xmrig | 8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
Size

3.8MB
MD5

1f2c853cecf687e2b8fc5c9e7013b993
SHA1

050a6e4989e5343eff6b4e138560f2038de5ab06
SHA256

8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00
SHA512

259ee151b1e7a29a6876f1dd546b5bdc34370b06b272db76807a6aea593ffd202e9abf3d9a7bb6525105f6dd02515aed2fd10eea3867a7995104e790e74b8d31
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW0:7bBeSFk4

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3092-0-0x00007FF6733A0000-0x00007FF673796000-memory.dmp	xmrig
behavioral2/files/0x00090000000234b1-9.dat	xmrig
behavioral2/files/0x00070000000234bb-8.dat	xmrig
behavioral2/files/0x00080000000234b7-11.dat	xmrig
behavioral2/files/0x00070000000234be-29.dat	xmrig
behavioral2/files/0x00070000000234bf-37.dat	xmrig
behavioral2/files/0x00070000000234c3-47.dat	xmrig
behavioral2/files/0x00070000000234bc-64.dat	xmrig
behavioral2/files/0x00080000000234c6-86.dat	xmrig
behavioral2/memory/4608-89-0x00007FF609E60000-0x00007FF60A256000-memory.dmp	xmrig
behavioral2/memory/4952-100-0x00007FF7D9BA0000-0x00007FF7D9F96000-memory.dmp	xmrig
behavioral2/memory/736-105-0x00007FF7F54A0000-0x00007FF7F5896000-memory.dmp	xmrig
behavioral2/memory/2700-108-0x00007FF6E8620000-0x00007FF6E8A16000-memory.dmp	xmrig
behavioral2/memory/4760-111-0x00007FF6DAA60000-0x00007FF6DAE56000-memory.dmp	xmrig
behavioral2/files/0x00070000000234ca-114.dat	xmrig
behavioral2/files/0x00070000000234cc-125.dat	xmrig
behavioral2/memory/400-134-0x00007FF753FB0000-0x00007FF7543A6000-memory.dmp	xmrig
behavioral2/memory/3904-135-0x00007FF62C110000-0x00007FF62C506000-memory.dmp	xmrig
behavioral2/files/0x00070000000234cd-145.dat	xmrig
behavioral2/files/0x00070000000234cf-149.dat	xmrig
behavioral2/files/0x00070000000234ce-147.dat	xmrig
behavioral2/files/0x00070000000234cb-141.dat	xmrig
behavioral2/files/0x00080000000234c5-137.dat	xmrig
behavioral2/memory/3928-133-0x00007FF729B80000-0x00007FF729F76000-memory.dmp	xmrig
behavioral2/memory/4684-132-0x00007FF6DD840000-0x00007FF6DDC36000-memory.dmp	xmrig
behavioral2/memory/3504-110-0x00007FF684D00000-0x00007FF6850F6000-memory.dmp	xmrig
behavioral2/memory/2192-109-0x00007FF70F4B0000-0x00007FF70F8A6000-memory.dmp	xmrig
behavioral2/memory/3696-107-0x00007FF792490000-0x00007FF792886000-memory.dmp	xmrig
behavioral2/memory/2216-106-0x00007FF6CAF00000-0x00007FF6CB2F6000-memory.dmp	xmrig
behavioral2/memory/3304-104-0x00007FF61ED70000-0x00007FF61F166000-memory.dmp	xmrig
behavioral2/files/0x00070000000234c9-102.dat	xmrig
behavioral2/memory/4508-101-0x00007FF65CCB0000-0x00007FF65D0A6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234c8-98.dat	xmrig
behavioral2/memory/2284-95-0x00007FF6CF840000-0x00007FF6CFC36000-memory.dmp	xmrig
behavioral2/files/0x00070000000234c7-93.dat	xmrig
behavioral2/files/0x00070000000234c4-91.dat	xmrig
behavioral2/memory/1816-88-0x00007FF63C770000-0x00007FF63CB66000-memory.dmp	xmrig
behavioral2/memory/2652-82-0x00007FF7C3350000-0x00007FF7C3746000-memory.dmp	xmrig
behavioral2/memory/3516-69-0x00007FF652F80000-0x00007FF653376000-memory.dmp	xmrig
behavioral2/files/0x00070000000234c2-68.dat	xmrig
behavioral2/files/0x00070000000234c0-72.dat	xmrig
behavioral2/memory/1472-61-0x00007FF781E40000-0x00007FF782236000-memory.dmp	xmrig
behavioral2/files/0x00070000000234bd-59.dat	xmrig
behavioral2/files/0x00070000000234c1-45.dat	xmrig
behavioral2/files/0x00070000000234d0-310.dat	xmrig
behavioral2/memory/3076-325-0x00007FF6824F0000-0x00007FF6828E6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234eb-341.dat	xmrig
behavioral2/files/0x00070000000234f1-352.dat	xmrig
behavioral2/files/0x00070000000234ec-368.dat	xmrig
behavioral2/files/0x00070000000234f0-366.dat	xmrig
behavioral2/files/0x00070000000234f2-360.dat	xmrig
behavioral2/files/0x00070000000234f3-359.dat	xmrig
behavioral2/files/0x00070000000234f6-363.dat	xmrig
behavioral2/files/0x00070000000234ef-354.dat	xmrig
behavioral2/memory/2168-337-0x00007FF7C6D50000-0x00007FF7C7146000-memory.dmp	xmrig
behavioral2/memory/3552-336-0x00007FF647CE0000-0x00007FF6480D6000-memory.dmp	xmrig
behavioral2/memory/2152-328-0x00007FF6D4210000-0x00007FF6D4606000-memory.dmp	xmrig
behavioral2/files/0x00070000000234e8-315.dat	xmrig
behavioral2/memory/3092-1815-0x00007FF6733A0000-0x00007FF673796000-memory.dmp	xmrig
behavioral2/memory/3928-2190-0x00007FF729B80000-0x00007FF729F76000-memory.dmp	xmrig
behavioral2/memory/400-2191-0x00007FF753FB0000-0x00007FF7543A6000-memory.dmp	xmrig
behavioral2/memory/3904-2192-0x00007FF62C110000-0x00007FF62C506000-memory.dmp	xmrig
behavioral2/memory/3696-2193-0x00007FF792490000-0x00007FF792886000-memory.dmp	xmrig
behavioral2/memory/1472-2194-0x00007FF781E40000-0x00007FF782236000-memory.dmp	xmrig

Blocklisted process makes network request 10 IoCs

flow	pid	Process
3	1272	powershell.exe
8	1272	powershell.exe
14	1272	powershell.exe
15	1272	powershell.exe
16	1272	powershell.exe
17	1272	powershell.exe
19	1272	powershell.exe
29	1272	powershell.exe
30	1272	powershell.exe
31	1272	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1272	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3696	wKYbwNv.exe
1472	LQxFAPX.exe
3516	rALdwvb.exe
2652	puvNndG.exe
1816	pEkaXUu.exe
2700	JEszZNP.exe
4608	EkSYRMi.exe
2284	UJPekio.exe
4952	QYCQLMG.exe
4508	WMHZueI.exe
3304	JFZtRKj.exe
2192	uFfqXzW.exe
736	ZnfuKim.exe
3504	NqQYbVJ.exe
2216	WBveAzB.exe
4760	OifgqjZ.exe
4684	KocBseE.exe
3928	fPPxsKq.exe
400	nhlxVNI.exe
3904	juTtANe.exe
3076	IAuvkTs.exe
2152	cIVexjw.exe
3552	OhMWkhU.exe
2168	rdQKJpL.exe
4868	SezHdEt.exe
4724	PQkiucT.exe
208	pPxnjav.exe
548	TRDBOIp.exe
3064	lpGFDSP.exe
4344	WreIcSa.exe
2928	UzoPgFn.exe
3148	BZessZE.exe
2704	WNBczcD.exe
5000	FQqNICJ.exe
5112	EnwGKlA.exe
3060	xmhJJiB.exe
2668	IhwikeA.exe
2636	MxmbPTf.exe
4708	llszAjF.exe
4516	UEdubxP.exe
3840	ySSgtah.exe
2148	WZoHqly.exe
2232	IsXTylm.exe
4468	DabaVFN.exe
3080	vauDmej.exe
2420	CykbXUP.exe
3984	tvTCzFp.exe
2632	CafhhIf.exe
1352	yxEKehq.exe
2388	XUazsJP.exe
4540	spVFDYW.exe
2616	bmtFzwD.exe
4912	jTHZlTg.exe
2304	JPYzHTj.exe
1604	DQUKjBw.exe
4380	SwkwHUT.exe
4720	KQIJKyX.exe
3672	Ojrodpq.exe
2744	AfvDHUn.exe
2384	tgRqAjx.exe
4312	zcRjVHX.exe
4696	ERxAsqg.exe
2128	JKEsdLO.exe
4428	BFyWPFM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3092-0-0x00007FF6733A0000-0x00007FF673796000-memory.dmp	upx
behavioral2/files/0x00090000000234b1-9.dat	upx
behavioral2/files/0x00070000000234bb-8.dat	upx
behavioral2/files/0x00080000000234b7-11.dat	upx
behavioral2/files/0x00070000000234be-29.dat	upx
behavioral2/files/0x00070000000234bf-37.dat	upx
behavioral2/files/0x00070000000234c3-47.dat	upx
behavioral2/files/0x00070000000234bc-64.dat	upx
behavioral2/files/0x00080000000234c6-86.dat	upx
behavioral2/memory/4608-89-0x00007FF609E60000-0x00007FF60A256000-memory.dmp	upx
behavioral2/memory/4952-100-0x00007FF7D9BA0000-0x00007FF7D9F96000-memory.dmp	upx
behavioral2/memory/736-105-0x00007FF7F54A0000-0x00007FF7F5896000-memory.dmp	upx
behavioral2/memory/2700-108-0x00007FF6E8620000-0x00007FF6E8A16000-memory.dmp	upx
behavioral2/memory/4760-111-0x00007FF6DAA60000-0x00007FF6DAE56000-memory.dmp	upx
behavioral2/files/0x00070000000234ca-114.dat	upx
behavioral2/files/0x00070000000234cc-125.dat	upx
behavioral2/memory/400-134-0x00007FF753FB0000-0x00007FF7543A6000-memory.dmp	upx
behavioral2/memory/3904-135-0x00007FF62C110000-0x00007FF62C506000-memory.dmp	upx
behavioral2/files/0x00070000000234cd-145.dat	upx
behavioral2/files/0x00070000000234cf-149.dat	upx
behavioral2/files/0x00070000000234ce-147.dat	upx
behavioral2/files/0x00070000000234cb-141.dat	upx
behavioral2/files/0x00080000000234c5-137.dat	upx
behavioral2/memory/3928-133-0x00007FF729B80000-0x00007FF729F76000-memory.dmp	upx
behavioral2/memory/4684-132-0x00007FF6DD840000-0x00007FF6DDC36000-memory.dmp	upx
behavioral2/memory/3504-110-0x00007FF684D00000-0x00007FF6850F6000-memory.dmp	upx
behavioral2/memory/2192-109-0x00007FF70F4B0000-0x00007FF70F8A6000-memory.dmp	upx
behavioral2/memory/3696-107-0x00007FF792490000-0x00007FF792886000-memory.dmp	upx
behavioral2/memory/2216-106-0x00007FF6CAF00000-0x00007FF6CB2F6000-memory.dmp	upx
behavioral2/memory/3304-104-0x00007FF61ED70000-0x00007FF61F166000-memory.dmp	upx
behavioral2/files/0x00070000000234c9-102.dat	upx
behavioral2/memory/4508-101-0x00007FF65CCB0000-0x00007FF65D0A6000-memory.dmp	upx
behavioral2/files/0x00070000000234c8-98.dat	upx
behavioral2/memory/2284-95-0x00007FF6CF840000-0x00007FF6CFC36000-memory.dmp	upx
behavioral2/files/0x00070000000234c7-93.dat	upx
behavioral2/files/0x00070000000234c4-91.dat	upx
behavioral2/memory/1816-88-0x00007FF63C770000-0x00007FF63CB66000-memory.dmp	upx
behavioral2/memory/2652-82-0x00007FF7C3350000-0x00007FF7C3746000-memory.dmp	upx
behavioral2/memory/3516-69-0x00007FF652F80000-0x00007FF653376000-memory.dmp	upx
behavioral2/files/0x00070000000234c2-68.dat	upx
behavioral2/files/0x00070000000234c0-72.dat	upx
behavioral2/memory/1472-61-0x00007FF781E40000-0x00007FF782236000-memory.dmp	upx
behavioral2/files/0x00070000000234bd-59.dat	upx
behavioral2/files/0x00070000000234c1-45.dat	upx
behavioral2/files/0x00070000000234d0-310.dat	upx
behavioral2/memory/3076-325-0x00007FF6824F0000-0x00007FF6828E6000-memory.dmp	upx
behavioral2/files/0x00070000000234eb-341.dat	upx
behavioral2/files/0x00070000000234f1-352.dat	upx
behavioral2/files/0x00070000000234ec-368.dat	upx
behavioral2/files/0x00070000000234f0-366.dat	upx
behavioral2/files/0x00070000000234f2-360.dat	upx
behavioral2/files/0x00070000000234f3-359.dat	upx
behavioral2/files/0x00070000000234f6-363.dat	upx
behavioral2/files/0x00070000000234ef-354.dat	upx
behavioral2/memory/2168-337-0x00007FF7C6D50000-0x00007FF7C7146000-memory.dmp	upx
behavioral2/memory/3552-336-0x00007FF647CE0000-0x00007FF6480D6000-memory.dmp	upx
behavioral2/memory/2152-328-0x00007FF6D4210000-0x00007FF6D4606000-memory.dmp	upx
behavioral2/files/0x00070000000234e8-315.dat	upx
behavioral2/memory/3092-1815-0x00007FF6733A0000-0x00007FF673796000-memory.dmp	upx
behavioral2/memory/3928-2190-0x00007FF729B80000-0x00007FF729F76000-memory.dmp	upx
behavioral2/memory/400-2191-0x00007FF753FB0000-0x00007FF7543A6000-memory.dmp	upx
behavioral2/memory/3904-2192-0x00007FF62C110000-0x00007FF62C506000-memory.dmp	upx
behavioral2/memory/3696-2193-0x00007FF792490000-0x00007FF792886000-memory.dmp	upx
behavioral2/memory/1472-2194-0x00007FF781E40000-0x00007FF782236000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lpGFDSP.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\vDRMufm.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\TEozjQx.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\riwtsnC.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\uFfqXzW.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\ZwvtAoI.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\imFBULe.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\GZmcyBM.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\DgBEHMC.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\pchxOPF.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\FgVBKoF.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\xiSNVCP.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\wuGeJtw.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\vqnedLq.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\PkUrqoW.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\OUnZVwP.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\NbisJLS.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\ByfmWBc.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\jNuEfHF.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\wsFcJwY.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\jGdxQpg.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\qlQqRWB.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\bPfhiit.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\JLGwRzu.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\ywaKilN.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\XsGATNL.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\snuUzaL.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\xTrXOFT.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\hEXqweI.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\CuHcvfb.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\TiPLYmP.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\WDZtKJj.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\pgLkDiu.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\kCGtVbj.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\dwqtgDW.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\lPjHCVq.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\PXuMchl.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\mgRbUJM.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\RNplfbK.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\YklrgSF.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\XKVOCwr.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\dxbmQUO.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\AZxYduL.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\idcbDDm.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\TasaBkI.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\eWxdVdG.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\lqYuXhK.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\esAPcLH.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\RAVktiZ.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\HNUVJTo.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\VDWSiOF.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\CwjpfrT.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\xeZbdbG.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\CHRCfpY.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\aFOkxtt.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\HOsawqt.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\AgCLGzK.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\iPEoRLz.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\IHdnHoI.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\LriKwFZ.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\JBtbjYU.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\qYXvDVq.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\LfvwxIp.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\cJqPjWT.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1272	powershell.exe
1272	powershell.exe
1272	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeLockMemoryPrivilege	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
Token: SeLockMemoryPrivilege	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 1272	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	86
PID 3092 wrote to memory of 1272	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	86
PID 3092 wrote to memory of 3696	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	87
PID 3092 wrote to memory of 3696	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	87
PID 3092 wrote to memory of 1472	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	88
PID 3092 wrote to memory of 1472	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	88
PID 3092 wrote to memory of 3516	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	89
PID 3092 wrote to memory of 3516	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	89
PID 3092 wrote to memory of 2700	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	90
PID 3092 wrote to memory of 2700	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	90
PID 3092 wrote to memory of 2652	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	91
PID 3092 wrote to memory of 2652	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	91
PID 3092 wrote to memory of 1816	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	92
PID 3092 wrote to memory of 1816	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	92
PID 3092 wrote to memory of 4608	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	93
PID 3092 wrote to memory of 4608	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	93
PID 3092 wrote to memory of 2284	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	94
PID 3092 wrote to memory of 2284	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	94
PID 3092 wrote to memory of 4952	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	95
PID 3092 wrote to memory of 4952	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	95
PID 3092 wrote to memory of 4508	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	96
PID 3092 wrote to memory of 4508	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	96
PID 3092 wrote to memory of 3304	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	97
PID 3092 wrote to memory of 3304	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	97
PID 3092 wrote to memory of 2192	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	98
PID 3092 wrote to memory of 2192	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	98
PID 3092 wrote to memory of 736	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	99
PID 3092 wrote to memory of 736	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	99
PID 3092 wrote to memory of 3504	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	100
PID 3092 wrote to memory of 3504	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	100
PID 3092 wrote to memory of 2216	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	101
PID 3092 wrote to memory of 2216	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	101
PID 3092 wrote to memory of 4760	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	102
PID 3092 wrote to memory of 4760	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	102
PID 3092 wrote to memory of 4684	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	103
PID 3092 wrote to memory of 4684	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	103
PID 3092 wrote to memory of 3928	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	104
PID 3092 wrote to memory of 3928	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	104
PID 3092 wrote to memory of 400	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	105
PID 3092 wrote to memory of 400	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	105
PID 3092 wrote to memory of 3904	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	106
PID 3092 wrote to memory of 3904	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	106
PID 3092 wrote to memory of 3076	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	107
PID 3092 wrote to memory of 3076	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	107
PID 3092 wrote to memory of 2152	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	108
PID 3092 wrote to memory of 2152	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	108
PID 3092 wrote to memory of 3552	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	109
PID 3092 wrote to memory of 3552	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	109
PID 3092 wrote to memory of 2168	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	110
PID 3092 wrote to memory of 2168	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	110
PID 3092 wrote to memory of 4868	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	112
PID 3092 wrote to memory of 4868	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	112
PID 3092 wrote to memory of 4724	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	113
PID 3092 wrote to memory of 4724	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	113
PID 3092 wrote to memory of 3064	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	114
PID 3092 wrote to memory of 3064	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	114
PID 3092 wrote to memory of 208	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	115
PID 3092 wrote to memory of 208	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	115
PID 3092 wrote to memory of 548	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	116
PID 3092 wrote to memory of 548	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	116
PID 3092 wrote to memory of 4344	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	117
PID 3092 wrote to memory of 4344	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	117
PID 3092 wrote to memory of 2928	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	118
PID 3092 wrote to memory of 2928	3092	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	118

C:\Users\Admin\AppData\Local\Temp\8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
"C:\Users\Admin\AppData\Local\Temp\8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- C:\Windows\System\wKYbwNv.exe
  C:\Windows\System\wKYbwNv.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\LQxFAPX.exe
  C:\Windows\System\LQxFAPX.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\rALdwvb.exe
  C:\Windows\System\rALdwvb.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\JEszZNP.exe
  C:\Windows\System\JEszZNP.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\puvNndG.exe
  C:\Windows\System\puvNndG.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\pEkaXUu.exe
  C:\Windows\System\pEkaXUu.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\EkSYRMi.exe
  C:\Windows\System\EkSYRMi.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\UJPekio.exe
  C:\Windows\System\UJPekio.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\QYCQLMG.exe
  C:\Windows\System\QYCQLMG.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\WMHZueI.exe
  C:\Windows\System\WMHZueI.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\JFZtRKj.exe
  C:\Windows\System\JFZtRKj.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\uFfqXzW.exe
  C:\Windows\System\uFfqXzW.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\ZnfuKim.exe
  C:\Windows\System\ZnfuKim.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\NqQYbVJ.exe
  C:\Windows\System\NqQYbVJ.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\WBveAzB.exe
  C:\Windows\System\WBveAzB.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\OifgqjZ.exe
  C:\Windows\System\OifgqjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\KocBseE.exe
  C:\Windows\System\KocBseE.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\fPPxsKq.exe
  C:\Windows\System\fPPxsKq.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\nhlxVNI.exe
  C:\Windows\System\nhlxVNI.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\juTtANe.exe
  C:\Windows\System\juTtANe.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\IAuvkTs.exe
  C:\Windows\System\IAuvkTs.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\cIVexjw.exe
  C:\Windows\System\cIVexjw.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\OhMWkhU.exe
  C:\Windows\System\OhMWkhU.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\rdQKJpL.exe
  C:\Windows\System\rdQKJpL.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\SezHdEt.exe
  C:\Windows\System\SezHdEt.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\PQkiucT.exe
  C:\Windows\System\PQkiucT.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\lpGFDSP.exe
  C:\Windows\System\lpGFDSP.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\pPxnjav.exe
  C:\Windows\System\pPxnjav.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\TRDBOIp.exe
  C:\Windows\System\TRDBOIp.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\WreIcSa.exe
  C:\Windows\System\WreIcSa.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\UzoPgFn.exe
  C:\Windows\System\UzoPgFn.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\BZessZE.exe
  C:\Windows\System\BZessZE.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\WNBczcD.exe
  C:\Windows\System\WNBczcD.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\FQqNICJ.exe
  C:\Windows\System\FQqNICJ.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\EnwGKlA.exe
  C:\Windows\System\EnwGKlA.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\xmhJJiB.exe
  C:\Windows\System\xmhJJiB.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\IhwikeA.exe
  C:\Windows\System\IhwikeA.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\MxmbPTf.exe
  C:\Windows\System\MxmbPTf.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\llszAjF.exe
  C:\Windows\System\llszAjF.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\UEdubxP.exe
  C:\Windows\System\UEdubxP.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\ySSgtah.exe
  C:\Windows\System\ySSgtah.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\WZoHqly.exe
  C:\Windows\System\WZoHqly.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\IsXTylm.exe
  C:\Windows\System\IsXTylm.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\DabaVFN.exe
  C:\Windows\System\DabaVFN.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\vauDmej.exe
  C:\Windows\System\vauDmej.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\CykbXUP.exe
  C:\Windows\System\CykbXUP.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\tvTCzFp.exe
  C:\Windows\System\tvTCzFp.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\CafhhIf.exe
  C:\Windows\System\CafhhIf.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\yxEKehq.exe
  C:\Windows\System\yxEKehq.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\XUazsJP.exe
  C:\Windows\System\XUazsJP.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\spVFDYW.exe
  C:\Windows\System\spVFDYW.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\bmtFzwD.exe
  C:\Windows\System\bmtFzwD.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\jTHZlTg.exe
  C:\Windows\System\jTHZlTg.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\JPYzHTj.exe
  C:\Windows\System\JPYzHTj.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\DQUKjBw.exe
  C:\Windows\System\DQUKjBw.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\SwkwHUT.exe
  C:\Windows\System\SwkwHUT.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\KQIJKyX.exe
  C:\Windows\System\KQIJKyX.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\Ojrodpq.exe
  C:\Windows\System\Ojrodpq.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\AfvDHUn.exe
  C:\Windows\System\AfvDHUn.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\tgRqAjx.exe
  C:\Windows\System\tgRqAjx.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\zcRjVHX.exe
  C:\Windows\System\zcRjVHX.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\ERxAsqg.exe
  C:\Windows\System\ERxAsqg.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\JKEsdLO.exe
  C:\Windows\System\JKEsdLO.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\BFyWPFM.exe
  C:\Windows\System\BFyWPFM.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\FFKTglE.exe
  C:\Windows\System\FFKTglE.exe
  2⤵
  PID:2164
- C:\Windows\System\dbMVsSo.exe
  C:\Windows\System\dbMVsSo.exe
  2⤵
  PID:3756
- C:\Windows\System\XsGATNL.exe
  C:\Windows\System\XsGATNL.exe
  2⤵
  PID:2656
- C:\Windows\System\ATzSCdc.exe
  C:\Windows\System\ATzSCdc.exe
  2⤵
  PID:4400
- C:\Windows\System\cJqPjWT.exe
  C:\Windows\System\cJqPjWT.exe
  2⤵
  PID:988
- C:\Windows\System\UupZIRd.exe
  C:\Windows\System\UupZIRd.exe
  2⤵
  PID:668
- C:\Windows\System\JBtbjYU.exe
  C:\Windows\System\JBtbjYU.exe
  2⤵
  PID:3604
- C:\Windows\System\VSaNWja.exe
  C:\Windows\System\VSaNWja.exe
  2⤵
  PID:5068
- C:\Windows\System\CxdreIi.exe
  C:\Windows\System\CxdreIi.exe
  2⤵
  PID:2520
- C:\Windows\System\CwTuJRq.exe
  C:\Windows\System\CwTuJRq.exe
  2⤵
  PID:4244
- C:\Windows\System\VZWBIoe.exe
  C:\Windows\System\VZWBIoe.exe
  2⤵
  PID:3660
- C:\Windows\System\hhVvAoJ.exe
  C:\Windows\System\hhVvAoJ.exe
  2⤵
  PID:4996
- C:\Windows\System\nvfbZSl.exe
  C:\Windows\System\nvfbZSl.exe
  2⤵
  PID:828
- C:\Windows\System\xiSNVCP.exe
  C:\Windows\System\xiSNVCP.exe
  2⤵
  PID:4188
- C:\Windows\System\bqNqGDR.exe
  C:\Windows\System\bqNqGDR.exe
  2⤵
  PID:64
- C:\Windows\System\QiyMWOh.exe
  C:\Windows\System\QiyMWOh.exe
  2⤵
  PID:4264
- C:\Windows\System\VkvToMz.exe
  C:\Windows\System\VkvToMz.exe
  2⤵
  PID:3096
- C:\Windows\System\DKILUDt.exe
  C:\Windows\System\DKILUDt.exe
  2⤵
  PID:2084
- C:\Windows\System\cSNwevM.exe
  C:\Windows\System\cSNwevM.exe
  2⤵
  PID:4900
- C:\Windows\System\abCpWPT.exe
  C:\Windows\System\abCpWPT.exe
  2⤵
  PID:2280
- C:\Windows\System\ZuSxyFW.exe
  C:\Windows\System\ZuSxyFW.exe
  2⤵
  PID:3200
- C:\Windows\System\ezUgwHd.exe
  C:\Windows\System\ezUgwHd.exe
  2⤵
  PID:5128
- C:\Windows\System\jACFJJC.exe
  C:\Windows\System\jACFJJC.exe
  2⤵
  PID:5164
- C:\Windows\System\vRFKXYw.exe
  C:\Windows\System\vRFKXYw.exe
  2⤵
  PID:5184
- C:\Windows\System\jRwRkpN.exe
  C:\Windows\System\jRwRkpN.exe
  2⤵
  PID:5212
- C:\Windows\System\SACCdil.exe
  C:\Windows\System\SACCdil.exe
  2⤵
  PID:5252
- C:\Windows\System\BiaLzke.exe
  C:\Windows\System\BiaLzke.exe
  2⤵
  PID:5280
- C:\Windows\System\jNuEfHF.exe
  C:\Windows\System\jNuEfHF.exe
  2⤵
  PID:5308
- C:\Windows\System\nIJDwpX.exe
  C:\Windows\System\nIJDwpX.exe
  2⤵
  PID:5324
- C:\Windows\System\OZjNWMP.exe
  C:\Windows\System\OZjNWMP.exe
  2⤵
  PID:5352
- C:\Windows\System\vpcOUky.exe
  C:\Windows\System\vpcOUky.exe
  2⤵
  PID:5396
- C:\Windows\System\CLqVbph.exe
  C:\Windows\System\CLqVbph.exe
  2⤵
  PID:5424
- C:\Windows\System\NMkTPIW.exe
  C:\Windows\System\NMkTPIW.exe
  2⤵
  PID:5452
- C:\Windows\System\WUwyxqN.exe
  C:\Windows\System\WUwyxqN.exe
  2⤵
  PID:5480
- C:\Windows\System\srOHSJQ.exe
  C:\Windows\System\srOHSJQ.exe
  2⤵
  PID:5516
- C:\Windows\System\jvCYybJ.exe
  C:\Windows\System\jvCYybJ.exe
  2⤵
  PID:5536
- C:\Windows\System\RXAXfOG.exe
  C:\Windows\System\RXAXfOG.exe
  2⤵
  PID:5564
- C:\Windows\System\CHRCfpY.exe
  C:\Windows\System\CHRCfpY.exe
  2⤵
  PID:5592
- C:\Windows\System\rMqFXmD.exe
  C:\Windows\System\rMqFXmD.exe
  2⤵
  PID:5620
- C:\Windows\System\VVzOhEA.exe
  C:\Windows\System\VVzOhEA.exe
  2⤵
  PID:5640
- C:\Windows\System\pRdNeie.exe
  C:\Windows\System\pRdNeie.exe
  2⤵
  PID:5664
- C:\Windows\System\UkILHcS.exe
  C:\Windows\System\UkILHcS.exe
  2⤵
  PID:5692
- C:\Windows\System\qwAGkLP.exe
  C:\Windows\System\qwAGkLP.exe
  2⤵
  PID:5732
- C:\Windows\System\ODQpkoF.exe
  C:\Windows\System\ODQpkoF.exe
  2⤵
  PID:5760
- C:\Windows\System\BGIVerN.exe
  C:\Windows\System\BGIVerN.exe
  2⤵
  PID:5788
- C:\Windows\System\KHtuyIt.exe
  C:\Windows\System\KHtuyIt.exe
  2⤵
  PID:5804
- C:\Windows\System\dkbGgxM.exe
  C:\Windows\System\dkbGgxM.exe
  2⤵
  PID:5852
- C:\Windows\System\KdiFjTs.exe
  C:\Windows\System\KdiFjTs.exe
  2⤵
  PID:5868
- C:\Windows\System\vlloRYH.exe
  C:\Windows\System\vlloRYH.exe
  2⤵
  PID:5896
- C:\Windows\System\nXSucMi.exe
  C:\Windows\System\nXSucMi.exe
  2⤵
  PID:5928
- C:\Windows\System\VbrxVsS.exe
  C:\Windows\System\VbrxVsS.exe
  2⤵
  PID:5956
- C:\Windows\System\lmtdtyf.exe
  C:\Windows\System\lmtdtyf.exe
  2⤵
  PID:5976
- C:\Windows\System\OIobyEI.exe
  C:\Windows\System\OIobyEI.exe
  2⤵
  PID:5996
- C:\Windows\System\CWYlaUy.exe
  C:\Windows\System\CWYlaUy.exe
  2⤵
  PID:6020
- C:\Windows\System\dlynCwx.exe
  C:\Windows\System\dlynCwx.exe
  2⤵
  PID:6064
- C:\Windows\System\OUnZVwP.exe
  C:\Windows\System\OUnZVwP.exe
  2⤵
  PID:6108
- C:\Windows\System\dxdSOCz.exe
  C:\Windows\System\dxdSOCz.exe
  2⤵
  PID:6124
- C:\Windows\System\EHmbrvK.exe
  C:\Windows\System\EHmbrvK.exe
  2⤵
  PID:4764
- C:\Windows\System\JLDsqVw.exe
  C:\Windows\System\JLDsqVw.exe
  2⤵
  PID:5196
- C:\Windows\System\ELBSKnU.exe
  C:\Windows\System\ELBSKnU.exe
  2⤵
  PID:5264
- C:\Windows\System\bEdSsuE.exe
  C:\Windows\System\bEdSsuE.exe
  2⤵
  PID:5304
- C:\Windows\System\YklrgSF.exe
  C:\Windows\System\YklrgSF.exe
  2⤵
  PID:5384
- C:\Windows\System\LAZnZrD.exe
  C:\Windows\System\LAZnZrD.exe
  2⤵
  PID:5444
- C:\Windows\System\EKWykhu.exe
  C:\Windows\System\EKWykhu.exe
  2⤵
  PID:5504
- C:\Windows\System\LriKwFZ.exe
  C:\Windows\System\LriKwFZ.exe
  2⤵
  PID:5580
- C:\Windows\System\mfBsScn.exe
  C:\Windows\System\mfBsScn.exe
  2⤵
  PID:5628
- C:\Windows\System\TJWGcue.exe
  C:\Windows\System\TJWGcue.exe
  2⤵
  PID:5688
- C:\Windows\System\MwVcjmf.exe
  C:\Windows\System\MwVcjmf.exe
  2⤵
  PID:5744
- C:\Windows\System\XyWzYxW.exe
  C:\Windows\System\XyWzYxW.exe
  2⤵
  PID:5800
- C:\Windows\System\pUaMNvM.exe
  C:\Windows\System\pUaMNvM.exe
  2⤵
  PID:5876
- C:\Windows\System\IpjrkxD.exe
  C:\Windows\System\IpjrkxD.exe
  2⤵
  PID:5988
- C:\Windows\System\FUaFGXK.exe
  C:\Windows\System\FUaFGXK.exe
  2⤵
  PID:6008
- C:\Windows\System\KdbCweY.exe
  C:\Windows\System\KdbCweY.exe
  2⤵
  PID:6076
- C:\Windows\System\BqPppMY.exe
  C:\Windows\System\BqPppMY.exe
  2⤵
  PID:5160
- C:\Windows\System\AbfjJZx.exe
  C:\Windows\System\AbfjJZx.exe
  2⤵
  PID:5320
- C:\Windows\System\hgmNMOZ.exe
  C:\Windows\System\hgmNMOZ.exe
  2⤵
  PID:5500
- C:\Windows\System\MInrmBn.exe
  C:\Windows\System\MInrmBn.exe
  2⤵
  PID:3528
- C:\Windows\System\elWeXlV.exe
  C:\Windows\System\elWeXlV.exe
  2⤵
  PID:5684
- C:\Windows\System\yPrbPjC.exe
  C:\Windows\System\yPrbPjC.exe
  2⤵
  PID:5940
- C:\Windows\System\ebZDMpn.exe
  C:\Windows\System\ebZDMpn.exe
  2⤵
  PID:6120
- C:\Windows\System\pvRhuAH.exe
  C:\Windows\System\pvRhuAH.exe
  2⤵
  PID:5300
- C:\Windows\System\XFnQdfz.exe
  C:\Windows\System\XFnQdfz.exe
  2⤵
  PID:5676
- C:\Windows\System\xkAJFgQ.exe
  C:\Windows\System\xkAJFgQ.exe
  2⤵
  PID:6036
- C:\Windows\System\LbPpsZi.exe
  C:\Windows\System\LbPpsZi.exe
  2⤵
  PID:5780
- C:\Windows\System\RFwuqZn.exe
  C:\Windows\System\RFwuqZn.exe
  2⤵
  PID:5388
- C:\Windows\System\JmeuQpi.exe
  C:\Windows\System\JmeuQpi.exe
  2⤵
  PID:6164
- C:\Windows\System\VKzQOWQ.exe
  C:\Windows\System\VKzQOWQ.exe
  2⤵
  PID:6200
- C:\Windows\System\LansCSD.exe
  C:\Windows\System\LansCSD.exe
  2⤵
  PID:6228
- C:\Windows\System\vDRMufm.exe
  C:\Windows\System\vDRMufm.exe
  2⤵
  PID:6252
- C:\Windows\System\SjiTekO.exe
  C:\Windows\System\SjiTekO.exe
  2⤵
  PID:6284
- C:\Windows\System\oAKnMQI.exe
  C:\Windows\System\oAKnMQI.exe
  2⤵
  PID:6308
- C:\Windows\System\vmFGgxM.exe
  C:\Windows\System\vmFGgxM.exe
  2⤵
  PID:6340
- C:\Windows\System\bUEoEqQ.exe
  C:\Windows\System\bUEoEqQ.exe
  2⤵
  PID:6368
- C:\Windows\System\rOWefKc.exe
  C:\Windows\System\rOWefKc.exe
  2⤵
  PID:6396
- C:\Windows\System\saPOwEt.exe
  C:\Windows\System\saPOwEt.exe
  2⤵
  PID:6416
- C:\Windows\System\GyucjsF.exe
  C:\Windows\System\GyucjsF.exe
  2⤵
  PID:6448
- C:\Windows\System\GBJTHBa.exe
  C:\Windows\System\GBJTHBa.exe
  2⤵
  PID:6476
- C:\Windows\System\TFDWYuD.exe
  C:\Windows\System\TFDWYuD.exe
  2⤵
  PID:6508
- C:\Windows\System\MVHiwwl.exe
  C:\Windows\System\MVHiwwl.exe
  2⤵
  PID:6528
- C:\Windows\System\PkUrqoW.exe
  C:\Windows\System\PkUrqoW.exe
  2⤵
  PID:6560
- C:\Windows\System\RmRqzFX.exe
  C:\Windows\System\RmRqzFX.exe
  2⤵
  PID:6592
- C:\Windows\System\pJzpILx.exe
  C:\Windows\System\pJzpILx.exe
  2⤵
  PID:6616
- C:\Windows\System\iBbmWOL.exe
  C:\Windows\System\iBbmWOL.exe
  2⤵
  PID:6648
- C:\Windows\System\ZsxrCZs.exe
  C:\Windows\System\ZsxrCZs.exe
  2⤵
  PID:6672
- C:\Windows\System\ubOGGGA.exe
  C:\Windows\System\ubOGGGA.exe
  2⤵
  PID:6700
- C:\Windows\System\ZUkJHuI.exe
  C:\Windows\System\ZUkJHuI.exe
  2⤵
  PID:6728
- C:\Windows\System\fUVrQYj.exe
  C:\Windows\System\fUVrQYj.exe
  2⤵
  PID:6764
- C:\Windows\System\XnAJuVV.exe
  C:\Windows\System\XnAJuVV.exe
  2⤵
  PID:6788
- C:\Windows\System\KfDxUzT.exe
  C:\Windows\System\KfDxUzT.exe
  2⤵
  PID:6808
- C:\Windows\System\lABOClD.exe
  C:\Windows\System\lABOClD.exe
  2⤵
  PID:6844
- C:\Windows\System\eoZPFOT.exe
  C:\Windows\System\eoZPFOT.exe
  2⤵
  PID:6868
- C:\Windows\System\mgRbUJM.exe
  C:\Windows\System\mgRbUJM.exe
  2⤵
  PID:6900
- C:\Windows\System\jrEDgMp.exe
  C:\Windows\System\jrEDgMp.exe
  2⤵
  PID:6920
- C:\Windows\System\HHnfqZv.exe
  C:\Windows\System\HHnfqZv.exe
  2⤵
  PID:6948
- C:\Windows\System\dSlocWF.exe
  C:\Windows\System\dSlocWF.exe
  2⤵
  PID:6984
- C:\Windows\System\ZKvpjEM.exe
  C:\Windows\System\ZKvpjEM.exe
  2⤵
  PID:7016
- C:\Windows\System\UdqXBAe.exe
  C:\Windows\System\UdqXBAe.exe
  2⤵
  PID:7048
- C:\Windows\System\HALHFSS.exe
  C:\Windows\System\HALHFSS.exe
  2⤵
  PID:7068
- C:\Windows\System\wsFcJwY.exe
  C:\Windows\System\wsFcJwY.exe
  2⤵
  PID:7096
- C:\Windows\System\xuTkZUd.exe
  C:\Windows\System\xuTkZUd.exe
  2⤵
  PID:7124
- C:\Windows\System\tYxnSKY.exe
  C:\Windows\System\tYxnSKY.exe
  2⤵
  PID:7164
- C:\Windows\System\VnxLSEQ.exe
  C:\Windows\System\VnxLSEQ.exe
  2⤵
  PID:6180
- C:\Windows\System\GIvIiNj.exe
  C:\Windows\System\GIvIiNj.exe
  2⤵
  PID:6240
- C:\Windows\System\sBPyoAH.exe
  C:\Windows\System\sBPyoAH.exe
  2⤵
  PID:6324
- C:\Windows\System\nAqMhgc.exe
  C:\Windows\System\nAqMhgc.exe
  2⤵
  PID:6384
- C:\Windows\System\qmgfbUz.exe
  C:\Windows\System\qmgfbUz.exe
  2⤵
  PID:6456
- C:\Windows\System\TsKXNLQ.exe
  C:\Windows\System\TsKXNLQ.exe
  2⤵
  PID:6500
- C:\Windows\System\GfOxLAD.exe
  C:\Windows\System\GfOxLAD.exe
  2⤵
  PID:6568
- C:\Windows\System\LEdWQGr.exe
  C:\Windows\System\LEdWQGr.exe
  2⤵
  PID:6640
- C:\Windows\System\aFOkxtt.exe
  C:\Windows\System\aFOkxtt.exe
  2⤵
  PID:6712
- C:\Windows\System\enqSfHr.exe
  C:\Windows\System\enqSfHr.exe
  2⤵
  PID:6772
- C:\Windows\System\foRzbxG.exe
  C:\Windows\System\foRzbxG.exe
  2⤵
  PID:6836
- C:\Windows\System\ZwvtAoI.exe
  C:\Windows\System\ZwvtAoI.exe
  2⤵
  PID:6908
- C:\Windows\System\zlgHJyw.exe
  C:\Windows\System\zlgHJyw.exe
  2⤵
  PID:6944
- C:\Windows\System\hwoitvz.exe
  C:\Windows\System\hwoitvz.exe
  2⤵
  PID:7028
- C:\Windows\System\JjioHDm.exe
  C:\Windows\System\JjioHDm.exe
  2⤵
  PID:7084
- C:\Windows\System\olPxahO.exe
  C:\Windows\System\olPxahO.exe
  2⤵
  PID:3688
- C:\Windows\System\wNEifaM.exe
  C:\Windows\System\wNEifaM.exe
  2⤵
  PID:2316
- C:\Windows\System\HOsawqt.exe
  C:\Windows\System\HOsawqt.exe
  2⤵
  PID:3960
- C:\Windows\System\rmpLUpd.exe
  C:\Windows\System\rmpLUpd.exe
  2⤵
  PID:3028
- C:\Windows\System\FtwUYvw.exe
  C:\Windows\System\FtwUYvw.exe
  2⤵
  PID:6148
- C:\Windows\System\qTyQghP.exe
  C:\Windows\System\qTyQghP.exe
  2⤵
  PID:6296
- C:\Windows\System\SezXEtX.exe
  C:\Windows\System\SezXEtX.exe
  2⤵
  PID:6484
- C:\Windows\System\EZkcDar.exe
  C:\Windows\System\EZkcDar.exe
  2⤵
  PID:6660
- C:\Windows\System\YJGAVcb.exe
  C:\Windows\System\YJGAVcb.exe
  2⤵
  PID:6800
- C:\Windows\System\TaWSMyT.exe
  C:\Windows\System\TaWSMyT.exe
  2⤵
  PID:6932
- C:\Windows\System\NIJxNwV.exe
  C:\Windows\System\NIJxNwV.exe
  2⤵
  PID:7076
- C:\Windows\System\mTjFtcZ.exe
  C:\Windows\System\mTjFtcZ.exe
  2⤵
  PID:4852
- C:\Windows\System\VZapglr.exe
  C:\Windows\System\VZapglr.exe
  2⤵
  PID:7160
- C:\Windows\System\RTDUDHQ.exe
  C:\Windows\System\RTDUDHQ.exe
  2⤵
  PID:6412
- C:\Windows\System\NDaMHRq.exe
  C:\Windows\System\NDaMHRq.exe
  2⤵
  PID:6744
- C:\Windows\System\yAdkPXp.exe
  C:\Windows\System\yAdkPXp.exe
  2⤵
  PID:7132
- C:\Windows\System\AocPYSb.exe
  C:\Windows\System\AocPYSb.exe
  2⤵
  PID:6216
- C:\Windows\System\EexHwoG.exe
  C:\Windows\System\EexHwoG.exe
  2⤵
  PID:1672
- C:\Windows\System\HHKOnfk.exe
  C:\Windows\System\HHKOnfk.exe
  2⤵
  PID:6524
- C:\Windows\System\EJPUIxc.exe
  C:\Windows\System\EJPUIxc.exe
  2⤵
  PID:7192
- C:\Windows\System\jpnzSdz.exe
  C:\Windows\System\jpnzSdz.exe
  2⤵
  PID:7216
- C:\Windows\System\ZRUUMaW.exe
  C:\Windows\System\ZRUUMaW.exe
  2⤵
  PID:7248
- C:\Windows\System\jGdxQpg.exe
  C:\Windows\System\jGdxQpg.exe
  2⤵
  PID:7280
- C:\Windows\System\uqHNsLn.exe
  C:\Windows\System\uqHNsLn.exe
  2⤵
  PID:7304
- C:\Windows\System\hOyCejy.exe
  C:\Windows\System\hOyCejy.exe
  2⤵
  PID:7332
- C:\Windows\System\PXuMchl.exe
  C:\Windows\System\PXuMchl.exe
  2⤵
  PID:7364
- C:\Windows\System\TIePQGO.exe
  C:\Windows\System\TIePQGO.exe
  2⤵
  PID:7384
- C:\Windows\System\kAaqKnX.exe
  C:\Windows\System\kAaqKnX.exe
  2⤵
  PID:7416
- C:\Windows\System\NbisJLS.exe
  C:\Windows\System\NbisJLS.exe
  2⤵
  PID:7440
- C:\Windows\System\edbYcjo.exe
  C:\Windows\System\edbYcjo.exe
  2⤵
  PID:7472
- C:\Windows\System\TiPLYmP.exe
  C:\Windows\System\TiPLYmP.exe
  2⤵
  PID:7500
- C:\Windows\System\JPzfYnn.exe
  C:\Windows\System\JPzfYnn.exe
  2⤵
  PID:7532
- C:\Windows\System\AgCLGzK.exe
  C:\Windows\System\AgCLGzK.exe
  2⤵
  PID:7556
- C:\Windows\System\xSptTvO.exe
  C:\Windows\System\xSptTvO.exe
  2⤵
  PID:7580
- C:\Windows\System\MCnWJcl.exe
  C:\Windows\System\MCnWJcl.exe
  2⤵
  PID:7616
- C:\Windows\System\OPelwaZ.exe
  C:\Windows\System\OPelwaZ.exe
  2⤵
  PID:7636
- C:\Windows\System\CuHcvfb.exe
  C:\Windows\System\CuHcvfb.exe
  2⤵
  PID:7672
- C:\Windows\System\RboRtby.exe
  C:\Windows\System\RboRtby.exe
  2⤵
  PID:7696
- C:\Windows\System\hjXLqwT.exe
  C:\Windows\System\hjXLqwT.exe
  2⤵
  PID:7728
- C:\Windows\System\KNNauOG.exe
  C:\Windows\System\KNNauOG.exe
  2⤵
  PID:7748
- C:\Windows\System\AsSpapE.exe
  C:\Windows\System\AsSpapE.exe
  2⤵
  PID:7780
- C:\Windows\System\qNgPKGb.exe
  C:\Windows\System\qNgPKGb.exe
  2⤵
  PID:7804
- C:\Windows\System\FqEotwq.exe
  C:\Windows\System\FqEotwq.exe
  2⤵
  PID:7832
- C:\Windows\System\qBotYlB.exe
  C:\Windows\System\qBotYlB.exe
  2⤵
  PID:7864
- C:\Windows\System\WgwJOrf.exe
  C:\Windows\System\WgwJOrf.exe
  2⤵
  PID:7896
- C:\Windows\System\XVVBMxe.exe
  C:\Windows\System\XVVBMxe.exe
  2⤵
  PID:7924
- C:\Windows\System\gfsygpD.exe
  C:\Windows\System\gfsygpD.exe
  2⤵
  PID:7948
- C:\Windows\System\odURDva.exe
  C:\Windows\System\odURDva.exe
  2⤵
  PID:7980
- C:\Windows\System\DvXMWAK.exe
  C:\Windows\System\DvXMWAK.exe
  2⤵
  PID:8004
- C:\Windows\System\ZlmmXkV.exe
  C:\Windows\System\ZlmmXkV.exe
  2⤵
  PID:8028
- C:\Windows\System\jeUlEDd.exe
  C:\Windows\System\jeUlEDd.exe
  2⤵
  PID:8060
- C:\Windows\System\WDZtKJj.exe
  C:\Windows\System\WDZtKJj.exe
  2⤵
  PID:8088
- C:\Windows\System\zSnEvhS.exe
  C:\Windows\System\zSnEvhS.exe
  2⤵
  PID:8120
- C:\Windows\System\JgdaiSt.exe
  C:\Windows\System\JgdaiSt.exe
  2⤵
  PID:8144
- C:\Windows\System\BQtKhVW.exe
  C:\Windows\System\BQtKhVW.exe
  2⤵
  PID:8172
- C:\Windows\System\rKnhjin.exe
  C:\Windows\System\rKnhjin.exe
  2⤵
  PID:7200
- C:\Windows\System\MMXBPBO.exe
  C:\Windows\System\MMXBPBO.exe
  2⤵
  PID:7264
- C:\Windows\System\uoTvalO.exe
  C:\Windows\System\uoTvalO.exe
  2⤵
  PID:7320
- C:\Windows\System\WejEPSD.exe
  C:\Windows\System\WejEPSD.exe
  2⤵
  PID:7376
- C:\Windows\System\TEozjQx.exe
  C:\Windows\System\TEozjQx.exe
  2⤵
  PID:7452
- C:\Windows\System\HHoKFeJ.exe
  C:\Windows\System\HHoKFeJ.exe
  2⤵
  PID:7516
- C:\Windows\System\rJiKsqc.exe
  C:\Windows\System\rJiKsqc.exe
  2⤵
  PID:7576
- C:\Windows\System\XzzJRnH.exe
  C:\Windows\System\XzzJRnH.exe
  2⤵
  PID:7684
- C:\Windows\System\RbTJixf.exe
  C:\Windows\System\RbTJixf.exe
  2⤵
  PID:3016
- C:\Windows\System\PnGwoZx.exe
  C:\Windows\System\PnGwoZx.exe
  2⤵
  PID:7796
- C:\Windows\System\KdRWHva.exe
  C:\Windows\System\KdRWHva.exe
  2⤵
  PID:7856
- C:\Windows\System\CiKdEmB.exe
  C:\Windows\System\CiKdEmB.exe
  2⤵
  PID:7932
- C:\Windows\System\KLfUwRy.exe
  C:\Windows\System\KLfUwRy.exe
  2⤵
  PID:7992
- C:\Windows\System\qUSAAkb.exe
  C:\Windows\System\qUSAAkb.exe
  2⤵
  PID:8048
- C:\Windows\System\iYMhVRD.exe
  C:\Windows\System\iYMhVRD.exe
  2⤵
  PID:8108
- C:\Windows\System\IJhokYV.exe
  C:\Windows\System\IJhokYV.exe
  2⤵
  PID:8180
- C:\Windows\System\esAPcLH.exe
  C:\Windows\System\esAPcLH.exe
  2⤵
  PID:7292
- C:\Windows\System\raZLrmE.exe
  C:\Windows\System\raZLrmE.exe
  2⤵
  PID:7436
- C:\Windows\System\SoGiIkX.exe
  C:\Windows\System\SoGiIkX.exe
  2⤵
  PID:7648
- C:\Windows\System\tsuCGvq.exe
  C:\Windows\System\tsuCGvq.exe
  2⤵
  PID:7772
- C:\Windows\System\mlJdyBd.exe
  C:\Windows\System\mlJdyBd.exe
  2⤵
  PID:7912
- C:\Windows\System\ZSkGDbR.exe
  C:\Windows\System\ZSkGDbR.exe
  2⤵
  PID:8076
- C:\Windows\System\wUGiJTr.exe
  C:\Windows\System\wUGiJTr.exe
  2⤵
  PID:7240
- C:\Windows\System\qYXvDVq.exe
  C:\Windows\System\qYXvDVq.exe
  2⤵
  PID:7564
- C:\Windows\System\cEoXdzB.exe
  C:\Windows\System\cEoXdzB.exe
  2⤵
  PID:7968
- C:\Windows\System\DRKCdjB.exe
  C:\Windows\System\DRKCdjB.exe
  2⤵
  PID:7508
- C:\Windows\System\TmOdUgY.exe
  C:\Windows\System\TmOdUgY.exe
  2⤵
  PID:8136
- C:\Windows\System\iTcvUav.exe
  C:\Windows\System\iTcvUav.exe
  2⤵
  PID:8220
- C:\Windows\System\bAMiUdc.exe
  C:\Windows\System\bAMiUdc.exe
  2⤵
  PID:8236
- C:\Windows\System\LfvwxIp.exe
  C:\Windows\System\LfvwxIp.exe
  2⤵
  PID:8264
- C:\Windows\System\JABVZzI.exe
  C:\Windows\System\JABVZzI.exe
  2⤵
  PID:8292
- C:\Windows\System\HWZVIbs.exe
  C:\Windows\System\HWZVIbs.exe
  2⤵
  PID:8320
- C:\Windows\System\pvskwsA.exe
  C:\Windows\System\pvskwsA.exe
  2⤵
  PID:8348
- C:\Windows\System\ZOUCySH.exe
  C:\Windows\System\ZOUCySH.exe
  2⤵
  PID:8376
- C:\Windows\System\TiGQOGk.exe
  C:\Windows\System\TiGQOGk.exe
  2⤵
  PID:8404
- C:\Windows\System\ajpepzF.exe
  C:\Windows\System\ajpepzF.exe
  2⤵
  PID:8432
- C:\Windows\System\LveJOHV.exe
  C:\Windows\System\LveJOHV.exe
  2⤵
  PID:8460
- C:\Windows\System\xIzwBlY.exe
  C:\Windows\System\xIzwBlY.exe
  2⤵
  PID:8488
- C:\Windows\System\JlBPLoC.exe
  C:\Windows\System\JlBPLoC.exe
  2⤵
  PID:8516
- C:\Windows\System\Gaewagn.exe
  C:\Windows\System\Gaewagn.exe
  2⤵
  PID:8544
- C:\Windows\System\hYmxQnc.exe
  C:\Windows\System\hYmxQnc.exe
  2⤵
  PID:8572
- C:\Windows\System\RAVktiZ.exe
  C:\Windows\System\RAVktiZ.exe
  2⤵
  PID:8600
- C:\Windows\System\ikjYeAS.exe
  C:\Windows\System\ikjYeAS.exe
  2⤵
  PID:8628
- C:\Windows\System\RQyHETu.exe
  C:\Windows\System\RQyHETu.exe
  2⤵
  PID:8656
- C:\Windows\System\amwNyBq.exe
  C:\Windows\System\amwNyBq.exe
  2⤵
  PID:8684
- C:\Windows\System\DhGkbGp.exe
  C:\Windows\System\DhGkbGp.exe
  2⤵
  PID:8712
- C:\Windows\System\imFBULe.exe
  C:\Windows\System\imFBULe.exe
  2⤵
  PID:8740
- C:\Windows\System\GxPkrMH.exe
  C:\Windows\System\GxPkrMH.exe
  2⤵
  PID:8768
- C:\Windows\System\NSGciqW.exe
  C:\Windows\System\NSGciqW.exe
  2⤵
  PID:8796
- C:\Windows\System\KtbEssv.exe
  C:\Windows\System\KtbEssv.exe
  2⤵
  PID:8824
- C:\Windows\System\ZDSkzBi.exe
  C:\Windows\System\ZDSkzBi.exe
  2⤵
  PID:8852
- C:\Windows\System\BTDzshS.exe
  C:\Windows\System\BTDzshS.exe
  2⤵
  PID:8880
- C:\Windows\System\mHkeJar.exe
  C:\Windows\System\mHkeJar.exe
  2⤵
  PID:8908
- C:\Windows\System\vUSJktP.exe
  C:\Windows\System\vUSJktP.exe
  2⤵
  PID:8936
- C:\Windows\System\shZDfZT.exe
  C:\Windows\System\shZDfZT.exe
  2⤵
  PID:8968
- C:\Windows\System\WFNTOzn.exe
  C:\Windows\System\WFNTOzn.exe
  2⤵
  PID:8996
- C:\Windows\System\fBttWtW.exe
  C:\Windows\System\fBttWtW.exe
  2⤵
  PID:9024
- C:\Windows\System\HNUVJTo.exe
  C:\Windows\System\HNUVJTo.exe
  2⤵
  PID:9052
- C:\Windows\System\ZkXLSnc.exe
  C:\Windows\System\ZkXLSnc.exe
  2⤵
  PID:9080
- C:\Windows\System\YJVpLNV.exe
  C:\Windows\System\YJVpLNV.exe
  2⤵
  PID:9108
- C:\Windows\System\eHAFssf.exe
  C:\Windows\System\eHAFssf.exe
  2⤵
  PID:9136
- C:\Windows\System\SJZbrmY.exe
  C:\Windows\System\SJZbrmY.exe
  2⤵
  PID:9164
- C:\Windows\System\yEdWNug.exe
  C:\Windows\System\yEdWNug.exe
  2⤵
  PID:9180
- C:\Windows\System\cvGmUvc.exe
  C:\Windows\System\cvGmUvc.exe
  2⤵
  PID:8200
- C:\Windows\System\EGhDGHJ.exe
  C:\Windows\System\EGhDGHJ.exe
  2⤵
  PID:8260
- C:\Windows\System\HMvxity.exe
  C:\Windows\System\HMvxity.exe
  2⤵
  PID:8332
- C:\Windows\System\KnJcRNV.exe
  C:\Windows\System\KnJcRNV.exe
  2⤵
  PID:8396
- C:\Windows\System\UDAkJpJ.exe
  C:\Windows\System\UDAkJpJ.exe
  2⤵
  PID:8456
- C:\Windows\System\sjBWLcN.exe
  C:\Windows\System\sjBWLcN.exe
  2⤵
  PID:8528
- C:\Windows\System\AzyJTHU.exe
  C:\Windows\System\AzyJTHU.exe
  2⤵
  PID:8592
- C:\Windows\System\AsqmQMG.exe
  C:\Windows\System\AsqmQMG.exe
  2⤵
  PID:8648
- C:\Windows\System\uFIhFPs.exe
  C:\Windows\System\uFIhFPs.exe
  2⤵
  PID:8704
- C:\Windows\System\BBxgqLY.exe
  C:\Windows\System\BBxgqLY.exe
  2⤵
  PID:8780
- C:\Windows\System\cVYjtOI.exe
  C:\Windows\System\cVYjtOI.exe
  2⤵
  PID:8848
- C:\Windows\System\MmTnwfA.exe
  C:\Windows\System\MmTnwfA.exe
  2⤵
  PID:8904
- C:\Windows\System\tchxeYv.exe
  C:\Windows\System\tchxeYv.exe
  2⤵
  PID:8980
- C:\Windows\System\fPQDILb.exe
  C:\Windows\System\fPQDILb.exe
  2⤵
  PID:9048
- C:\Windows\System\OpQNZIN.exe
  C:\Windows\System\OpQNZIN.exe
  2⤵
  PID:9104
- C:\Windows\System\ZZQTqbX.exe
  C:\Windows\System\ZZQTqbX.exe
  2⤵
  PID:9156
- C:\Windows\System\szDQVEU.exe
  C:\Windows\System\szDQVEU.exe
  2⤵
  PID:8248
- C:\Windows\System\zklwPnx.exe
  C:\Windows\System\zklwPnx.exe
  2⤵
  PID:8388
- C:\Windows\System\xKzyhNm.exe
  C:\Windows\System\xKzyhNm.exe
  2⤵
  PID:8556
- C:\Windows\System\lrKJKtM.exe
  C:\Windows\System\lrKJKtM.exe
  2⤵
  PID:8696
- C:\Windows\System\xCPKOmF.exe
  C:\Windows\System\xCPKOmF.exe
  2⤵
  PID:8836
- C:\Windows\System\oeGyTHN.exe
  C:\Windows\System\oeGyTHN.exe
  2⤵
  PID:9008
- C:\Windows\System\QFLpIpe.exe
  C:\Windows\System\QFLpIpe.exe
  2⤵
  PID:9160
- C:\Windows\System\XAAJcfG.exe
  C:\Windows\System\XAAJcfG.exe
  2⤵
  PID:8360
- C:\Windows\System\dHIHDpe.exe
  C:\Windows\System\dHIHDpe.exe
  2⤵
  PID:8760
- C:\Windows\System\HRYnxTU.exe
  C:\Windows\System\HRYnxTU.exe
  2⤵
  PID:9100
- C:\Windows\System\HcfReET.exe
  C:\Windows\System\HcfReET.exe
  2⤵
  PID:8676
- C:\Windows\System\lbvBhHV.exe
  C:\Windows\System\lbvBhHV.exe
  2⤵
  PID:9072
- C:\Windows\System\YxCNezB.exe
  C:\Windows\System\YxCNezB.exe
  2⤵
  PID:9236
- C:\Windows\System\PTbgbjU.exe
  C:\Windows\System\PTbgbjU.exe
  2⤵
  PID:9264
- C:\Windows\System\uXHfGiW.exe
  C:\Windows\System\uXHfGiW.exe
  2⤵
  PID:9292
- C:\Windows\System\PSkjSRn.exe
  C:\Windows\System\PSkjSRn.exe
  2⤵
  PID:9320
- C:\Windows\System\VQQFLOd.exe
  C:\Windows\System\VQQFLOd.exe
  2⤵
  PID:9348
- C:\Windows\System\wuGeJtw.exe
  C:\Windows\System\wuGeJtw.exe
  2⤵
  PID:9376
- C:\Windows\System\LBumoyZ.exe
  C:\Windows\System\LBumoyZ.exe
  2⤵
  PID:9404
- C:\Windows\System\jzGKqkH.exe
  C:\Windows\System\jzGKqkH.exe
  2⤵
  PID:9432
- C:\Windows\System\QIZDYPD.exe
  C:\Windows\System\QIZDYPD.exe
  2⤵
  PID:9460
- C:\Windows\System\jKBZWEX.exe
  C:\Windows\System\jKBZWEX.exe
  2⤵
  PID:9488
- C:\Windows\System\EjRFelN.exe
  C:\Windows\System\EjRFelN.exe
  2⤵
  PID:9516
- C:\Windows\System\BwLDaeK.exe
  C:\Windows\System\BwLDaeK.exe
  2⤵
  PID:9544
- C:\Windows\System\nCLyoHU.exe
  C:\Windows\System\nCLyoHU.exe
  2⤵
  PID:9576
- C:\Windows\System\QGSVpuw.exe
  C:\Windows\System\QGSVpuw.exe
  2⤵
  PID:9604
- C:\Windows\System\anqNUtN.exe
  C:\Windows\System\anqNUtN.exe
  2⤵
  PID:9632
- C:\Windows\System\aQVcBEw.exe
  C:\Windows\System\aQVcBEw.exe
  2⤵
  PID:9660
- C:\Windows\System\FwxSxhB.exe
  C:\Windows\System\FwxSxhB.exe
  2⤵
  PID:9688
- C:\Windows\System\YYXVrto.exe
  C:\Windows\System\YYXVrto.exe
  2⤵
  PID:9716
- C:\Windows\System\niLrpXa.exe
  C:\Windows\System\niLrpXa.exe
  2⤵
  PID:9744
- C:\Windows\System\KERgqzi.exe
  C:\Windows\System\KERgqzi.exe
  2⤵
  PID:9772
- C:\Windows\System\VeBJbEs.exe
  C:\Windows\System\VeBJbEs.exe
  2⤵
  PID:9800
- C:\Windows\System\EZPwvKa.exe
  C:\Windows\System\EZPwvKa.exe
  2⤵
  PID:9828
- C:\Windows\System\zFSLCvT.exe
  C:\Windows\System\zFSLCvT.exe
  2⤵
  PID:9856
- C:\Windows\System\wPlgGIP.exe
  C:\Windows\System\wPlgGIP.exe
  2⤵
  PID:9884
- C:\Windows\System\pBbcklc.exe
  C:\Windows\System\pBbcklc.exe
  2⤵
  PID:9912
- C:\Windows\System\ygLyNca.exe
  C:\Windows\System\ygLyNca.exe
  2⤵
  PID:9940
- C:\Windows\System\AlWTXLF.exe
  C:\Windows\System\AlWTXLF.exe
  2⤵
  PID:9968
- C:\Windows\System\qlQqRWB.exe
  C:\Windows\System\qlQqRWB.exe
  2⤵
  PID:9996
- C:\Windows\System\aOQhLnz.exe
  C:\Windows\System\aOQhLnz.exe
  2⤵
  PID:10024
- C:\Windows\System\FWPCLmM.exe
  C:\Windows\System\FWPCLmM.exe
  2⤵
  PID:10052
- C:\Windows\System\YCkykLf.exe
  C:\Windows\System\YCkykLf.exe
  2⤵
  PID:10080
- C:\Windows\System\ZgIWSyr.exe
  C:\Windows\System\ZgIWSyr.exe
  2⤵
  PID:10108
- C:\Windows\System\IBgLIng.exe
  C:\Windows\System\IBgLIng.exe
  2⤵
  PID:10136
- C:\Windows\System\fjHuphI.exe
  C:\Windows\System\fjHuphI.exe
  2⤵
  PID:10164
- C:\Windows\System\pJYrJBs.exe
  C:\Windows\System\pJYrJBs.exe
  2⤵
  PID:10192
- C:\Windows\System\pUTZDSb.exe
  C:\Windows\System\pUTZDSb.exe
  2⤵
  PID:10220
- C:\Windows\System\RFqOHLD.exe
  C:\Windows\System\RFqOHLD.exe
  2⤵
  PID:9228
- C:\Windows\System\tvvoNLq.exe
  C:\Windows\System\tvvoNLq.exe
  2⤵
  PID:9288
- C:\Windows\System\cemRBly.exe
  C:\Windows\System\cemRBly.exe
  2⤵
  PID:9360
- C:\Windows\System\GYEPpvH.exe
  C:\Windows\System\GYEPpvH.exe
  2⤵
  PID:9424
- C:\Windows\System\HMmnlny.exe
  C:\Windows\System\HMmnlny.exe
  2⤵
  PID:9484
- C:\Windows\System\QMtZqia.exe
  C:\Windows\System\QMtZqia.exe
  2⤵
  PID:9556
- C:\Windows\System\RNplfbK.exe
  C:\Windows\System\RNplfbK.exe
  2⤵
  PID:9624
- C:\Windows\System\DzcpHOL.exe
  C:\Windows\System\DzcpHOL.exe
  2⤵
  PID:9712
- C:\Windows\System\bNdgIlh.exe
  C:\Windows\System\bNdgIlh.exe
  2⤵
  PID:9756
- C:\Windows\System\kPLlVcn.exe
  C:\Windows\System\kPLlVcn.exe
  2⤵
  PID:9820
- C:\Windows\System\zVROCAE.exe
  C:\Windows\System\zVROCAE.exe
  2⤵
  PID:9880
- C:\Windows\System\SBuvDOD.exe
  C:\Windows\System\SBuvDOD.exe
  2⤵
  PID:9932
- C:\Windows\System\DWAnOys.exe
  C:\Windows\System\DWAnOys.exe
  2⤵
  PID:9992
- C:\Windows\System\qLbZPNV.exe
  C:\Windows\System\qLbZPNV.exe
  2⤵
  PID:10064
- C:\Windows\System\CSrRkHS.exe
  C:\Windows\System\CSrRkHS.exe
  2⤵
  PID:10128
- C:\Windows\System\dIMhiiL.exe
  C:\Windows\System\dIMhiiL.exe
  2⤵
  PID:10188
- C:\Windows\System\dvbtwZn.exe
  C:\Windows\System\dvbtwZn.exe
  2⤵
  PID:9256
- C:\Windows\System\kRrXTuV.exe
  C:\Windows\System\kRrXTuV.exe
  2⤵
  PID:9400
- C:\Windows\System\IVItPhs.exe
  C:\Windows\System\IVItPhs.exe
  2⤵
  PID:9536
- C:\Windows\System\bPfhiit.exe
  C:\Windows\System\bPfhiit.exe
  2⤵
  PID:9564
- C:\Windows\System\kRFInLT.exe
  C:\Windows\System\kRFInLT.exe
  2⤵
  PID:9848
- C:\Windows\System\orWGzOC.exe
  C:\Windows\System\orWGzOC.exe
  2⤵
  PID:9980
- C:\Windows\System\HQPPayC.exe
  C:\Windows\System\HQPPayC.exe
  2⤵
  PID:10120
- C:\Windows\System\hPcLFZa.exe
  C:\Windows\System\hPcLFZa.exe
  2⤵
  PID:9316
- C:\Windows\System\ytzuzbC.exe
  C:\Windows\System\ytzuzbC.exe
  2⤵
  PID:9672
- C:\Windows\System\lqYuXhK.exe
  C:\Windows\System\lqYuXhK.exe
  2⤵
  PID:9960
- C:\Windows\System\NGqkzum.exe
  C:\Windows\System\NGqkzum.exe
  2⤵
  PID:9472
- C:\Windows\System\eWlTJht.exe
  C:\Windows\System\eWlTJht.exe
  2⤵
  PID:10232
- C:\Windows\System\aocyCol.exe
  C:\Windows\System\aocyCol.exe
  2⤵
  PID:10248
- C:\Windows\System\ZYVWKGO.exe
  C:\Windows\System\ZYVWKGO.exe
  2⤵
  PID:10276
- C:\Windows\System\YbgxAjZ.exe
  C:\Windows\System\YbgxAjZ.exe
  2⤵
  PID:10304
- C:\Windows\System\fgmVitH.exe
  C:\Windows\System\fgmVitH.exe
  2⤵
  PID:10332
- C:\Windows\System\hKRtqaD.exe
  C:\Windows\System\hKRtqaD.exe
  2⤵
  PID:10360
- C:\Windows\System\rmBubFi.exe
  C:\Windows\System\rmBubFi.exe
  2⤵
  PID:10388
- C:\Windows\System\OjOmHnM.exe
  C:\Windows\System\OjOmHnM.exe
  2⤵
  PID:10416
- C:\Windows\System\DMfWfsw.exe
  C:\Windows\System\DMfWfsw.exe
  2⤵
  PID:10444
- C:\Windows\System\vOBnILj.exe
  C:\Windows\System\vOBnILj.exe
  2⤵
  PID:10472
- C:\Windows\System\JniINGa.exe
  C:\Windows\System\JniINGa.exe
  2⤵
  PID:10500
- C:\Windows\System\PPYZpto.exe
  C:\Windows\System\PPYZpto.exe
  2⤵
  PID:10528
- C:\Windows\System\nZzOdBa.exe
  C:\Windows\System\nZzOdBa.exe
  2⤵
  PID:10556
- C:\Windows\System\NcigucC.exe
  C:\Windows\System\NcigucC.exe
  2⤵
  PID:10584
- C:\Windows\System\HZTbwYa.exe
  C:\Windows\System\HZTbwYa.exe
  2⤵
  PID:10612
- C:\Windows\System\SNlKOet.exe
  C:\Windows\System\SNlKOet.exe
  2⤵
  PID:10640
- C:\Windows\System\BxEvzGF.exe
  C:\Windows\System\BxEvzGF.exe
  2⤵
  PID:10668
- C:\Windows\System\BFQMTvr.exe
  C:\Windows\System\BFQMTvr.exe
  2⤵
  PID:10696
- C:\Windows\System\sdyJYGf.exe
  C:\Windows\System\sdyJYGf.exe
  2⤵
  PID:10724
- C:\Windows\System\KIEQloa.exe
  C:\Windows\System\KIEQloa.exe
  2⤵
  PID:10752
- C:\Windows\System\SZssowf.exe
  C:\Windows\System\SZssowf.exe
  2⤵
  PID:10780
- C:\Windows\System\VDWSiOF.exe
  C:\Windows\System\VDWSiOF.exe
  2⤵
  PID:10808
- C:\Windows\System\GFVyecA.exe
  C:\Windows\System\GFVyecA.exe
  2⤵
  PID:10836
- C:\Windows\System\FgoGHkQ.exe
  C:\Windows\System\FgoGHkQ.exe
  2⤵
  PID:10864
- C:\Windows\System\yIwdeSW.exe
  C:\Windows\System\yIwdeSW.exe
  2⤵
  PID:10892
- C:\Windows\System\ERPLukF.exe
  C:\Windows\System\ERPLukF.exe
  2⤵
  PID:10924
- C:\Windows\System\RoYKxLJ.exe
  C:\Windows\System\RoYKxLJ.exe
  2⤵
  PID:10948
- C:\Windows\System\JLGwRzu.exe
  C:\Windows\System\JLGwRzu.exe
  2⤵
  PID:10976
- C:\Windows\System\rDKJyVL.exe
  C:\Windows\System\rDKJyVL.exe
  2⤵
  PID:11004
- C:\Windows\System\YKjvNXg.exe
  C:\Windows\System\YKjvNXg.exe
  2⤵
  PID:11032
- C:\Windows\System\CViuRet.exe
  C:\Windows\System\CViuRet.exe
  2⤵
  PID:11064
- C:\Windows\System\zGXkPgu.exe
  C:\Windows\System\zGXkPgu.exe
  2⤵
  PID:11092
- C:\Windows\System\RpqPMbs.exe
  C:\Windows\System\RpqPMbs.exe
  2⤵
  PID:11120
- C:\Windows\System\cmvrvrO.exe
  C:\Windows\System\cmvrvrO.exe
  2⤵
  PID:11148
- C:\Windows\System\miwuaeu.exe
  C:\Windows\System\miwuaeu.exe
  2⤵
  PID:11176
- C:\Windows\System\EykZAQa.exe
  C:\Windows\System\EykZAQa.exe
  2⤵
  PID:11204
- C:\Windows\System\tmdRBIz.exe
  C:\Windows\System\tmdRBIz.exe
  2⤵
  PID:11232
- C:\Windows\System\XKVOCwr.exe
  C:\Windows\System\XKVOCwr.exe
  2⤵
  PID:11260
- C:\Windows\System\ylynnGi.exe
  C:\Windows\System\ylynnGi.exe
  2⤵
  PID:10296
- C:\Windows\System\CwjpfrT.exe
  C:\Windows\System\CwjpfrT.exe
  2⤵
  PID:10356
- C:\Windows\System\FygsLhX.exe
  C:\Windows\System\FygsLhX.exe
  2⤵
  PID:10428
- C:\Windows\System\lXVreMK.exe
  C:\Windows\System\lXVreMK.exe
  2⤵
  PID:10492
- C:\Windows\System\gZMpJRw.exe
  C:\Windows\System\gZMpJRw.exe
  2⤵
  PID:10552
- C:\Windows\System\iPEoRLz.exe
  C:\Windows\System\iPEoRLz.exe
  2⤵
  PID:10624
- C:\Windows\System\cwytZSe.exe
  C:\Windows\System\cwytZSe.exe
  2⤵
  PID:10688
- C:\Windows\System\aVPQMoj.exe
  C:\Windows\System\aVPQMoj.exe
  2⤵
  PID:9904
- C:\Windows\System\WHeoZAd.exe
  C:\Windows\System\WHeoZAd.exe
  2⤵
  PID:10804
- C:\Windows\System\HJgdKLY.exe
  C:\Windows\System\HJgdKLY.exe
  2⤵
  PID:10876
- C:\Windows\System\fQJZDcG.exe
  C:\Windows\System\fQJZDcG.exe
  2⤵
  PID:10940
- C:\Windows\System\gFkwnvT.exe
  C:\Windows\System\gFkwnvT.exe
  2⤵
  PID:10996
- C:\Windows\System\OuQnpBU.exe
  C:\Windows\System\OuQnpBU.exe
  2⤵
  PID:11076
- C:\Windows\System\hkzrByx.exe
  C:\Windows\System\hkzrByx.exe
  2⤵
  PID:11140
- C:\Windows\System\iPubiSs.exe
  C:\Windows\System\iPubiSs.exe
  2⤵
  PID:11196
- C:\Windows\System\grdCcDj.exe
  C:\Windows\System\grdCcDj.exe
  2⤵
  PID:10260
- C:\Windows\System\McdQRAp.exe
  C:\Windows\System\McdQRAp.exe
  2⤵
  PID:10408
- C:\Windows\System\FAPgIPP.exe
  C:\Windows\System\FAPgIPP.exe
  2⤵
  PID:10548
- C:\Windows\System\FkxELtU.exe
  C:\Windows\System\FkxELtU.exe
  2⤵
  PID:10716
- C:\Windows\System\zBAcFgv.exe
  C:\Windows\System\zBAcFgv.exe
  2⤵
  PID:10856
- C:\Windows\System\dzITXZU.exe
  C:\Windows\System\dzITXZU.exe
  2⤵
  PID:10988
- C:\Windows\System\apLmumM.exe
  C:\Windows\System\apLmumM.exe
  2⤵
  PID:11172
- C:\Windows\System\sNrCXMX.exe
  C:\Windows\System\sNrCXMX.exe
  2⤵
  PID:10352
- C:\Windows\System\IDweabc.exe
  C:\Windows\System\IDweabc.exe
  2⤵
  PID:10680
- C:\Windows\System\uthLKLS.exe
  C:\Windows\System\uthLKLS.exe
  2⤵
  PID:11056
- C:\Windows\System\pgLkDiu.exe
  C:\Windows\System\pgLkDiu.exe
  2⤵
  PID:10608
- C:\Windows\System\MWjvhyX.exe
  C:\Windows\System\MWjvhyX.exe
  2⤵
  PID:10324
- C:\Windows\System\EjXNwgE.exe
  C:\Windows\System\EjXNwgE.exe
  2⤵
  PID:11280
- C:\Windows\System\NIdYcmE.exe
  C:\Windows\System\NIdYcmE.exe
  2⤵
  PID:11308
- C:\Windows\System\LBKYwQX.exe
  C:\Windows\System\LBKYwQX.exe
  2⤵
  PID:11336
- C:\Windows\System\kQDTGhH.exe
  C:\Windows\System\kQDTGhH.exe
  2⤵
  PID:11372
- C:\Windows\System\OXKpcIB.exe
  C:\Windows\System\OXKpcIB.exe
  2⤵
  PID:11392
- C:\Windows\System\BuUPoPn.exe
  C:\Windows\System\BuUPoPn.exe
  2⤵
  PID:11420
- C:\Windows\System\rMByRaX.exe
  C:\Windows\System\rMByRaX.exe
  2⤵
  PID:11448
- C:\Windows\System\WHhIajA.exe
  C:\Windows\System\WHhIajA.exe
  2⤵
  PID:11476
- C:\Windows\System\oySEyFq.exe
  C:\Windows\System\oySEyFq.exe
  2⤵
  PID:11504
- C:\Windows\System\BwqYExi.exe
  C:\Windows\System\BwqYExi.exe
  2⤵
  PID:11532
- C:\Windows\System\CksjCAG.exe
  C:\Windows\System\CksjCAG.exe
  2⤵
  PID:11560
- C:\Windows\System\zKtasxn.exe
  C:\Windows\System\zKtasxn.exe
  2⤵
  PID:11592
- C:\Windows\System\QpYunZQ.exe
  C:\Windows\System\QpYunZQ.exe
  2⤵
  PID:11612
- C:\Windows\System\BJATtCf.exe
  C:\Windows\System\BJATtCf.exe
  2⤵
  PID:11636
- C:\Windows\System\POwgRku.exe
  C:\Windows\System\POwgRku.exe
  2⤵
  PID:11696
- C:\Windows\System\kDgoeAV.exe
  C:\Windows\System\kDgoeAV.exe
  2⤵
  PID:11712
- C:\Windows\System\IHdnHoI.exe
  C:\Windows\System\IHdnHoI.exe
  2⤵
  PID:11728
- C:\Windows\System\dxbmQUO.exe
  C:\Windows\System\dxbmQUO.exe
  2⤵
  PID:11768
- C:\Windows\System\dfiTfIB.exe
  C:\Windows\System\dfiTfIB.exe
  2⤵
  PID:11796
- C:\Windows\System\ZBFoCLQ.exe
  C:\Windows\System\ZBFoCLQ.exe
  2⤵
  PID:11824
- C:\Windows\System\aOKHJYo.exe
  C:\Windows\System\aOKHJYo.exe
  2⤵
  PID:11852
- C:\Windows\System\YWPjTqk.exe
  C:\Windows\System\YWPjTqk.exe
  2⤵
  PID:11880
- C:\Windows\System\ICAxQOV.exe
  C:\Windows\System\ICAxQOV.exe
  2⤵
  PID:11908
- C:\Windows\System\EiYFZHF.exe
  C:\Windows\System\EiYFZHF.exe
  2⤵
  PID:11936
- C:\Windows\System\StEoRTl.exe
  C:\Windows\System\StEoRTl.exe
  2⤵
  PID:11964
- C:\Windows\System\JbXLZgF.exe
  C:\Windows\System\JbXLZgF.exe
  2⤵
  PID:11992
- C:\Windows\System\CejOUHl.exe
  C:\Windows\System\CejOUHl.exe
  2⤵
  PID:12020
- C:\Windows\System\RpSzEwG.exe
  C:\Windows\System\RpSzEwG.exe
  2⤵
  PID:12048
- C:\Windows\System\PNrEyFp.exe
  C:\Windows\System\PNrEyFp.exe
  2⤵
  PID:12076
- C:\Windows\System\EYJkBFJ.exe
  C:\Windows\System\EYJkBFJ.exe
  2⤵
  PID:12104
- C:\Windows\System\blIhpuq.exe
  C:\Windows\System\blIhpuq.exe
  2⤵
  PID:12132
- C:\Windows\System\owRLAoT.exe
  C:\Windows\System\owRLAoT.exe
  2⤵
  PID:12160
- C:\Windows\System\jImFwuu.exe
  C:\Windows\System\jImFwuu.exe
  2⤵
  PID:12188
- C:\Windows\System\DAcCiIg.exe
  C:\Windows\System\DAcCiIg.exe
  2⤵
  PID:12216
- C:\Windows\System\uUcalGD.exe
  C:\Windows\System\uUcalGD.exe
  2⤵
  PID:12244
- C:\Windows\System\bIllnPY.exe
  C:\Windows\System\bIllnPY.exe
  2⤵
  PID:12272
- C:\Windows\System\zHPmsyn.exe
  C:\Windows\System\zHPmsyn.exe
  2⤵
  PID:11276
- C:\Windows\System\GZmcyBM.exe
  C:\Windows\System\GZmcyBM.exe
  2⤵
  PID:11348
- C:\Windows\System\KJfKxik.exe
  C:\Windows\System\KJfKxik.exe
  2⤵
  PID:11412
- C:\Windows\System\ENskbaK.exe
  C:\Windows\System\ENskbaK.exe
  2⤵
  PID:11472
- C:\Windows\System\GvEOpAQ.exe
  C:\Windows\System\GvEOpAQ.exe
  2⤵
  PID:11544
- C:\Windows\System\rxZQEEW.exe
  C:\Windows\System\rxZQEEW.exe
  2⤵
  PID:11628
- C:\Windows\System\yfoNoNK.exe
  C:\Windows\System\yfoNoNK.exe
  2⤵
  PID:11692
- C:\Windows\System\jACFMXZ.exe
  C:\Windows\System\jACFMXZ.exe
  2⤵
  PID:11740
- C:\Windows\System\DgBEHMC.exe
  C:\Windows\System\DgBEHMC.exe
  2⤵
  PID:3248
- C:\Windows\System\pchxOPF.exe
  C:\Windows\System\pchxOPF.exe
  2⤵
  PID:11788
- C:\Windows\System\FgVBKoF.exe
  C:\Windows\System\FgVBKoF.exe
  2⤵
  PID:11864
- C:\Windows\System\AZxYduL.exe
  C:\Windows\System\AZxYduL.exe
  2⤵
  PID:11920
- C:\Windows\System\KmVylIJ.exe
  C:\Windows\System\KmVylIJ.exe
  2⤵
  PID:11984
- C:\Windows\System\cLptQZb.exe
  C:\Windows\System\cLptQZb.exe
  2⤵
  PID:12044
- C:\Windows\System\ErbfrHK.exe
  C:\Windows\System\ErbfrHK.exe
  2⤵
  PID:12116
- C:\Windows\System\aUqxhbG.exe
  C:\Windows\System\aUqxhbG.exe
  2⤵
  PID:12184
- C:\Windows\System\snuUzaL.exe
  C:\Windows\System\snuUzaL.exe
  2⤵
  PID:12240
- C:\Windows\System\gzkLAdi.exe
  C:\Windows\System\gzkLAdi.exe
  2⤵
  PID:11304
- C:\Windows\System\vpALIVu.exe
  C:\Windows\System\vpALIVu.exe
  2⤵
  PID:11460
- C:\Windows\System\THHBCYW.exe
  C:\Windows\System\THHBCYW.exe
  2⤵
  PID:11588
- C:\Windows\System\eSkWqMa.exe
  C:\Windows\System\eSkWqMa.exe
  2⤵
  PID:11724
- C:\Windows\System\ketTyDC.exe
  C:\Windows\System\ketTyDC.exe
  2⤵
  PID:11820
- C:\Windows\System\UrIocVp.exe
  C:\Windows\System\UrIocVp.exe
  2⤵
  PID:11960
- C:\Windows\System\RnMdwMg.exe
  C:\Windows\System\RnMdwMg.exe
  2⤵
  PID:12096
- C:\Windows\System\IMUGZjh.exe
  C:\Windows\System\IMUGZjh.exe
  2⤵
  PID:12268
- C:\Windows\System\nVvybUx.exe
  C:\Windows\System\nVvybUx.exe
  2⤵
  PID:11528
- C:\Windows\System\idcbDDm.exe
  C:\Windows\System\idcbDDm.exe
  2⤵
  PID:11792
- C:\Windows\System\xLqyESw.exe
  C:\Windows\System\xLqyESw.exe
  2⤵
  PID:12172
- C:\Windows\System\hUXyXzS.exe
  C:\Windows\System\hUXyXzS.exe
  2⤵
  PID:4612
- C:\Windows\System\qckLGLm.exe
  C:\Windows\System\qckLGLm.exe
  2⤵
  PID:11580
- C:\Windows\System\psgOKrz.exe
  C:\Windows\System\psgOKrz.exe
  2⤵
  PID:12304
- C:\Windows\System\afitdWU.exe
  C:\Windows\System\afitdWU.exe
  2⤵
  PID:12332
- C:\Windows\System\tbkheXf.exe
  C:\Windows\System\tbkheXf.exe
  2⤵
  PID:12360
- C:\Windows\System\zEoDdRe.exe
  C:\Windows\System\zEoDdRe.exe
  2⤵
  PID:12388
- C:\Windows\System\GNmfCxy.exe
  C:\Windows\System\GNmfCxy.exe
  2⤵
  PID:12416
- C:\Windows\System\YeYAyhO.exe
  C:\Windows\System\YeYAyhO.exe
  2⤵
  PID:12444
- C:\Windows\System\easkOnk.exe
  C:\Windows\System\easkOnk.exe
  2⤵
  PID:12472
- C:\Windows\System\KPFbGGX.exe
  C:\Windows\System\KPFbGGX.exe
  2⤵
  PID:12500
- C:\Windows\System\ciQnImX.exe
  C:\Windows\System\ciQnImX.exe
  2⤵
  PID:12528
- C:\Windows\System\kODSCbE.exe
  C:\Windows\System\kODSCbE.exe
  2⤵
  PID:12556
- C:\Windows\System\SSxkrYD.exe
  C:\Windows\System\SSxkrYD.exe
  2⤵
  PID:12584
- C:\Windows\System\sGFCTWm.exe
  C:\Windows\System\sGFCTWm.exe
  2⤵
  PID:12612
- C:\Windows\System\BvxhCbf.exe
  C:\Windows\System\BvxhCbf.exe
  2⤵
  PID:12640
- C:\Windows\System\DSwznZw.exe
  C:\Windows\System\DSwznZw.exe
  2⤵
  PID:12668
- C:\Windows\System\kCGtVbj.exe
  C:\Windows\System\kCGtVbj.exe
  2⤵
  PID:12696
- C:\Windows\System\vMqmUIp.exe
  C:\Windows\System\vMqmUIp.exe
  2⤵
  PID:12724
- C:\Windows\System\ATxMCXa.exe
  C:\Windows\System\ATxMCXa.exe
  2⤵
  PID:12752
- C:\Windows\System\dUJALzu.exe
  C:\Windows\System\dUJALzu.exe
  2⤵
  PID:12780
- C:\Windows\System\iJhskUG.exe
  C:\Windows\System\iJhskUG.exe
  2⤵
  PID:12808
- C:\Windows\System\CwSJdzD.exe
  C:\Windows\System\CwSJdzD.exe
  2⤵
  PID:12836
- C:\Windows\System\lXDJxAH.exe
  C:\Windows\System\lXDJxAH.exe
  2⤵
  PID:12864
- C:\Windows\System\ixFLQzy.exe
  C:\Windows\System\ixFLQzy.exe
  2⤵
  PID:12892
- C:\Windows\System\lzOnukf.exe
  C:\Windows\System\lzOnukf.exe
  2⤵
  PID:12920
- C:\Windows\System\DCxAIiu.exe
  C:\Windows\System\DCxAIiu.exe
  2⤵
  PID:12948
- C:\Windows\System\yPcfsSL.exe
  C:\Windows\System\yPcfsSL.exe
  2⤵
  PID:12980
- C:\Windows\System\YyxyJdp.exe
  C:\Windows\System\YyxyJdp.exe
  2⤵
  PID:13016
- C:\Windows\System\APfiGsw.exe
  C:\Windows\System\APfiGsw.exe
  2⤵
  PID:13036
- C:\Windows\System\VFZgHcj.exe
  C:\Windows\System\VFZgHcj.exe
  2⤵
  PID:13064
- C:\Windows\System\xTrXOFT.exe
  C:\Windows\System\xTrXOFT.exe
  2⤵
  PID:13092
- C:\Windows\System\SDgsNcJ.exe
  C:\Windows\System\SDgsNcJ.exe
  2⤵
  PID:13120
- C:\Windows\System\vbTkKVL.exe
  C:\Windows\System\vbTkKVL.exe
  2⤵
  PID:13196
- C:\Windows\System\hEXqweI.exe
  C:\Windows\System\hEXqweI.exe
  2⤵
  PID:13212
- C:\Windows\System\mBectef.exe
  C:\Windows\System\mBectef.exe
  2⤵
  PID:13228
- C:\Windows\System\NZApaEU.exe
  C:\Windows\System\NZApaEU.exe
  2⤵
  PID:13264
- C:\Windows\System\vqnedLq.exe
  C:\Windows\System\vqnedLq.exe
  2⤵
  PID:13296
- C:\Windows\System\FZIQdsU.exe
  C:\Windows\System\FZIQdsU.exe
  2⤵
  PID:12316
- C:\Windows\System\DVcYXmc.exe
  C:\Windows\System\DVcYXmc.exe
  2⤵
  PID:12380
- C:\Windows\System\ywaKilN.exe
  C:\Windows\System\ywaKilN.exe
  2⤵
  PID:12436
- C:\Windows\System\bSuFLhu.exe
  C:\Windows\System\bSuFLhu.exe
  2⤵
  PID:12492
- C:\Windows\System\cmZdsYn.exe
  C:\Windows\System\cmZdsYn.exe
  2⤵
  PID:12548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i3nhhupp.a2r.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BZessZE.exe

Filesize
3.8MB

MD5
fcdcd8d60333b2561482c200c63b0474

SHA1
d9ba042e6c1ed1f371d599673a7c78128dc24450

SHA256
16b32fc5e5ed6cbc241b6bf0c4bbceed220bcd34bbe68628e5c90b097ce322c4

SHA512
3850883a709a45d3c86868bf11aad342c1fdd44d1f14b22ed24fe671306d0657950177db31c26d4e0ea1e3358d1c1421e6b20506d39fe9ff0a494b45738ab1a7

Download Submit
C:\Windows\System\EkSYRMi.exe

Filesize
3.8MB

MD5
992483135dfa596d402975a6dd1c15c0

SHA1
46b738e25e206b5d4e4150f69d6ac481182c7439

SHA256
509da924d7a20347f272dac24a488c6b0e650bc4f32869d3763c99b4a180c81e

SHA512
86a1baee3d8ca2d663c0a9e3773cd9c0403c9a8466f78c3252cb7dede71d986b60e3f390653f2ed2cb2b41e2cb22a2d4e84e525ea9d7b03ce77552a18d26207c

Download Submit
C:\Windows\System\IAuvkTs.exe

Filesize
3.8MB

MD5
392cb5cb32625076093115f7846a9e48

SHA1
f76244e7efe0aa6f96120fefcdf33a9bc448b50d

SHA256
02e6637c2efb57ae3bc9cc4fec7e8d351e7dae14235250ad32720bad8f097d93

SHA512
84c052a013342d419c10b1cfe884d025775f0d3e5285c9f2f7c089f2820bc028becd903e9390ecc9c1dce8c8827a9461ebee381c43f219db5a3f731e55210a63

Download Submit
C:\Windows\System\JEszZNP.exe

Filesize
3.8MB

MD5
d0b27dfe2577fe3dcc5fa2575a6cd9ee

SHA1
be19645ea6a3b1542b2a57596fff5e6cb076afd3

SHA256
36336174f300b6b702e05cfa8c0aaeca6b0a8ccb0bc196c5c8ae9948eb084973

SHA512
bb45a6938da7aa73a11d975796cf586f80a89e78cb66ea8f03bf34dc1666e229c7d8549d7787a81a9b24a7d8e9cfa7279f00bc9d8c47958e447e8a87f7a60621

Download Submit
C:\Windows\System\JFZtRKj.exe

Filesize
3.8MB

MD5
d172b246e11ba40b529aaab6dc4d03e7

SHA1
a285bebaca98563ed751bcd0f9e9b7da25a2a238

SHA256
8314158f18b7ca7f662d456fde8e9635db8fb8d73ed91de9dc9885ec86fa7277

SHA512
1f2ec5a064df248e832b6a5a17d5639cb26f2b2cd6beb23fe60c738b03e5dc73cc4e7737e861ad7602d20acd4ac3aa20a8bf77d85321e66e3a82fd436bfe1ac0

Download Submit
C:\Windows\System\KocBseE.exe

Filesize
3.8MB

MD5
68dc6f3b1c91684e8778a7a88cbef4c5

SHA1
6343859c5512e188fa9e8ffdfe9917376a49e7a5

SHA256
d0150685ad76a2fc93590e2b68b0f66f609cadd77f0aeb9f8de9ad7c82e562d1

SHA512
601ff88d08664275ac5cc9ac6c4d7559bfa620199d941a7487fc9f64b4a6c3c5f77af8f6bba1e6ddd61506d6a70464471b052ff48f0c9b8a67a74cca705ec8ba

Download Submit
C:\Windows\System\LQxFAPX.exe

Filesize
3.8MB

MD5
dd61d62dd2e3006f8915a7f7e91e80ea

SHA1
566c24e6eeab54ee866ec77e5cccfd3059136896

SHA256
d48c6a4c0e40676ec5f8a3da010f65689bd6facd8be93e1608c5d54550015b14

SHA512
d5f774e2e585a557b966ba43b44fee53a7793e596d935cda19c12e27a490c1d7977c5423d253386882403d57c2f695ec0dbebb28d63f6e540d64a4e02cc38393

Download Submit
C:\Windows\System\NqQYbVJ.exe

Filesize
3.8MB

MD5
359e35a0f1dbaa905a783b19400e392b

SHA1
de0f8d15724e5a32f563c5d2a176d9cc41727272

SHA256
6e798cdd71824ecc28755799035017a0ed4eeb9fdc55660c13067e56686da3d6

SHA512
ce7006b6fec47ebe52f36155ead32bb759f1910f0029d8dfe6fe05feb71884f8e8d3bc9fa0c2a6af22fb3bf0cd5529e821f60270407e94ddd7c1b3125aa0ec08

Download Submit
C:\Windows\System\OhMWkhU.exe

Filesize
3.8MB

MD5
8621c05424cba6605ba5d25a15c9004a

SHA1
50cad55d87dd515be4ef1cd31c1e26f5a758aec9

SHA256
1e21a27e3f85a2fdc52f3d23ce4e2a5ae479de8be7cdb051419cac4ff43af388

SHA512
5725f27146dd3a92b3dbbff6bfa39c223ddfb33e9afaf790ec69a2d477ab0c2249be5db7fc95b68e45b2ddbdc0b91d84dcb1d14df56d8103a86f67e3c170f7a0

Download Submit
C:\Windows\System\OifgqjZ.exe

Filesize
3.8MB

MD5
81ce180a43621c18246dfaf4f698bbdb

SHA1
1cf185f212f0a1942a4ff5e11d7ced62640eab00

SHA256
e85f914878fccddef4c1dfd182a1c141d679cd2d24e40e963385df56d7357ebb

SHA512
f671ac75358636b52b69e19222f65f40f59e61455ffdb503e12e94e4ffb42c03a26023f534b43e11367e9dec4c6e9110a1110f5572eee942d5c5f322de4dc129

Download Submit
C:\Windows\System\PQkiucT.exe

Filesize
3.8MB

MD5
e1f1bde7f37e5439c025fc0f3c9e82c8

SHA1
5b0de2158f167a6ac90a92c2f9813ab7e2fe240f

SHA256
51267c72f3dfd27a44e22fce154e2425211e63333e68bac2b5f98befae2d7cf2

SHA512
b62efbf1e43a16dc27d4639f46f8036911b6beb3f0fc6ebc4de558e2826761ce36220004f66faf8ff9688c9cc9449d0650b96b048a88e1b5f0f1f168d1ac272c

Download Submit
C:\Windows\System\QYCQLMG.exe

Filesize
3.8MB

MD5
209621aa6ea7be4e7c99bf67e0272da9

SHA1
d15e7c1e96e95ae517e5e0295f74c75d89c7aaf6

SHA256
41f36c6e9efa23bcfecd86879efedb4172a737c8a3d4f74ea50d3489eb5e7541

SHA512
19c494dfe86e3e474ce9eade25f2dd72ec10aa244edfb5c25ecb3ac663246e6545454608e9d215613aec8abde8a19400867b7e9a0b64146d163c8f715dbd1b4f

Download Submit
C:\Windows\System\SezHdEt.exe

Filesize
3.8MB

MD5
001b2ab72b3501afcc0d9cf1111fc17b

SHA1
3d51a4c89c520a3305093c129c2918c908568e42

SHA256
966aaa22ba0b46726b287315051a209e8d8c49413ba4f1c5b5725d6687690acd

SHA512
289f8283bd418505c8cd3a05562865c7f5cecd934aca53dac9622eaf20b6443861dc9725f8e2175b0dd77227432a9945dc988e2e8c5056bb420d693630021848

Download Submit
C:\Windows\System\TRDBOIp.exe

Filesize
3.8MB

MD5
78c90d7a6699ddbfeb538f5c29a43cfe

SHA1
f9d0c6c413f227a8eeda92bf6e65bf43bc36d9c1

SHA256
4e2e44e62b8cf752df4e3b139b171954984c1535a52af59911d8f990cb11ddbc

SHA512
17dd1850275657527f61d5c8ed8ea0e33516a086728eb7a283ae54eab60557db455ed48a2753d826c446629a16db82c48ec7a86d8b8cec2fc22d9ba633ad268b

Download Submit
C:\Windows\System\UJPekio.exe

Filesize
3.8MB

MD5
30eafd5360b7c6639f94a92505b33cdf

SHA1
b18345bd10876ba78be420b9da8ba63b821d6f87

SHA256
e1c11a56fa3caea19232f93ae12d9c3bdc80af93e9f4d2e8a59556d975397fdc

SHA512
2c608f2b960f7ac65be7a56ec513a2cbef6a9e8d58099b048a918a0857ed76f9191dc7b244f5a7b60c8ee72896d9e3bb34e9a95f0182f410476c3230b81aec08

Download Submit
C:\Windows\System\UzoPgFn.exe

Filesize
3.8MB

MD5
336757a37a51cf9eec2172d983beed5b

SHA1
f6be10a1dc81a1b4b2f686d3e6c2211b4129ab21

SHA256
e901ff6c7749bca24168671334a44b8fc8798b8d5f75892adf55303672cf0a60

SHA512
bd56c9e06cdc24a36a7cf19c244164d2db30e85fafd8c8782d5e70767aa09c09c8b9fb779248b1dd7005111b3ea56fceab7fc5f00d746a078b03386e6d8dfa4a

Download Submit
C:\Windows\System\WBveAzB.exe

Filesize
3.8MB

MD5
15106a8ed03743602ce54fa8c25c63ed

SHA1
7e847543558e74e585f3043e554aac2e471da70f

SHA256
b91f50336f2de1fe0ebaa90788dc90998f69315515554e35f1a824aa09649201

SHA512
9c481be11429e82f9236b8b0cb42513d2daaa297fb918da072005f2708edc10cf93274137646022c295d49b6c2d0ce2a229e30be274035cb478619d859ea567a

Download Submit
C:\Windows\System\WMHZueI.exe

Filesize
3.8MB

MD5
923a88974fbfa9a5410a78aaf2bb658f

SHA1
8d86068c34dfd8c7efcf368da3ced875a4574b60

SHA256
42cd486fb8f6bbc849f1541da1e28521b354b2955dee73f14f7d24a1b6c24bb3

SHA512
7193aec2ab7e97a30bafdfe36367394340b053606a38b9bf62071ce1ad71c2e306c0ad0a05cf01cb9d7c78d4384d38f9c2c33fd0032430057736fa9f1555f7b1

Download Submit
C:\Windows\System\WNBczcD.exe

Filesize
3.8MB

MD5
3a60977befd737b0e5a72e4efc9e4481

SHA1
372e14040dd5c0726d1acbca493fbf221bf418c0

SHA256
394187c6f5b4eefdda5d1ffaf12372fbdbbfde135607f546b801fbda30202fcd

SHA512
4a97d8625e7e079f216076f0c0c2396a4c83bfe9565acaa89fdacad470939bc57717b185f1934e808b842097308348a46c7440fb2ad9c8875290a8e89af197fe

Download Submit
C:\Windows\System\WreIcSa.exe

Filesize
3.8MB

MD5
4162b4ea064edf58c886f81fd4a16695

SHA1
9026b820d244be22039efcd7bca9a546647ad849

SHA256
c73cf9f3b748ce2bee6f937b6d2af123a5044a42e62fdaea7f683af4eba311b8

SHA512
520c5b2c5fcc6dc7c2282ce6c8a122b7fd1b4fe990f9dffd1b7ef44b10378da14df4288b2cdf15c5f431ba3c312ea2eaf34cef86a236db76644092e01a242aec

Download Submit
C:\Windows\System\ZnfuKim.exe

Filesize
3.8MB

MD5
b3d674d81e075c07f62bedb1bb9bc7fb

SHA1
08cee929dc54a4ff768a1d33dd9808b33d990ce1

SHA256
9576238cf25a4741bf2aaad2a4b452cefcc352e6c7ef49c95f400aa40fac4128

SHA512
b7ee4bcff4f939f7ade3653216f578dce2c5bb97270f7d777b1e23d9dbf59150482df505a507e2bc8a8316326a5081e1ec5ec572a4980a6c5be49bffa0ee73c6

Download Submit
C:\Windows\System\cIVexjw.exe

Filesize
3.8MB

MD5
0c0011ade7126857ae15333581cc7a91

SHA1
cd5cc28cbb70dccb30fe19e3e93a1395e35c7774

SHA256
a5909c08e0795fbcbace9670b8ab7d9f97a7b3119b9bf06acc9bbd7551d3ba51

SHA512
0aebbcf87471dbfa1f7b2af6c0cdf6ee0c78acc710624b74448f96c11972ecdad0f22431172fa5b9f49d82a370538c7af9382a2f08d7c1b72585df4b9c4773fb

Download Submit
C:\Windows\System\fPPxsKq.exe

Filesize
3.8MB

MD5
261a79ce8961f986044793f3c1b18525

SHA1
e586126bc74a67ba67a952ce720bd997f634cbd6

SHA256
ecba6b85146858c607661381dba2c72146b4c89eda35dde6ee01305b743aee8c

SHA512
a5d6220cd9c86a04fbfe7540fb5d217822d463b3ab98dec6a3bb3c16b181ec26791b4497ccc8ab0177846a54784f48b88797a42333146a740b98896802cff12c

Download Submit
C:\Windows\System\juTtANe.exe

Filesize
3.8MB

MD5
c3090ad74c86d10a0b46183958c0c062

SHA1
6a3c2daf11430b2490c7a143f8fa1672c0c65df1

SHA256
21829266dfc856a01c2f392164aa7468d123ac0910c710b60315c6e4393af036

SHA512
a682991f1dae4779f3f8d4ab4b175bfb67fe0dab5b3794f3d031bc9778fbf8a617c694b61c411d3c988ef3aa1cac4d476fc9b2d1a151d0c010a843a4e29cccdb

Download Submit
C:\Windows\System\lpGFDSP.exe

Filesize
3.8MB

MD5
b4aefe07679c48336b9c49bd4fde9495

SHA1
0a4962d7186dce8f645f4df9386735e613098ffa

SHA256
69f6dff929dd2119436f92e2661baccc2c18fc3f3ec8484bd85055d009dc9126

SHA512
b661d97a0922b128a5540ad15059f944b87795496e3dcd63e99d076b05e67802830d46052a879e8fcaa002ec4ba9b81c1c25d8d4204d6091ad14989dc3f9c4cb

Download Submit
C:\Windows\System\nhlxVNI.exe

Filesize
3.8MB

MD5
0b1e6222d56ca91422a72630ccc2d2c5

SHA1
ea4675a8779062058ab95155ede91aebea35594e

SHA256
706555ac2b08cec56ce0eee6bb578c035ccc352ddfa20c24b5993c113118994c

SHA512
a89f0bccb3b0c5eea30bac3eee23a9a0c583938b8da25ea7a85d825e352a3602e9b4958726e3fb0fba5e26bddcd64b8cceb9b5a01342ddf858b78838b593f8c4

Download Submit
C:\Windows\System\pEkaXUu.exe

Filesize
3.8MB

MD5
7256e8a5c4015e84e86ec883550b55a1

SHA1
93a539608d40072f1f6453514f1952384dbe8ec0

SHA256
6af471b0fb189149f89c74c8e43c929a3f089a90d5faf2ff24501ace2cfa4a9c

SHA512
bdf23c903ee188b2110339573aaf6bf39e1d02dfdd528d69df8706be2c3844e96c9f7d0d671bdb800a7e10092102092cd87a8612c82a7753c8295b0686abd866

Download Submit
C:\Windows\System\pPxnjav.exe

Filesize
3.8MB

MD5
e98c6d3ad71224ff1be13a673411c942

SHA1
7836397657c958888c233fe0cc65fa78668225fd

SHA256
185599e6b5c91c8db3e2d08ac78503fed6852f0b9261c1c2f2be5c3122cf7425

SHA512
d6698933a1729a259a7acc1c09720888c946fd8c37488fc90f5333a58e5ac4a67b7b18acc2555596f9e6d677f61369a8372ad9c5f30a2f9fc5ce51b65b2e2a97

Download Submit
C:\Windows\System\puvNndG.exe

Filesize
3.8MB

MD5
9923fa2d99c57f760fc7e422c5031089

SHA1
66eeef5aff4990372cf4cf25546dcfec863589c8

SHA256
d11e0cac4ab0fd483bdfe17be0ea64285c6e8ecb4b9f9def2c257eb90f0b1f31

SHA512
86087d549c9699f5501f7df2b02de6876ba6ad345bb6ee0844fef00ae0369a1ada02c4bf43703bed9865d35057350bdd64717b17786d9578fb9310241cb097db

Download Submit
C:\Windows\System\rALdwvb.exe

Filesize
3.8MB

MD5
2a78569487f166f57223f74c02ff836f

SHA1
e8d8d53c93a8de018bfe140edf44f82c30715e7c

SHA256
2556416972a7e8bb05194d4210340f322480182610f9d067fb4e88e4b401c345

SHA512
5acdfba2d7c30fce111a2896126d24b8be2dde7cc984a5cbe0e99f39c679d2ba2406a56745b983c19eaecb769f183dc5dec2697232993255edbe7b367de01ef9

Download Submit
C:\Windows\System\rdQKJpL.exe

Filesize
3.8MB

MD5
f9bdcbb76ec033d33b02d1277325139d

SHA1
e8bd2ab903632cf572393f3ec8d52f9d14bc63a1

SHA256
79318ef220e6a5c873247f5b3c0d573459919970c7d29bff6c69c60e711bc933

SHA512
776b96d62a22d2731303f511a2de27a4382cc8c49eb32a40f878c99dc89a2d7781a7cf674abe7495c31e587ee2ae322a95057548b3d2fe9c3c70f10070297c4a

Download Submit
C:\Windows\System\uFfqXzW.exe

Filesize
3.8MB

MD5
56e7cee2db58f018ddca9b71fb22368c

SHA1
12ac890f8221d3ec05ea889294eab952a41b169f

SHA256
c9b77d6355bf8e85f812c0f6dac4bc596120118763b193f2358df249bc651e6b

SHA512
19bbc40fb16e545cbb2b987c3e3febb09ccf5679b165cab53ef3ae97be4f2ea324723f06f222887accbc441b509eb3c74d2d523037b4aefa653c9b5f983d154f

Download Submit
C:\Windows\System\wKYbwNv.exe

Filesize
3.8MB

MD5
acbd4181e2b55e2da0f74baf04577060

SHA1
3a3afda2e1e665fc2b37f4542d839371e2d9c246

SHA256
06e5fb470ec78819eac5c3f10407448f773b302b641015a66c33e0728f8bdfc4

SHA512
01ace6a751850ebf6454f9eb290bd342d4204532c05ea1513f98797bfbb8b89754077c67cec02d9d5798ceb218dfad8f158aa2b3ef0a0e9b4c2f5ac14b4e1949

Download Submit
memory/400-2213-0x00007FF753FB0000-0x00007FF7543A6000-memory.dmp

Filesize
4.0MB

Download
memory/400-2191-0x00007FF753FB0000-0x00007FF7543A6000-memory.dmp

Filesize
4.0MB

Download
memory/400-134-0x00007FF753FB0000-0x00007FF7543A6000-memory.dmp

Filesize
4.0MB

Download
memory/736-2204-0x00007FF7F54A0000-0x00007FF7F5896000-memory.dmp

Filesize
4.0MB

Download
memory/736-105-0x00007FF7F54A0000-0x00007FF7F5896000-memory.dmp

Filesize
4.0MB

Download
memory/1272-2076-0x00007FFCC73B3000-0x00007FFCC73B5000-memory.dmp

Filesize
8KB

Download
memory/1272-42-0x00007FFCC73B0000-0x00007FFCC7E71000-memory.dmp

Filesize
10.8MB

Download
memory/1272-27-0x00007FFCC73B0000-0x00007FFCC7E71000-memory.dmp

Filesize
10.8MB

Download
memory/1272-1823-0x00007FFCC73B0000-0x00007FFCC7E71000-memory.dmp

Filesize
10.8MB

Download
memory/1272-151-0x0000024368BE0000-0x0000024369386000-memory.dmp

Filesize
7.6MB

Download
memory/1272-5-0x00007FFCC73B3000-0x00007FFCC73B5000-memory.dmp

Filesize
8KB

Download
memory/1272-58-0x0000024368080000-0x00000243680A2000-memory.dmp

Filesize
136KB

Download
memory/1472-2194-0x00007FF781E40000-0x00007FF782236000-memory.dmp

Filesize
4.0MB

Download
memory/1472-61-0x00007FF781E40000-0x00007FF782236000-memory.dmp

Filesize
4.0MB

Download
memory/1816-88-0x00007FF63C770000-0x00007FF63CB66000-memory.dmp

Filesize
4.0MB

Download
memory/1816-2196-0x00007FF63C770000-0x00007FF63CB66000-memory.dmp

Filesize
4.0MB

Download
memory/2152-328-0x00007FF6D4210000-0x00007FF6D4606000-memory.dmp

Filesize
4.0MB

Download
memory/2152-2210-0x00007FF6D4210000-0x00007FF6D4606000-memory.dmp

Filesize
4.0MB

Download
memory/2168-337-0x00007FF7C6D50000-0x00007FF7C7146000-memory.dmp

Filesize
4.0MB

Download
memory/2168-2216-0x00007FF7C6D50000-0x00007FF7C7146000-memory.dmp

Filesize
4.0MB

Download
memory/2192-109-0x00007FF70F4B0000-0x00007FF70F8A6000-memory.dmp

Filesize
4.0MB

Download
memory/2192-2205-0x00007FF70F4B0000-0x00007FF70F8A6000-memory.dmp

Filesize
4.0MB

Download
memory/2216-106-0x00007FF6CAF00000-0x00007FF6CB2F6000-memory.dmp

Filesize
4.0MB

Download
memory/2216-2207-0x00007FF6CAF00000-0x00007FF6CB2F6000-memory.dmp

Filesize
4.0MB

Download
memory/2284-2201-0x00007FF6CF840000-0x00007FF6CFC36000-memory.dmp

Filesize
4.0MB

Download
memory/2284-95-0x00007FF6CF840000-0x00007FF6CFC36000-memory.dmp

Filesize
4.0MB

Download
memory/2652-2198-0x00007FF7C3350000-0x00007FF7C3746000-memory.dmp

Filesize
4.0MB

Download
memory/2652-82-0x00007FF7C3350000-0x00007FF7C3746000-memory.dmp

Filesize
4.0MB

Download
memory/2700-108-0x00007FF6E8620000-0x00007FF6E8A16000-memory.dmp

Filesize
4.0MB

Download
memory/2700-2200-0x00007FF6E8620000-0x00007FF6E8A16000-memory.dmp

Filesize
4.0MB

Download
memory/3076-2211-0x00007FF6824F0000-0x00007FF6828E6000-memory.dmp

Filesize
4.0MB

Download
memory/3076-325-0x00007FF6824F0000-0x00007FF6828E6000-memory.dmp

Filesize
4.0MB

Download
memory/3092-1815-0x00007FF6733A0000-0x00007FF673796000-memory.dmp

Filesize
4.0MB

Download
memory/3092-1-0x000001EAB3C80000-0x000001EAB3C90000-memory.dmp

Filesize
64KB

Download
memory/3092-0-0x00007FF6733A0000-0x00007FF673796000-memory.dmp

Filesize
4.0MB

Download
memory/3304-104-0x00007FF61ED70000-0x00007FF61F166000-memory.dmp

Filesize
4.0MB

Download
memory/3304-2202-0x00007FF61ED70000-0x00007FF61F166000-memory.dmp

Filesize
4.0MB

Download
memory/3504-2208-0x00007FF684D00000-0x00007FF6850F6000-memory.dmp

Filesize
4.0MB

Download
memory/3504-110-0x00007FF684D00000-0x00007FF6850F6000-memory.dmp

Filesize
4.0MB

Download
memory/3516-69-0x00007FF652F80000-0x00007FF653376000-memory.dmp

Filesize
4.0MB

Download
memory/3516-2195-0x00007FF652F80000-0x00007FF653376000-memory.dmp

Filesize
4.0MB

Download
memory/3552-336-0x00007FF647CE0000-0x00007FF6480D6000-memory.dmp

Filesize
4.0MB

Download
memory/3552-2209-0x00007FF647CE0000-0x00007FF6480D6000-memory.dmp

Filesize
4.0MB

Download
memory/3696-107-0x00007FF792490000-0x00007FF792886000-memory.dmp

Filesize
4.0MB

Download
memory/3696-2193-0x00007FF792490000-0x00007FF792886000-memory.dmp

Filesize
4.0MB

Download
memory/3904-2212-0x00007FF62C110000-0x00007FF62C506000-memory.dmp

Filesize
4.0MB

Download
memory/3904-135-0x00007FF62C110000-0x00007FF62C506000-memory.dmp

Filesize
4.0MB

Download
memory/3904-2192-0x00007FF62C110000-0x00007FF62C506000-memory.dmp

Filesize
4.0MB

Download
memory/3928-2214-0x00007FF729B80000-0x00007FF729F76000-memory.dmp

Filesize
4.0MB

Download
memory/3928-2190-0x00007FF729B80000-0x00007FF729F76000-memory.dmp

Filesize
4.0MB

Download
memory/3928-133-0x00007FF729B80000-0x00007FF729F76000-memory.dmp

Filesize
4.0MB

Download
memory/4508-2199-0x00007FF65CCB0000-0x00007FF65D0A6000-memory.dmp

Filesize
4.0MB

Download
memory/4508-101-0x00007FF65CCB0000-0x00007FF65D0A6000-memory.dmp

Filesize
4.0MB

Download
memory/4608-89-0x00007FF609E60000-0x00007FF60A256000-memory.dmp

Filesize
4.0MB

Download
memory/4608-2203-0x00007FF609E60000-0x00007FF60A256000-memory.dmp

Filesize
4.0MB

Download
memory/4684-132-0x00007FF6DD840000-0x00007FF6DDC36000-memory.dmp

Filesize
4.0MB

Download
memory/4684-2215-0x00007FF6DD840000-0x00007FF6DDC36000-memory.dmp

Filesize
4.0MB

Download
memory/4760-111-0x00007FF6DAA60000-0x00007FF6DAE56000-memory.dmp

Filesize
4.0MB

Download
memory/4760-2206-0x00007FF6DAA60000-0x00007FF6DAE56000-memory.dmp

Filesize
4.0MB

Download
memory/4952-2197-0x00007FF7D9BA0000-0x00007FF7D9F96000-memory.dmp

Filesize
4.0MB

Download
memory/4952-100-0x00007FF7D9BA0000-0x00007FF7D9F96000-memory.dmp

Filesize
4.0MB

Download