd1369a47d47944d4af2a7d0f74adbb8a49187ee2f52fa6c706c8206cfdc85d7a27fc84eea5103640a34c7996d1fd07b8e62a24ab539f9adaf3e

Download Submit
C:\Windows\System\LPczHLr.exe

Filesize
3.3MB

MD5
2c0acd7376d0a6bc1ed08e6307cf260b

SHA1
d689cb9196cb8fcfa652e0e6dd7ee836e1bd2d2d

SHA256
766367edcc14cd532cd5c8ffba851ae377e72e0aa00a8af5dc37cdb452fee12a

SHA512
a6973ebc4bb40c7614204310e93430cdb497c35353c21a9b98e2ae416266aba8c1650138dbc753df6dc0aac44f3c56cff70627193edc9c8f8005269bd9fec978

Download Submit
C:\Windows\System\LahVwZQ.exe

Filesize
3.3MB

MD5
2d3f33e00b46ab302b807bcc592bef2f

SHA1
dbf42537980d19424a6c5a12764192536dc6445c

SHA256
480dd38afbbbf3a313f550a71c6a2b19d94ec1960bb085ca358e769d39ad800a

SHA512
8fd670c1d528e70c4fd5e2e53cf321703fe03c5cb42b90150c65b98e6cf38e686bb6496965f7152c43f215a920a31f29f476e51c29d851f5ba83f8c641202bc1

Download Submit
C:\Windows\System\MkyTHep.exe

Filesize
3.3MB

MD5
61f1aab305f563609e64867579eeb998

SHA1
43c141e073e22a207231789a7000c87a0efd0719

SHA256
b5e6033ca33c74210e263789610c8dbb9add9a1bf9946f49be856f79a39b539b

SHA512
5d6aeb66ceed082c445275372a378709a0ee15284d965f8bf3133a5cb3f4ab07c5abf5044397b320142119294ecbe044ade55f5d74366ef2683d4403458073a9

Download Submit
C:\Windows\System\NQXKzqI.exe

Filesize
3.3MB

MD5
9ad006b263cc7c652e4db926bfcda63a

SHA1
a20818a361bdea445cb504f5c7ff08b22f1f63c5

SHA256
66c6e58f04c59abf4c1cef6ab74a678c3517df05afb923bb107881c9290f01a5

SHA512
075883c9362291dbcc807ad4c5083423d010daa70dc221bd889904a5e4865981e7944ad38340416b15d19d22ced9037e27f0baf652ff8a5c441d4b9404f563ca

Download Submit
C:\Windows\System\RDvHwYw.exe

Filesize
3.3MB

MD5
4ab31c6437e250690cd02ec73c0f451c

SHA1
602529b929eac1fda7c3dd082cfbaf3dba9ac2b0

SHA256
a68193df483439a382ab0ce5d29cb1d8631ffb46178cadac0642d3d07826b9d0

SHA512
26e4d27e0c868d45b4aae7a48f740235c36981a196883d705f94c6e33902ff6cccdd96dc92929266ba36e1df6c0a10f9aa5c0cc262bf0d1f623f9e6dd7796291

Download Submit
C:\Windows\System\TIVBiyv.exe

Filesize
3.3MB

MD5
8235b888bd0be8a7f2642f920d6e1f3e

SHA1
02e9f8c00966a8eb133792107bdd0370ecc00063

SHA256
daf81886575d7c3581174f2be7ffaf10fb4d0163309daeff0737b3b4dd36850f

SHA512
58654396ea1c757f305606b5b8a2b1f9dc037fa7af2389a352dbdde11e21a13224a2a4c93fc25dad8bdde6113dbbecf03a7f8ce5f53328bc25e4780f25e3ce96

Download Submit
C:\Windows\System\Ucklrlr.exe

Filesize
3.3MB

MD5
76107ab05d71177a54e7a2da8bc6af73

SHA1
14d473acf01cf83ad1354d9814e8017cef487d35

SHA256
1ae47dfa8fc25e9089914c5bdfde9d9aea872ddc56b442e08ea0991ba437bc7d

SHA512
de3ad66a65c1a6437e2bc2469af89cd6f8faee0ac4148699297c7ff277964561828a9fdc4f50765768c418665f5d5cd5ce30a44537164e25d9a6165b4428f5bf

Download Submit
C:\Windows\System\UgxRInl.exe

Filesize
3.3MB

MD5
e17693bb889994273768f61bd4087d53

SHA1
7646255fa8c4554ad0dbfb0bf1f50a5ead2e41b3

SHA256
72e1ee556e466dedb5fd3a75f051a8502137ce61f792209df09595b7468ea8c5

SHA512
5a0ffbdbff25fee1c1b2d728ccd7f0371ce44acf09c2df63986f2f23b01c8dc553d6b4d6bbdb4b3ff83c344091078eaa37939e5d88610e73b2280231db0cb13c

Download Submit
C:\Windows\System\UrasoRi.exe

Filesize
3.3MB

MD5
f46804d5c44e465de0c1636ba4e1ec98

SHA1
a7e4e47eb604018515e425aa5f05c5bf37c979d2

SHA256
ba01e341154f2ad0246498b5e4c614cc89da6a24d9048624bb40a3dcac84721b

SHA512
333944577663590cc99454a86a2c73ae9815b1431065a4ac9697e1ae182a91a77de8e81082117f9d77301974aedd5bd0ba264f8c8192fc3f1a4d853afc18728f

Download Submit
C:\Windows\System\VCTNQUi.exe

Filesize
3.3MB

MD5
fb59060a83d1782e8875f07255704193

SHA1
678577d625c71df6dd8949a60b08647999ef07bb

SHA256
9d34787f7ab2fe392deb41058e514ae8ee306ee8fa1a854806820a2503e84365

SHA512
93aa1ee764ac47560d4a9d301eeca06229ca393baf4b729d933c2cc53552d7bd2cdabd0fdda4e60314cd15aa8a0117df34e30d33b8de37796698031c884dbfde

Download Submit
C:\Windows\System\bQTuGSC.exe

Filesize
3.3MB

MD5
6bb422a1d5d05de516175d0d2421d8ed

SHA1
ae10b99cf93235b5f69fa21a8edf4f9409ca3792

SHA256
e4a62d1fb6c3711983f14bbd499b12f2d0aeb62fb4c4f03f2039e4f0e0f0e58f

SHA512
6d5a97f5846c2b84b591610335c6b9be87f44a4e0ddf7f3394b25e0064b6ded053ce6694bb4ce2217390d0f9982d7482d1faa958fbe14df1ad8f0403bda284d3

Download Submit
C:\Windows\System\cYrgehq.exe

Filesize
3.3MB

MD5
c6e064764964495a4ef1f79aff016f14

SHA1
9ba41ab469cd063855057af8b811a9fb612c3420

SHA256
55ff58c5a0962e3507ab2603fd7ee65e96b401675becfbddbca2ebc658470747

SHA512
c4665e54fb12abbbeb72df808eb35e1f8af8ec68a5d857f84ef9b3ffdf1275bb5b69ebd69f67d563cd0c75c68d5d2a6e196946ca27948b933d4fe78c336a11d1

Download Submit
C:\Windows\System\caKCZLu.exe

Filesize
3.3MB

MD5
fd5e01550719dbc7ac99ada27f7c9316

SHA1
65106ddd158c7ff1f9025bc0f754e5ab863ed909

SHA256
3d7cb58af3c530a4880f1b476f7c31c9c0540c86a3a5c5e483c3082d108618fc

SHA512
e7b83a5ede6312d36e2dff762ebce80ef65173138e7df3fa491f5d11c338d8c35c1d675082081716a3eb699a4bf9c4d72a764cfea47e4233dd72264c5c526f55

Download Submit
C:\Windows\System\dZjafhu.exe

Filesize
3.3MB

MD5
a8183c335119fee8fe4b28354e75c797

SHA1
d9ec50e149e1cdfe9d5bc80741b63972b0c9a204

SHA256
806b8408a51c175212728cd00c61a4ba7cad245cd282b22bc1b52dfb7414411b

SHA512
c66d0fb33449f605988b8e19455bf2c0e9e7de43a6150c7a7610993b013a385a782eac559436d9a72f64b06ff748654f6e8255a724a1ec3d1e860e6c150fa913

Download Submit
C:\Windows\System\gYZlGdy.exe

Filesize
3.3MB

MD5
fdf9c903fddac975b19642ca5fc401fd

SHA1
ca75fa9a85b6eb29d4afc0d7496c46614cba561d

SHA256
56f567c03095337617acf60d1c023b687d1bcf315c9da2e68e98eea2c429830f

SHA512
d18086122afee83e6a7dc7768288e90fb556b4680f869e4739625cf58a018b182e8787bfaac3abb5ea40a16ac38f966c365bee0d24195d5c58a62ff8eae36440

Download Submit
C:\Windows\System\giNTPzd.exe

Filesize
3.3MB

MD5
ae9db2d8d6dcbffd7c84a1e4409c41e2

SHA1
3574109f83f0e71adfeb23b8c2a77f741a39dd8b

SHA256
9d2e0ebd4563d713a9f9abe9edcd58a45da3caeeedc1ba7ffcf8e35576433d1b

SHA512
57d8956223cc73ed11248d6cfbe8425d467950da157d35fcbc47a768996d24c5c33256c6002a93f5a07a3fd9b6e2b9377c1326040dfeb820c2bd24f2134745b4

Download Submit
C:\Windows\System\hulkXns.exe

Filesize
3.3MB

MD5
7bce416e7056fa4b8355907f90db1e07

SHA1
60c583d3549ee046f323099d7fa8ea119be88dc4

SHA256
8748fdf0db9d3d9c0a95ab823faad52eced896877a86f29f75a4332999ae150e

SHA512
f9930698652cd92345565b3770f6b55ead4e09100615a81896e8545b1595ff345713071c52b68f8542d98ddc61ecdb902825c3518301f043e4f6605200778272

Download Submit
C:\Windows\System\iUspaES.exe

Filesize
3.3MB

MD5
b622447af166f2bec220522b07eea020

SHA1
edf57828633222b3d2ebcd651e7d27147f63c8ba

SHA256
e11c7293fa3e1d0e8b76125dae5f545071c3be13e0fb049fb567d8694e969f23

SHA512
0d243c0be2e36394b49fc2e4a3f25647eed53edac2571506af43c763f92b7a1b83da22e804770008c7adac64b3339a2c29bf38d21d361d2a8c6ea2350597975d

Download Submit
C:\Windows\System\jcHoXfQ.exe

Filesize
3.3MB

MD5
93d8ac272382c135bbfaf7e9b7932157

SHA1
911e9232f83384969a08833e6629dcd6219322a6

SHA256
bd6403caf156441c94fb2e2110f335160e0231ce6060efe558a387ff1097f6a1

SHA512
4023865f21cf809a915dc74d855f0122564ffcf7861ce55d2b890960a609d2602cc7e00aa4c724d67ef6ab490fdaa62ed9160e62e17a0794948d912a7e85b3bf

Download Submit
C:\Windows\System\kNlrYat.exe

Filesize
3.3MB

MD5
0228d3cab71499d5dc5d6abfa8f7ea91

SHA1
dd79a927050faf45e0eb292fd6267e039c1f036f

SHA256
f43a4217a117b1b8265e88b07d17c67e133dac35d68cb5de89f2261f2795468a

SHA512
bc32eae44d8a54fc94284499ec15ae6c13e243d88e14c0b7c732386add595361a6b8bba8c389d337e811c56fc520e4992f7688a2b130b8dd848734ae5cfacff9

Download Submit
C:\Windows\System\nSAgliG.exe

Filesize
3.3MB

MD5
700443604942633fc8035ddfdba06bf1

SHA1
d1b63c7f6108656e8e97ce7a001911ebfa26e91c

SHA256
21111fec73e7c80f7e5bc53cc97fc1ebb63750ebc62c4cbfd8f5ea810c0ec455

SHA512
f87696a09ad96d15f19321500aa17ef102d922d493c67c3365410ec926eb47068c75f858770e4ff44d54cd2842ba9d812682648f3b2706daf8fa37fc6f5de471

Download Submit
C:\Windows\System\niqhpSV.exe

Filesize
3.3MB

MD5
36e9cacea65f5a31e513c80c3fe95fe4

SHA1
1c3609df5a6db722043a4134d676f85914367008

SHA256
8fee495ca3aa1b1d6f46b8f082aa1e526e26cd598a022fddc38d11b2e27cdb53

SHA512
ab44dbb10bf586097d5a44a5f0ceb76fdc75bb40fbfaf7f52fba168a78f8da670fff894153c980122dcb671aa6a78c7d5dde462e71a176c6679f7b511e5b6c7d

Download Submit
C:\Windows\System\pBayNZS.exe

Filesize
3.3MB

MD5
a31cd67dd3e37127c375e1d753392c03

SHA1
3ee727daf64cb7cfcba9410f6ba8d74709494d3c

SHA256
70d062677aeaa01c15810557531a81c375a8f839465e2bb0e67ea2c74f674d08

SHA512
f4c2b763a40bb0d84e6e4b496b075dbd4bbb07630288892940c9e42b5ae8f8c5027351e223768a32293a2bf86e8160cd79c26de3ce12b530888dbf219a11b1b4

Download Submit
C:\Windows\System\pfgmpDy.exe

Filesize
3.3MB

MD5
a5dd2542a4797a88e56ca2b291ac1434

SHA1
22f5eeec1fcbf51185671b5c7485751679104019

SHA256
e5dd983f39be344de44541863dc0afde7d1cbd9ec0d230d6e4d3711cdb0f5fb2

SHA512
7dd22b3c7d5487314caf47463bbeb46ba6d020601629fedad1b04fdb32e9277bab884c4e8da22e943ad2bda36d37aad50462efabc1ccd62c57c4f2bafbc8a229

Download Submit
C:\Windows\System\uFyHkfd.exe

Filesize
3.3MB

MD5
99abda493602b6fab02cf54432f9dbcd

SHA1
8d7e02f6a9682dc8c77cab58569d19a39fcaa0ba

SHA256
8469b452fe6a3a50823b5a096fdcb16433d06ab900a87acdafbdf4685d130336

SHA512
aad483226257f826f9b998c1fa5a213e28915a0a5110ad345cfd53480a594fa9892391a8510fb40a0dd4b48f4a3650aaf46a683b9f78671250698abc4a94d6d1

Download Submit
C:\Windows\System\xBWjWQj.exe

Filesize
3.3MB

MD5
3ebedfc3396febc36a27726c1cb6ed14

SHA1
4188503e0cbdbcf1d998c27d28539b6dd29529a4

SHA256
fe0476151fe1798dbd7a975fb8c6dd29515ceeb368aaee6277c49e4d1f09dee2

SHA512
7e1e34fbdc61ac0356e8a0e37ec4ab8ab7f5893fbf8726aebd7d59919915cb0e7d7a33fb7dc770019517a9460694bb05c9e02552203a0dd7b2d9c44b28b0812a

Download Submit
memory/224-2403-0x00007FF786020000-0x00007FF786416000-memory.dmp

Filesize
4.0MB

Download
memory/224-129-0x00007FF786020000-0x00007FF786416000-memory.dmp

Filesize
4.0MB

Download
memory/464-2400-0x00007FF6444A0000-0x00007FF644896000-memory.dmp

Filesize
4.0MB

Download
memory/464-2136-0x00007FF6444A0000-0x00007FF644896000-memory.dmp

Filesize
4.0MB

Download
memory/464-26-0x00007FF6444A0000-0x00007FF644896000-memory.dmp

Filesize
4.0MB

Download
memory/676-102-0x00007FF73D400000-0x00007FF73D7F6000-memory.dmp

Filesize
4.0MB

Download
memory/676-2398-0x00007FF73D400000-0x00007FF73D7F6000-memory.dmp

Filesize
4.0MB

Download
memory/728-133-0x00007FF6CEBA0000-0x00007FF6CEF96000-memory.dmp

Filesize
4.0MB

Download
memory/728-2417-0x00007FF6CEBA0000-0x00007FF6CEF96000-memory.dmp

Filesize
4.0MB

Download
memory/1072-136-0x00007FF63E330000-0x00007FF63E726000-memory.dmp

Filesize
4.0MB

Download
memory/1072-2411-0x00007FF63E330000-0x00007FF63E726000-memory.dmp

Filesize
4.0MB

Download
memory/1152-25-0x00007FF711E30000-0x00007FF712226000-memory.dmp

Filesize
4.0MB

Download
memory/1152-2401-0x00007FF711E30000-0x00007FF712226000-memory.dmp

Filesize
4.0MB

Download
memory/1180-2409-0x00007FF69E400000-0x00007FF69E7F6000-memory.dmp

Filesize
4.0MB

Download
memory/1180-139-0x00007FF69E400000-0x00007FF69E7F6000-memory.dmp

Filesize
4.0MB

Download
memory/1300-2408-0x00007FF773100000-0x00007FF7734F6000-memory.dmp

Filesize
4.0MB

Download
memory/1300-138-0x00007FF773100000-0x00007FF7734F6000-memory.dmp

Filesize
4.0MB

Download
memory/1516-2419-0x00007FF6CC9B0000-0x00007FF6CCDA6000-memory.dmp

Filesize
4.0MB

Download
memory/1516-2396-0x00007FF6CC9B0000-0x00007FF6CCDA6000-memory.dmp

Filesize
4.0MB

Download
memory/1516-278-0x00007FF6CC9B0000-0x00007FF6CCDA6000-memory.dmp

Filesize
4.0MB

Download
memory/1708-2412-0x00007FF6E4A50000-0x00007FF6E4E46000-memory.dmp

Filesize
4.0MB

Download
memory/1708-130-0x00007FF6E4A50000-0x00007FF6E4E46000-memory.dmp

Filesize
4.0MB

Download
memory/2232-131-0x00007FF7B60C0000-0x00007FF7B64B6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-2413-0x00007FF7B60C0000-0x00007FF7B64B6000-memory.dmp

Filesize
4.0MB

Download
memory/2252-2406-0x00007FF6FEA10000-0x00007FF6FEE06000-memory.dmp

Filesize
4.0MB

Download
memory/2252-124-0x00007FF6FEA10000-0x00007FF6FEE06000-memory.dmp

Filesize
4.0MB

Download
memory/2580-19-0x00007FFCA3540000-0x00007FFCA4001000-memory.dmp

Filesize
10.8MB

Download
memory/2580-1836-0x00007FFCA3540000-0x00007FFCA4001000-memory.dmp

Filesize
10.8MB

Download
memory/2580-142-0x000001CFE47E0000-0x000001CFE4F86000-memory.dmp

Filesize
7.6MB

Download
memory/2580-5-0x00007FFCA3543000-0x00007FFCA3545000-memory.dmp

Filesize
8KB

Download
memory/2580-86-0x00007FFCA3540000-0x00007FFCA4001000-memory.dmp

Filesize
10.8MB

Download
memory/2580-79-0x000001CFC96E0000-0x000001CFC9702000-memory.dmp

Filesize
136KB

Download
memory/2804-123-0x00007FF7CC700000-0x00007FF7CCAF6000-memory.dmp

Filesize
4.0MB

Download
memory/2804-2404-0x00007FF7CC700000-0x00007FF7CCAF6000-memory.dmp

Filesize
4.0MB

Download
memory/3124-1-0x000001CF0D860000-0x000001CF0D870000-memory.dmp

Filesize
64KB

Download
memory/3124-1496-0x00007FF695C10000-0x00007FF696006000-memory.dmp

Filesize
4.0MB

Download
memory/3124-0-0x00007FF695C10000-0x00007FF696006000-memory.dmp

Filesize
4.0MB

Download
memory/3376-2405-0x00007FF7E0FF0000-0x00007FF7E13E6000-memory.dmp

Filesize
4.0MB

Download
memory/3376-113-0x00007FF7E0FF0000-0x00007FF7E13E6000-memory.dmp

Filesize
4.0MB

Download
memory/3404-2399-0x00007FF7D4CE0000-0x00007FF7D50D6000-memory.dmp

Filesize
4.0MB

Download
memory/3404-24-0x00007FF7D4CE0000-0x00007FF7D50D6000-memory.dmp

Filesize
4.0MB

Download
memory/3436-2410-0x00007FF6FAC30000-0x00007FF6FB026000-memory.dmp

Filesize
4.0MB

Download
memory/3436-141-0x00007FF6FAC30000-0x00007FF6FB026000-memory.dmp

Filesize
4.0MB

Download
memory/3528-2397-0x00007FF7B1A50000-0x00007FF7B1E46000-memory.dmp

Filesize
4.0MB

Download
memory/3528-2421-0x00007FF7B1A50000-0x00007FF7B1E46000-memory.dmp

Filesize
4.0MB

Download
memory/3528-282-0x00007FF7B1A50000-0x00007FF7B1E46000-memory.dmp

Filesize
4.0MB

Download
memory/3636-2418-0x00007FF759D90000-0x00007FF75A186000-memory.dmp

Filesize
4.0MB

Download
memory/3636-134-0x00007FF759D90000-0x00007FF75A186000-memory.dmp

Filesize
4.0MB

Download
memory/3760-137-0x00007FF67B6E0000-0x00007FF67BAD6000-memory.dmp

Filesize
4.0MB

Download
memory/3760-2416-0x00007FF67B6E0000-0x00007FF67BAD6000-memory.dmp

Filesize
4.0MB

Download
memory/3920-2407-0x00007FF713280000-0x00007FF713676000-memory.dmp

Filesize
4.0MB

Download
memory/3920-140-0x00007FF713280000-0x00007FF713676000-memory.dmp

Filesize
4.0MB

Download
memory/4056-2415-0x00007FF72B0D0000-0x00007FF72B4C6000-memory.dmp

Filesize
4.0MB

Download
memory/4056-135-0x00007FF72B0D0000-0x00007FF72B4C6000-memory.dmp

Filesize
4.0MB

Download
memory/4424-2414-0x00007FF6B7E70000-0x00007FF6B8266000-memory.dmp

Filesize
4.0MB

Download
memory/4424-132-0x00007FF6B7E70000-0x00007FF6B8266000-memory.dmp

Filesize
4.0MB

Download
memory/4480-1840-0x00007FF73CC70000-0x00007FF73D066000-memory.dmp

Filesize
4.0MB

Download
memory/4480-2402-0x00007FF73CC70000-0x00007FF73D066000-memory.dmp

Filesize
4.0MB

Download
memory/4480-53-0x00007FF73CC70000-0x00007FF73D066000-memory.dmp

Filesize
4.0MB

Download
memory/4628-293-0x00007FF673950000-0x00007FF673D46000-memory.dmp

Filesize
4.0MB

Download
memory/4628-2420-0x00007FF673950000-0x00007FF673D46000-memory.dmp

Filesize
4.0MB

Download