xmrig | f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754

Analysis

max time kernel
93s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
Size

2.3MB
MD5

c9a6716cfcba5aefcaa5620ab3b600a0
SHA1

f3b54d3a322011ddf25ac954a964bb52482d53d4
SHA256

f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754
SHA512

9d1304cd0c2c37be218cf2cdce9984337bb6974dd76e55d47336affa7de357c43ea057ec2cfdb0de692aa9ce1f5ac2862cc4eb3cff3c39538985b142fa8b15be
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleh:NABg

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 51 IoCs

miner

resource	yara_rule
behavioral2/memory/4340-72-0x00007FF6D2EA0000-0x00007FF6D3292000-memory.dmp	xmrig
behavioral2/memory/4828-78-0x00007FF7E8330000-0x00007FF7E8722000-memory.dmp	xmrig
behavioral2/memory/3284-71-0x00007FF7EFBD0000-0x00007FF7EFFC2000-memory.dmp	xmrig
behavioral2/memory/4536-67-0x00007FF681F10000-0x00007FF682302000-memory.dmp	xmrig
behavioral2/memory/3304-59-0x00007FF769D00000-0x00007FF76A0F2000-memory.dmp	xmrig
behavioral2/memory/2344-13-0x00007FF7E8970000-0x00007FF7E8D62000-memory.dmp	xmrig
behavioral2/memory/224-132-0x00007FF674000000-0x00007FF6743F2000-memory.dmp	xmrig
behavioral2/memory/2344-142-0x00007FF7E8970000-0x00007FF7E8D62000-memory.dmp	xmrig
behavioral2/memory/2600-149-0x00007FF666D30000-0x00007FF667122000-memory.dmp	xmrig
behavioral2/memory/3004-245-0x00007FF75E280000-0x00007FF75E672000-memory.dmp	xmrig
behavioral2/memory/3540-244-0x00007FF70DE00000-0x00007FF70E1F2000-memory.dmp	xmrig
behavioral2/memory/2260-189-0x00007FF7F9A40000-0x00007FF7F9E32000-memory.dmp	xmrig
behavioral2/memory/4132-166-0x00007FF6BC150000-0x00007FF6BC542000-memory.dmp	xmrig
behavioral2/memory/2360-154-0x00007FF76F900000-0x00007FF76FCF2000-memory.dmp	xmrig
behavioral2/memory/3116-143-0x00007FF78D230000-0x00007FF78D622000-memory.dmp	xmrig
behavioral2/memory/224-391-0x00007FF674000000-0x00007FF6743F2000-memory.dmp	xmrig
behavioral2/memory/2232-393-0x00007FF733D20000-0x00007FF734112000-memory.dmp	xmrig
behavioral2/memory/3276-569-0x00007FF705860000-0x00007FF705C52000-memory.dmp	xmrig
behavioral2/memory/3468-703-0x00007FF7812C0000-0x00007FF7816B2000-memory.dmp	xmrig
behavioral2/memory/1056-822-0x00007FF7BD6F0000-0x00007FF7BDAE2000-memory.dmp	xmrig
behavioral2/memory/4624-1086-0x00007FF615D80000-0x00007FF616172000-memory.dmp	xmrig
behavioral2/memory/3592-1078-0x00007FF649CE0000-0x00007FF64A0D2000-memory.dmp	xmrig
behavioral2/memory/1500-1218-0x00007FF66DD90000-0x00007FF66E182000-memory.dmp	xmrig
behavioral2/memory/2948-1219-0x00007FF60D170000-0x00007FF60D562000-memory.dmp	xmrig
behavioral2/memory/752-1228-0x00007FF74F630000-0x00007FF74FA22000-memory.dmp	xmrig
behavioral2/memory/1552-1461-0x00007FF66AB00000-0x00007FF66AEF2000-memory.dmp	xmrig
behavioral2/memory/5040-1462-0x00007FF760630000-0x00007FF760A22000-memory.dmp	xmrig
behavioral2/memory/2344-2430-0x00007FF7E8970000-0x00007FF7E8D62000-memory.dmp	xmrig
behavioral2/memory/4132-2432-0x00007FF6BC150000-0x00007FF6BC542000-memory.dmp	xmrig
behavioral2/memory/3116-2434-0x00007FF78D230000-0x00007FF78D622000-memory.dmp	xmrig
behavioral2/memory/3004-2436-0x00007FF75E280000-0x00007FF75E672000-memory.dmp	xmrig
behavioral2/memory/4536-2438-0x00007FF681F10000-0x00007FF682302000-memory.dmp	xmrig
behavioral2/memory/3540-2452-0x00007FF70DE00000-0x00007FF70E1F2000-memory.dmp	xmrig
behavioral2/memory/3304-2453-0x00007FF769D00000-0x00007FF76A0F2000-memory.dmp	xmrig
behavioral2/memory/3284-2457-0x00007FF7EFBD0000-0x00007FF7EFFC2000-memory.dmp	xmrig
behavioral2/memory/4828-2456-0x00007FF7E8330000-0x00007FF7E8722000-memory.dmp	xmrig
behavioral2/memory/2232-2462-0x00007FF733D20000-0x00007FF734112000-memory.dmp	xmrig
behavioral2/memory/3276-2460-0x00007FF705860000-0x00007FF705C52000-memory.dmp	xmrig
behavioral2/memory/4340-2463-0x00007FF6D2EA0000-0x00007FF6D3292000-memory.dmp	xmrig
behavioral2/memory/3468-2470-0x00007FF7812C0000-0x00007FF7816B2000-memory.dmp	xmrig
behavioral2/memory/1056-2466-0x00007FF7BD6F0000-0x00007FF7BDAE2000-memory.dmp	xmrig
behavioral2/memory/3592-2518-0x00007FF649CE0000-0x00007FF64A0D2000-memory.dmp	xmrig
behavioral2/memory/4624-2520-0x00007FF615D80000-0x00007FF616172000-memory.dmp	xmrig
behavioral2/memory/1500-2524-0x00007FF66DD90000-0x00007FF66E182000-memory.dmp	xmrig
behavioral2/memory/2600-2526-0x00007FF666D30000-0x00007FF667122000-memory.dmp	xmrig
behavioral2/memory/2948-2523-0x00007FF60D170000-0x00007FF60D562000-memory.dmp	xmrig
behavioral2/memory/5040-2555-0x00007FF760630000-0x00007FF760A22000-memory.dmp	xmrig
behavioral2/memory/752-2559-0x00007FF74F630000-0x00007FF74FA22000-memory.dmp	xmrig
behavioral2/memory/2360-2551-0x00007FF76F900000-0x00007FF76FCF2000-memory.dmp	xmrig
behavioral2/memory/1552-2557-0x00007FF66AB00000-0x00007FF66AEF2000-memory.dmp	xmrig
behavioral2/memory/2260-2545-0x00007FF7F9A40000-0x00007FF7F9E32000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	3608	powershell.exe
10	3608	powershell.exe
15	3608	powershell.exe
16	3608	powershell.exe
18	3608	powershell.exe
27	3608	powershell.exe
28	3608	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3608	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2344	plkjbJg.exe
4132	vaNWArW.exe
3116	lvkDNEx.exe
3004	zSHSrna.exe
3540	ieNszhk.exe
4536	TMtcUsN.exe
3304	ISjYBlJ.exe
3284	kJvsccw.exe
2232	wHfnRrN.exe
4340	DbdBNeS.exe
4828	eapwJQU.exe
3276	XcRFPFc.exe
1056	RoRfWmx.exe
3468	peHeaVo.exe
3592	eUDvvqg.exe
1500	BFSonGv.exe
4624	EUZUgZe.exe
2948	MSeTSue.exe
2600	smrvEaN.exe
2360	iPMuPQU.exe
1552	GoRxLBf.exe
5040	FLRNKTC.exe
752	auchglh.exe
2260	LpBHMDB.exe
4672	qdiKhkU.exe
3912	nouTTGW.exe
1832	LLJqRhg.exe
1744	xENshLm.exe
4220	RJnFNEr.exe
1580	QpWgwrB.exe
4008	TZgAvAW.exe
3904	trUkAxX.exe
1152	qSNzuSn.exe
3712	nTuESZO.exe
4940	hLxSRvv.exe
4864	PMrvwhk.exe
348	RAFkitz.exe
640	FqrLDnt.exe
4412	kejCfqA.exe
864	UOItUiF.exe
4312	PtHqbXN.exe
3324	lymMkSH.exe
4820	FyBSCrK.exe
2124	NkAkFLd.exe
1440	zAtaDNE.exe
4568	gmZgnMg.exe
3528	paoqVkl.exe
3800	njQkaMr.exe
4796	qJaFgYD.exe
1872	uwFeIun.exe
4652	FDYxeKn.exe
4616	yeHOkjW.exe
1612	mhDcAmC.exe
2940	gDGjbAM.exe
2624	zuvRBrq.exe
2200	ocVxgQw.exe
3816	cZgpDmF.exe
3856	iBEkghj.exe
3984	ydpXAyx.exe
4416	HBVzniA.exe
1856	lWHBZFp.exe
4744	xxkNgjK.exe
2676	UxCiIft.exe
2720	Splculq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/224-0-0x00007FF674000000-0x00007FF6743F2000-memory.dmp	upx
behavioral2/files/0x0007000000023412-8.dat	upx
behavioral2/files/0x0007000000023411-15.dat	upx
behavioral2/files/0x0007000000023415-34.dat	upx
behavioral2/files/0x0007000000023416-35.dat	upx
behavioral2/files/0x0007000000023417-50.dat	upx
behavioral2/files/0x0007000000023419-55.dat	upx
behavioral2/files/0x000700000002341b-69.dat	upx
behavioral2/memory/4340-72-0x00007FF6D2EA0000-0x00007FF6D3292000-memory.dmp	upx
behavioral2/files/0x000700000002341c-96.dat	upx
behavioral2/files/0x000700000002341d-98.dat	upx
behavioral2/memory/1056-95-0x00007FF7BD6F0000-0x00007FF7BDAE2000-memory.dmp	upx
behavioral2/memory/3468-94-0x00007FF7812C0000-0x00007FF7816B2000-memory.dmp	upx
behavioral2/memory/3276-79-0x00007FF705860000-0x00007FF705C52000-memory.dmp	upx
behavioral2/memory/4828-78-0x00007FF7E8330000-0x00007FF7E8722000-memory.dmp	upx
behavioral2/memory/3284-71-0x00007FF7EFBD0000-0x00007FF7EFFC2000-memory.dmp	upx
behavioral2/memory/4536-67-0x00007FF681F10000-0x00007FF682302000-memory.dmp	upx
behavioral2/files/0x0007000000023418-65.dat	upx
behavioral2/files/0x000700000002341a-62.dat	upx
behavioral2/memory/2232-60-0x00007FF733D20000-0x00007FF734112000-memory.dmp	upx
behavioral2/memory/3304-59-0x00007FF769D00000-0x00007FF76A0F2000-memory.dmp	upx
behavioral2/memory/3004-39-0x00007FF75E280000-0x00007FF75E672000-memory.dmp	upx
behavioral2/files/0x0007000000023414-38.dat	upx
behavioral2/memory/3540-29-0x00007FF70DE00000-0x00007FF70E1F2000-memory.dmp	upx
behavioral2/files/0x0007000000023413-28.dat	upx
behavioral2/memory/3116-24-0x00007FF78D230000-0x00007FF78D622000-memory.dmp	upx
behavioral2/memory/4132-21-0x00007FF6BC150000-0x00007FF6BC542000-memory.dmp	upx
behavioral2/memory/2344-13-0x00007FF7E8970000-0x00007FF7E8D62000-memory.dmp	upx
behavioral2/files/0x0007000000023410-6.dat	upx
behavioral2/files/0x000700000002341e-104.dat	upx
behavioral2/memory/3592-109-0x00007FF649CE0000-0x00007FF64A0D2000-memory.dmp	upx
behavioral2/files/0x0007000000023422-118.dat	upx
behavioral2/memory/2948-129-0x00007FF60D170000-0x00007FF60D562000-memory.dmp	upx
behavioral2/files/0x0007000000023420-123.dat	upx
behavioral2/memory/1500-120-0x00007FF66DD90000-0x00007FF66E182000-memory.dmp	upx
behavioral2/files/0x0007000000023421-115.dat	upx
behavioral2/files/0x000800000002341f-112.dat	upx
behavioral2/files/0x0007000000023423-127.dat	upx
behavioral2/memory/224-132-0x00007FF674000000-0x00007FF6743F2000-memory.dmp	upx
behavioral2/memory/2344-142-0x00007FF7E8970000-0x00007FF7E8D62000-memory.dmp	upx
behavioral2/memory/2600-149-0x00007FF666D30000-0x00007FF667122000-memory.dmp	upx
behavioral2/memory/752-159-0x00007FF74F630000-0x00007FF74FA22000-memory.dmp	upx
behavioral2/memory/1552-165-0x00007FF66AB00000-0x00007FF66AEF2000-memory.dmp	upx
behavioral2/files/0x000700000002342e-188.dat	upx
behavioral2/files/0x000700000002342d-196.dat	upx
behavioral2/files/0x000700000002342f-202.dat	upx
behavioral2/files/0x000700000002342b-204.dat	upx
behavioral2/files/0x000700000002342a-200.dat	upx
behavioral2/memory/3004-245-0x00007FF75E280000-0x00007FF75E672000-memory.dmp	upx
behavioral2/memory/3540-244-0x00007FF70DE00000-0x00007FF70E1F2000-memory.dmp	upx
behavioral2/files/0x000700000002342c-194.dat	upx
behavioral2/memory/2260-189-0x00007FF7F9A40000-0x00007FF7F9E32000-memory.dmp	upx
behavioral2/files/0x0007000000023429-184.dat	upx
behavioral2/memory/5040-174-0x00007FF760630000-0x00007FF760A22000-memory.dmp	upx
behavioral2/files/0x0007000000023428-170.dat	upx
behavioral2/files/0x0007000000023425-167.dat	upx
behavioral2/memory/4132-166-0x00007FF6BC150000-0x00007FF6BC542000-memory.dmp	upx
behavioral2/files/0x0007000000023427-169.dat	upx
behavioral2/files/0x0007000000023426-161.dat	upx
behavioral2/files/0x0007000000023424-160.dat	upx
behavioral2/memory/2360-154-0x00007FF76F900000-0x00007FF76FCF2000-memory.dmp	upx
behavioral2/memory/3116-143-0x00007FF78D230000-0x00007FF78D622000-memory.dmp	upx
behavioral2/memory/4624-128-0x00007FF615D80000-0x00007FF616172000-memory.dmp	upx
behavioral2/memory/224-391-0x00007FF674000000-0x00007FF6743F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HBVzniA.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\ZegATKm.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\lAdulOU.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\xtKdCUB.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\nrwVAhR.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\bSopHGU.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\IpeQkxN.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\TZgAvAW.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\SSuwSaT.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\nZpCXvY.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\xzOMAtW.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\USIVLwx.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\aPsCrie.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\SrEwrvI.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\cgaUJyW.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\WJoKWDN.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\iocWBhc.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\QcgrBUj.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\yNPaoku.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\UATbHQe.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\YOhzLoB.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\GtwCiMb.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\qDtqKoN.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\auchglh.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\kShAYFq.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\zyWVdkP.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\ZBadlzB.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\SpGunnB.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\QbganRZ.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\cQoxWHA.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\zuvRBrq.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\lWHBZFp.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\qGehSzM.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\QCZffno.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\jdffeal.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\FeRePKH.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\xENshLm.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\gDGjbAM.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\yZJlaSz.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\dNDrhGR.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\cBmVstJ.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\opjOgMj.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\FRNKaoE.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\qvYZsIK.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\IlqQCpN.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\MXHUufz.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\sfIZgZy.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\oLBwGON.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\OLWCTlr.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\NcNWhNc.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\QusVjkx.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\hhYifXw.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\tuzYqBh.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\ZIxhdwq.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\GLBziGY.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\fCunKyR.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\IFwdYHI.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\MSeTSue.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\JkOBEpd.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\cehhOYq.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\Nukhkrh.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\keZqxtW.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\wPoYzmq.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
File created	C:\Windows\System\EUDyBHQ.exe	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3608	powershell.exe
3608	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
Token: SeLockMemoryPrivilege	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
Token: SeDebugPrivilege	3608	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 3608	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	83
PID 224 wrote to memory of 3608	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	83
PID 224 wrote to memory of 2344	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	84
PID 224 wrote to memory of 2344	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	84
PID 224 wrote to memory of 4132	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	85
PID 224 wrote to memory of 4132	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	85
PID 224 wrote to memory of 3004	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	86
PID 224 wrote to memory of 3004	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	86
PID 224 wrote to memory of 3116	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	87
PID 224 wrote to memory of 3116	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	87
PID 224 wrote to memory of 3540	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	88
PID 224 wrote to memory of 3540	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	88
PID 224 wrote to memory of 4536	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	89
PID 224 wrote to memory of 4536	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	89
PID 224 wrote to memory of 3304	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	90
PID 224 wrote to memory of 3304	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	90
PID 224 wrote to memory of 3284	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	91
PID 224 wrote to memory of 3284	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	91
PID 224 wrote to memory of 2232	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	92
PID 224 wrote to memory of 2232	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	92
PID 224 wrote to memory of 4340	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	93
PID 224 wrote to memory of 4340	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	93
PID 224 wrote to memory of 4828	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	94
PID 224 wrote to memory of 4828	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	94
PID 224 wrote to memory of 3276	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	95
PID 224 wrote to memory of 3276	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	95
PID 224 wrote to memory of 1056	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	96
PID 224 wrote to memory of 1056	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	96
PID 224 wrote to memory of 3468	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	97
PID 224 wrote to memory of 3468	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	97
PID 224 wrote to memory of 3592	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	98
PID 224 wrote to memory of 3592	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	98
PID 224 wrote to memory of 1500	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	99
PID 224 wrote to memory of 1500	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	99
PID 224 wrote to memory of 4624	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	100
PID 224 wrote to memory of 4624	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	100
PID 224 wrote to memory of 2948	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	101
PID 224 wrote to memory of 2948	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	101
PID 224 wrote to memory of 2600	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	102
PID 224 wrote to memory of 2600	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	102
PID 224 wrote to memory of 2360	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	103
PID 224 wrote to memory of 2360	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	103
PID 224 wrote to memory of 1552	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	104
PID 224 wrote to memory of 1552	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	104
PID 224 wrote to memory of 5040	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	105
PID 224 wrote to memory of 5040	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	105
PID 224 wrote to memory of 752	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	106
PID 224 wrote to memory of 752	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	106
PID 224 wrote to memory of 2260	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	107
PID 224 wrote to memory of 2260	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	107
PID 224 wrote to memory of 4672	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	108
PID 224 wrote to memory of 4672	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	108
PID 224 wrote to memory of 3912	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	109
PID 224 wrote to memory of 3912	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	109
PID 224 wrote to memory of 1832	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	110
PID 224 wrote to memory of 1832	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	110
PID 224 wrote to memory of 3904	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	111
PID 224 wrote to memory of 3904	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	111
PID 224 wrote to memory of 1744	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	112
PID 224 wrote to memory of 1744	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	112
PID 224 wrote to memory of 4220	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	113
PID 224 wrote to memory of 4220	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	113
PID 224 wrote to memory of 1580	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	114
PID 224 wrote to memory of 1580	224	f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe	114

C:\Users\Admin\AppData\Local\Temp\f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe
"C:\Users\Admin\AppData\Local\Temp\f0b2def7abd4ef68672b1f178780b72777a62e61ec8570f4157ea8174126c754N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\System\plkjbJg.exe
  C:\Windows\System\plkjbJg.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\vaNWArW.exe
  C:\Windows\System\vaNWArW.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\zSHSrna.exe
  C:\Windows\System\zSHSrna.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\lvkDNEx.exe
  C:\Windows\System\lvkDNEx.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\ieNszhk.exe
  C:\Windows\System\ieNszhk.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\TMtcUsN.exe
  C:\Windows\System\TMtcUsN.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\ISjYBlJ.exe
  C:\Windows\System\ISjYBlJ.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\kJvsccw.exe
  C:\Windows\System\kJvsccw.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\wHfnRrN.exe
  C:\Windows\System\wHfnRrN.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\DbdBNeS.exe
  C:\Windows\System\DbdBNeS.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\eapwJQU.exe
  C:\Windows\System\eapwJQU.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\XcRFPFc.exe
  C:\Windows\System\XcRFPFc.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\RoRfWmx.exe
  C:\Windows\System\RoRfWmx.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\peHeaVo.exe
  C:\Windows\System\peHeaVo.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\eUDvvqg.exe
  C:\Windows\System\eUDvvqg.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\BFSonGv.exe
  C:\Windows\System\BFSonGv.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\EUZUgZe.exe
  C:\Windows\System\EUZUgZe.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\MSeTSue.exe
  C:\Windows\System\MSeTSue.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\smrvEaN.exe
  C:\Windows\System\smrvEaN.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\iPMuPQU.exe
  C:\Windows\System\iPMuPQU.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\GoRxLBf.exe
  C:\Windows\System\GoRxLBf.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\FLRNKTC.exe
  C:\Windows\System\FLRNKTC.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\auchglh.exe
  C:\Windows\System\auchglh.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\LpBHMDB.exe
  C:\Windows\System\LpBHMDB.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\qdiKhkU.exe
  C:\Windows\System\qdiKhkU.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\nouTTGW.exe
  C:\Windows\System\nouTTGW.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\LLJqRhg.exe
  C:\Windows\System\LLJqRhg.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\trUkAxX.exe
  C:\Windows\System\trUkAxX.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\xENshLm.exe
  C:\Windows\System\xENshLm.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\RJnFNEr.exe
  C:\Windows\System\RJnFNEr.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\QpWgwrB.exe
  C:\Windows\System\QpWgwrB.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\TZgAvAW.exe
  C:\Windows\System\TZgAvAW.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\qSNzuSn.exe
  C:\Windows\System\qSNzuSn.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\nTuESZO.exe
  C:\Windows\System\nTuESZO.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\hLxSRvv.exe
  C:\Windows\System\hLxSRvv.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\PMrvwhk.exe
  C:\Windows\System\PMrvwhk.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\RAFkitz.exe
  C:\Windows\System\RAFkitz.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\FqrLDnt.exe
  C:\Windows\System\FqrLDnt.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\kejCfqA.exe
  C:\Windows\System\kejCfqA.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\UOItUiF.exe
  C:\Windows\System\UOItUiF.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\PtHqbXN.exe
  C:\Windows\System\PtHqbXN.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\lymMkSH.exe
  C:\Windows\System\lymMkSH.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\FyBSCrK.exe
  C:\Windows\System\FyBSCrK.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\NkAkFLd.exe
  C:\Windows\System\NkAkFLd.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\zAtaDNE.exe
  C:\Windows\System\zAtaDNE.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\gmZgnMg.exe
  C:\Windows\System\gmZgnMg.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\paoqVkl.exe
  C:\Windows\System\paoqVkl.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\qJaFgYD.exe
  C:\Windows\System\qJaFgYD.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\njQkaMr.exe
  C:\Windows\System\njQkaMr.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\uwFeIun.exe
  C:\Windows\System\uwFeIun.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\FDYxeKn.exe
  C:\Windows\System\FDYxeKn.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\yeHOkjW.exe
  C:\Windows\System\yeHOkjW.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\mhDcAmC.exe
  C:\Windows\System\mhDcAmC.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\gDGjbAM.exe
  C:\Windows\System\gDGjbAM.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\zuvRBrq.exe
  C:\Windows\System\zuvRBrq.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\ocVxgQw.exe
  C:\Windows\System\ocVxgQw.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\cZgpDmF.exe
  C:\Windows\System\cZgpDmF.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\iBEkghj.exe
  C:\Windows\System\iBEkghj.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\ydpXAyx.exe
  C:\Windows\System\ydpXAyx.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\HBVzniA.exe
  C:\Windows\System\HBVzniA.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\lWHBZFp.exe
  C:\Windows\System\lWHBZFp.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\xxkNgjK.exe
  C:\Windows\System\xxkNgjK.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\UxCiIft.exe
  C:\Windows\System\UxCiIft.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\Splculq.exe
  C:\Windows\System\Splculq.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\qTEoXxX.exe
  C:\Windows\System\qTEoXxX.exe
  2⤵
  PID:2256
- C:\Windows\System\skzGwIy.exe
  C:\Windows\System\skzGwIy.exe
  2⤵
  PID:3068
- C:\Windows\System\seYtvaX.exe
  C:\Windows\System\seYtvaX.exe
  2⤵
  PID:1572
- C:\Windows\System\UEkOjqZ.exe
  C:\Windows\System\UEkOjqZ.exe
  2⤵
  PID:1812
- C:\Windows\System\PppTsSs.exe
  C:\Windows\System\PppTsSs.exe
  2⤵
  PID:2648
- C:\Windows\System\pdlKLnj.exe
  C:\Windows\System\pdlKLnj.exe
  2⤵
  PID:1304
- C:\Windows\System\xVNnBbi.exe
  C:\Windows\System\xVNnBbi.exe
  2⤵
  PID:3688
- C:\Windows\System\qKFPFEg.exe
  C:\Windows\System\qKFPFEg.exe
  2⤵
  PID:4604
- C:\Windows\System\JPDZypU.exe
  C:\Windows\System\JPDZypU.exe
  2⤵
  PID:3884
- C:\Windows\System\RrZwDpZ.exe
  C:\Windows\System\RrZwDpZ.exe
  2⤵
  PID:2400
- C:\Windows\System\HddEKCK.exe
  C:\Windows\System\HddEKCK.exe
  2⤵
  PID:2364
- C:\Windows\System\NIVDMKH.exe
  C:\Windows\System\NIVDMKH.exe
  2⤵
  PID:4448
- C:\Windows\System\FhrSviy.exe
  C:\Windows\System\FhrSviy.exe
  2⤵
  PID:4348
- C:\Windows\System\SLaURZb.exe
  C:\Windows\System\SLaURZb.exe
  2⤵
  PID:3572
- C:\Windows\System\RCWNqUC.exe
  C:\Windows\System\RCWNqUC.exe
  2⤵
  PID:4732
- C:\Windows\System\VnoaFEP.exe
  C:\Windows\System\VnoaFEP.exe
  2⤵
  PID:1216
- C:\Windows\System\dlpevDP.exe
  C:\Windows\System\dlpevDP.exe
  2⤵
  PID:3280
- C:\Windows\System\QiagjNn.exe
  C:\Windows\System\QiagjNn.exe
  2⤵
  PID:1828
- C:\Windows\System\xqAlyZY.exe
  C:\Windows\System\xqAlyZY.exe
  2⤵
  PID:4876
- C:\Windows\System\SgOYgVc.exe
  C:\Windows\System\SgOYgVc.exe
  2⤵
  PID:2584
- C:\Windows\System\ccOYbQu.exe
  C:\Windows\System\ccOYbQu.exe
  2⤵
  PID:4904
- C:\Windows\System\TVFTHcq.exe
  C:\Windows\System\TVFTHcq.exe
  2⤵
  PID:3648
- C:\Windows\System\wDuqjji.exe
  C:\Windows\System\wDuqjji.exe
  2⤵
  PID:4184
- C:\Windows\System\qfWPTuK.exe
  C:\Windows\System\qfWPTuK.exe
  2⤵
  PID:872
- C:\Windows\System\LUzeJxS.exe
  C:\Windows\System\LUzeJxS.exe
  2⤵
  PID:4192
- C:\Windows\System\oyKdzoD.exe
  C:\Windows\System\oyKdzoD.exe
  2⤵
  PID:2292
- C:\Windows\System\jtHMIKk.exe
  C:\Windows\System\jtHMIKk.exe
  2⤵
  PID:4088
- C:\Windows\System\UlVMRYs.exe
  C:\Windows\System\UlVMRYs.exe
  2⤵
  PID:4472
- C:\Windows\System\PDZwHeb.exe
  C:\Windows\System\PDZwHeb.exe
  2⤵
  PID:5128
- C:\Windows\System\OtuIrGa.exe
  C:\Windows\System\OtuIrGa.exe
  2⤵
  PID:5152
- C:\Windows\System\vpJztTp.exe
  C:\Windows\System\vpJztTp.exe
  2⤵
  PID:5208
- C:\Windows\System\QYHPoDt.exe
  C:\Windows\System\QYHPoDt.exe
  2⤵
  PID:5228
- C:\Windows\System\NhmoJVl.exe
  C:\Windows\System\NhmoJVl.exe
  2⤵
  PID:5256
- C:\Windows\System\mPCwyJC.exe
  C:\Windows\System\mPCwyJC.exe
  2⤵
  PID:5292
- C:\Windows\System\YFQNgxG.exe
  C:\Windows\System\YFQNgxG.exe
  2⤵
  PID:5312
- C:\Windows\System\jJlJvcq.exe
  C:\Windows\System\jJlJvcq.exe
  2⤵
  PID:5372
- C:\Windows\System\SjJtwcM.exe
  C:\Windows\System\SjJtwcM.exe
  2⤵
  PID:5396
- C:\Windows\System\xwVoJQd.exe
  C:\Windows\System\xwVoJQd.exe
  2⤵
  PID:5412
- C:\Windows\System\YjwyXsV.exe
  C:\Windows\System\YjwyXsV.exe
  2⤵
  PID:5444
- C:\Windows\System\vgFwFVE.exe
  C:\Windows\System\vgFwFVE.exe
  2⤵
  PID:5472
- C:\Windows\System\rQTxwlY.exe
  C:\Windows\System\rQTxwlY.exe
  2⤵
  PID:5496
- C:\Windows\System\jGTBfmH.exe
  C:\Windows\System\jGTBfmH.exe
  2⤵
  PID:5552
- C:\Windows\System\qhJoxOx.exe
  C:\Windows\System\qhJoxOx.exe
  2⤵
  PID:5576
- C:\Windows\System\SLIMLUE.exe
  C:\Windows\System\SLIMLUE.exe
  2⤵
  PID:5624
- C:\Windows\System\BfJhnoX.exe
  C:\Windows\System\BfJhnoX.exe
  2⤵
  PID:5644
- C:\Windows\System\sSPLeEE.exe
  C:\Windows\System\sSPLeEE.exe
  2⤵
  PID:5668
- C:\Windows\System\dZlvaUJ.exe
  C:\Windows\System\dZlvaUJ.exe
  2⤵
  PID:5688
- C:\Windows\System\abRROuA.exe
  C:\Windows\System\abRROuA.exe
  2⤵
  PID:5716
- C:\Windows\System\EsexbpH.exe
  C:\Windows\System\EsexbpH.exe
  2⤵
  PID:5748
- C:\Windows\System\MOLIQYh.exe
  C:\Windows\System\MOLIQYh.exe
  2⤵
  PID:5768
- C:\Windows\System\MQsvkke.exe
  C:\Windows\System\MQsvkke.exe
  2⤵
  PID:5816
- C:\Windows\System\jrDsPeg.exe
  C:\Windows\System\jrDsPeg.exe
  2⤵
  PID:5836
- C:\Windows\System\ItAtBCz.exe
  C:\Windows\System\ItAtBCz.exe
  2⤵
  PID:5856
- C:\Windows\System\juchCPj.exe
  C:\Windows\System\juchCPj.exe
  2⤵
  PID:5912
- C:\Windows\System\kJFzgEL.exe
  C:\Windows\System\kJFzgEL.exe
  2⤵
  PID:5936
- C:\Windows\System\iocWBhc.exe
  C:\Windows\System\iocWBhc.exe
  2⤵
  PID:5960
- C:\Windows\System\sCwqMbP.exe
  C:\Windows\System\sCwqMbP.exe
  2⤵
  PID:5980
- C:\Windows\System\zjBwgQO.exe
  C:\Windows\System\zjBwgQO.exe
  2⤵
  PID:6028
- C:\Windows\System\HfYPURj.exe
  C:\Windows\System\HfYPURj.exe
  2⤵
  PID:6048
- C:\Windows\System\kShAYFq.exe
  C:\Windows\System\kShAYFq.exe
  2⤵
  PID:6084
- C:\Windows\System\hXupuaC.exe
  C:\Windows\System\hXupuaC.exe
  2⤵
  PID:6100
- C:\Windows\System\qoXafSq.exe
  C:\Windows\System\qoXafSq.exe
  2⤵
  PID:6124
- C:\Windows\System\ABGgfNj.exe
  C:\Windows\System\ABGgfNj.exe
  2⤵
  PID:5184
- C:\Windows\System\nzioEVP.exe
  C:\Windows\System\nzioEVP.exe
  2⤵
  PID:5172
- C:\Windows\System\dgIkcxA.exe
  C:\Windows\System\dgIkcxA.exe
  2⤵
  PID:5268
- C:\Windows\System\pyeuqeC.exe
  C:\Windows\System\pyeuqeC.exe
  2⤵
  PID:5252
- C:\Windows\System\RZChJCq.exe
  C:\Windows\System\RZChJCq.exe
  2⤵
  PID:5420
- C:\Windows\System\RfgMoTV.exe
  C:\Windows\System\RfgMoTV.exe
  2⤵
  PID:5368
- C:\Windows\System\hIeyeuq.exe
  C:\Windows\System\hIeyeuq.exe
  2⤵
  PID:5460
- C:\Windows\System\SoUebOF.exe
  C:\Windows\System\SoUebOF.exe
  2⤵
  PID:5488
- C:\Windows\System\YtlAZhw.exe
  C:\Windows\System\YtlAZhw.exe
  2⤵
  PID:5568
- C:\Windows\System\YCwjhVW.exe
  C:\Windows\System\YCwjhVW.exe
  2⤵
  PID:5708
- C:\Windows\System\cNaSArH.exe
  C:\Windows\System\cNaSArH.exe
  2⤵
  PID:5852
- C:\Windows\System\LCXQgFD.exe
  C:\Windows\System\LCXQgFD.exe
  2⤵
  PID:5828
- C:\Windows\System\ZcNMKej.exe
  C:\Windows\System\ZcNMKej.exe
  2⤵
  PID:5900
- C:\Windows\System\NJUPSSi.exe
  C:\Windows\System\NJUPSSi.exe
  2⤵
  PID:6040
- C:\Windows\System\ihtZKkZ.exe
  C:\Windows\System\ihtZKkZ.exe
  2⤵
  PID:6008
- C:\Windows\System\JeAYopQ.exe
  C:\Windows\System\JeAYopQ.exe
  2⤵
  PID:6112
- C:\Windows\System\CagqxWF.exe
  C:\Windows\System\CagqxWF.exe
  2⤵
  PID:2112
- C:\Windows\System\NIkpwXd.exe
  C:\Windows\System\NIkpwXd.exe
  2⤵
  PID:5248
- C:\Windows\System\EeQKWdC.exe
  C:\Windows\System\EeQKWdC.exe
  2⤵
  PID:4048
- C:\Windows\System\zNslGaY.exe
  C:\Windows\System\zNslGaY.exe
  2⤵
  PID:5324
- C:\Windows\System\eFbHjqO.exe
  C:\Windows\System\eFbHjqO.exe
  2⤵
  PID:5636
- C:\Windows\System\tOghyCR.exe
  C:\Windows\System\tOghyCR.exe
  2⤵
  PID:5696
- C:\Windows\System\aQJTANB.exe
  C:\Windows\System\aQJTANB.exe
  2⤵
  PID:5740
- C:\Windows\System\YGcUZFD.exe
  C:\Windows\System\YGcUZFD.exe
  2⤵
  PID:6068
- C:\Windows\System\AJPFisL.exe
  C:\Windows\System\AJPFisL.exe
  2⤵
  PID:6108
- C:\Windows\System\yVHAXOp.exe
  C:\Windows\System\yVHAXOp.exe
  2⤵
  PID:2976
- C:\Windows\System\CsDpKeN.exe
  C:\Windows\System\CsDpKeN.exe
  2⤵
  PID:5872
- C:\Windows\System\ZsjHREj.exe
  C:\Windows\System\ZsjHREj.exe
  2⤵
  PID:4968
- C:\Windows\System\gCrqpGm.exe
  C:\Windows\System\gCrqpGm.exe
  2⤵
  PID:6156
- C:\Windows\System\ApNOxjG.exe
  C:\Windows\System\ApNOxjG.exe
  2⤵
  PID:6200
- C:\Windows\System\SSuwSaT.exe
  C:\Windows\System\SSuwSaT.exe
  2⤵
  PID:6228
- C:\Windows\System\eWpCSJG.exe
  C:\Windows\System\eWpCSJG.exe
  2⤵
  PID:6288
- C:\Windows\System\nOjMunH.exe
  C:\Windows\System\nOjMunH.exe
  2⤵
  PID:6304
- C:\Windows\System\OmMZfHs.exe
  C:\Windows\System\OmMZfHs.exe
  2⤵
  PID:6328
- C:\Windows\System\FfYrQCc.exe
  C:\Windows\System\FfYrQCc.exe
  2⤵
  PID:6348
- C:\Windows\System\ZegATKm.exe
  C:\Windows\System\ZegATKm.exe
  2⤵
  PID:6368
- C:\Windows\System\rSNlhEZ.exe
  C:\Windows\System\rSNlhEZ.exe
  2⤵
  PID:6396
- C:\Windows\System\xlSnDOq.exe
  C:\Windows\System\xlSnDOq.exe
  2⤵
  PID:6424
- C:\Windows\System\vJHSjMI.exe
  C:\Windows\System\vJHSjMI.exe
  2⤵
  PID:6452
- C:\Windows\System\mkaHydr.exe
  C:\Windows\System\mkaHydr.exe
  2⤵
  PID:6468
- C:\Windows\System\fWotLGw.exe
  C:\Windows\System\fWotLGw.exe
  2⤵
  PID:6492
- C:\Windows\System\bePwERb.exe
  C:\Windows\System\bePwERb.exe
  2⤵
  PID:6512
- C:\Windows\System\tIusSiM.exe
  C:\Windows\System\tIusSiM.exe
  2⤵
  PID:6564
- C:\Windows\System\KZefALr.exe
  C:\Windows\System\KZefALr.exe
  2⤵
  PID:6592
- C:\Windows\System\jnKLeKs.exe
  C:\Windows\System\jnKLeKs.exe
  2⤵
  PID:6620
- C:\Windows\System\JLqVxIM.exe
  C:\Windows\System\JLqVxIM.exe
  2⤵
  PID:6664
- C:\Windows\System\MZqptle.exe
  C:\Windows\System\MZqptle.exe
  2⤵
  PID:6692
- C:\Windows\System\yEkZdzi.exe
  C:\Windows\System\yEkZdzi.exe
  2⤵
  PID:6712
- C:\Windows\System\jtEXLfX.exe
  C:\Windows\System\jtEXLfX.exe
  2⤵
  PID:6732
- C:\Windows\System\mQlWnOk.exe
  C:\Windows\System\mQlWnOk.exe
  2⤵
  PID:6756
- C:\Windows\System\wzPhAox.exe
  C:\Windows\System\wzPhAox.exe
  2⤵
  PID:6776
- C:\Windows\System\VLfpWYt.exe
  C:\Windows\System\VLfpWYt.exe
  2⤵
  PID:6800
- C:\Windows\System\nZpCXvY.exe
  C:\Windows\System\nZpCXvY.exe
  2⤵
  PID:6828
- C:\Windows\System\zCKoHlY.exe
  C:\Windows\System\zCKoHlY.exe
  2⤵
  PID:6848
- C:\Windows\System\DsXTkrP.exe
  C:\Windows\System\DsXTkrP.exe
  2⤵
  PID:6872
- C:\Windows\System\BHgVqqG.exe
  C:\Windows\System\BHgVqqG.exe
  2⤵
  PID:6932
- C:\Windows\System\rrdwXNN.exe
  C:\Windows\System\rrdwXNN.exe
  2⤵
  PID:6968
- C:\Windows\System\QcgrBUj.exe
  C:\Windows\System\QcgrBUj.exe
  2⤵
  PID:6992
- C:\Windows\System\yNPaoku.exe
  C:\Windows\System\yNPaoku.exe
  2⤵
  PID:7008
- C:\Windows\System\QtLMTFf.exe
  C:\Windows\System\QtLMTFf.exe
  2⤵
  PID:7028
- C:\Windows\System\TkhjzRn.exe
  C:\Windows\System\TkhjzRn.exe
  2⤵
  PID:7052
- C:\Windows\System\sZYYpox.exe
  C:\Windows\System\sZYYpox.exe
  2⤵
  PID:7096
- C:\Windows\System\qkNSMdC.exe
  C:\Windows\System\qkNSMdC.exe
  2⤵
  PID:7120
- C:\Windows\System\ZIxhdwq.exe
  C:\Windows\System\ZIxhdwq.exe
  2⤵
  PID:5408
- C:\Windows\System\tLeMqOv.exe
  C:\Windows\System\tLeMqOv.exe
  2⤵
  PID:1512
- C:\Windows\System\QlzaUer.exe
  C:\Windows\System\QlzaUer.exe
  2⤵
  PID:6224
- C:\Windows\System\TeWiZRd.exe
  C:\Windows\System\TeWiZRd.exe
  2⤵
  PID:2092
- C:\Windows\System\DDiLbHh.exe
  C:\Windows\System\DDiLbHh.exe
  2⤵
  PID:6300
- C:\Windows\System\uoeNBIp.exe
  C:\Windows\System\uoeNBIp.exe
  2⤵
  PID:6392
- C:\Windows\System\cnXRaPb.exe
  C:\Windows\System\cnXRaPb.exe
  2⤵
  PID:6420
- C:\Windows\System\mOwuLng.exe
  C:\Windows\System\mOwuLng.exe
  2⤵
  PID:6444
- C:\Windows\System\lYKAPdp.exe
  C:\Windows\System\lYKAPdp.exe
  2⤵
  PID:6560
- C:\Windows\System\KLhMdXQ.exe
  C:\Windows\System\KLhMdXQ.exe
  2⤵
  PID:6616
- C:\Windows\System\WNpoXJk.exe
  C:\Windows\System\WNpoXJk.exe
  2⤵
  PID:6660
- C:\Windows\System\FRNKaoE.exe
  C:\Windows\System\FRNKaoE.exe
  2⤵
  PID:6708
- C:\Windows\System\yxKkKco.exe
  C:\Windows\System\yxKkKco.exe
  2⤵
  PID:6724
- C:\Windows\System\KujFELD.exe
  C:\Windows\System\KujFELD.exe
  2⤵
  PID:6808
- C:\Windows\System\nwWyIxi.exe
  C:\Windows\System\nwWyIxi.exe
  2⤵
  PID:6864
- C:\Windows\System\zuhNHLH.exe
  C:\Windows\System\zuhNHLH.exe
  2⤵
  PID:6940
- C:\Windows\System\rbpKwgC.exe
  C:\Windows\System\rbpKwgC.exe
  2⤵
  PID:7000
- C:\Windows\System\NbNFcrR.exe
  C:\Windows\System\NbNFcrR.exe
  2⤵
  PID:7084
- C:\Windows\System\tpVgCXX.exe
  C:\Windows\System\tpVgCXX.exe
  2⤵
  PID:7108
- C:\Windows\System\demplCi.exe
  C:\Windows\System\demplCi.exe
  2⤵
  PID:6148
- C:\Windows\System\qsuEPZM.exe
  C:\Windows\System\qsuEPZM.exe
  2⤵
  PID:1956
- C:\Windows\System\jUqbpAf.exe
  C:\Windows\System\jUqbpAf.exe
  2⤵
  PID:6092
- C:\Windows\System\VNJQruz.exe
  C:\Windows\System\VNJQruz.exe
  2⤵
  PID:6656
- C:\Windows\System\JvMopje.exe
  C:\Windows\System\JvMopje.exe
  2⤵
  PID:2312
- C:\Windows\System\Sjujuxx.exe
  C:\Windows\System\Sjujuxx.exe
  2⤵
  PID:6772
- C:\Windows\System\OxzfKMV.exe
  C:\Windows\System\OxzfKMV.exe
  2⤵
  PID:6868
- C:\Windows\System\KbKuijQ.exe
  C:\Windows\System\KbKuijQ.exe
  2⤵
  PID:7024
- C:\Windows\System\kmWmzmA.exe
  C:\Windows\System\kmWmzmA.exe
  2⤵
  PID:6524
- C:\Windows\System\TyWtxaG.exe
  C:\Windows\System\TyWtxaG.exe
  2⤵
  PID:7036
- C:\Windows\System\gfRawXM.exe
  C:\Windows\System\gfRawXM.exe
  2⤵
  PID:6272
- C:\Windows\System\HigzSOu.exe
  C:\Windows\System\HigzSOu.exe
  2⤵
  PID:4980
- C:\Windows\System\tovRQku.exe
  C:\Windows\System\tovRQku.exe
  2⤵
  PID:7176
- C:\Windows\System\kOeWIXz.exe
  C:\Windows\System\kOeWIXz.exe
  2⤵
  PID:7196
- C:\Windows\System\uUgUDCJ.exe
  C:\Windows\System\uUgUDCJ.exe
  2⤵
  PID:7228
- C:\Windows\System\XQyJwVt.exe
  C:\Windows\System\XQyJwVt.exe
  2⤵
  PID:7252
- C:\Windows\System\cBAZXcs.exe
  C:\Windows\System\cBAZXcs.exe
  2⤵
  PID:7280
- C:\Windows\System\lFqyuxJ.exe
  C:\Windows\System\lFqyuxJ.exe
  2⤵
  PID:7296
- C:\Windows\System\uzvhwpr.exe
  C:\Windows\System\uzvhwpr.exe
  2⤵
  PID:7316
- C:\Windows\System\aabLeZm.exe
  C:\Windows\System\aabLeZm.exe
  2⤵
  PID:7340
- C:\Windows\System\JDeZFKz.exe
  C:\Windows\System\JDeZFKz.exe
  2⤵
  PID:7364
- C:\Windows\System\TxFdEpJ.exe
  C:\Windows\System\TxFdEpJ.exe
  2⤵
  PID:7412
- C:\Windows\System\HzvWDwE.exe
  C:\Windows\System\HzvWDwE.exe
  2⤵
  PID:7488
- C:\Windows\System\rsGpBPg.exe
  C:\Windows\System\rsGpBPg.exe
  2⤵
  PID:7504
- C:\Windows\System\Nukhkrh.exe
  C:\Windows\System\Nukhkrh.exe
  2⤵
  PID:7532
- C:\Windows\System\gXhCoOq.exe
  C:\Windows\System\gXhCoOq.exe
  2⤵
  PID:7548
- C:\Windows\System\JBleYMW.exe
  C:\Windows\System\JBleYMW.exe
  2⤵
  PID:7604
- C:\Windows\System\KJsmDDh.exe
  C:\Windows\System\KJsmDDh.exe
  2⤵
  PID:7624
- C:\Windows\System\DvQJZHc.exe
  C:\Windows\System\DvQJZHc.exe
  2⤵
  PID:7640
- C:\Windows\System\zwRlpaY.exe
  C:\Windows\System\zwRlpaY.exe
  2⤵
  PID:7664
- C:\Windows\System\jjfVcHS.exe
  C:\Windows\System\jjfVcHS.exe
  2⤵
  PID:7688
- C:\Windows\System\mlGkxHj.exe
  C:\Windows\System\mlGkxHj.exe
  2⤵
  PID:7720
- C:\Windows\System\nHfTxwD.exe
  C:\Windows\System\nHfTxwD.exe
  2⤵
  PID:7756
- C:\Windows\System\fEYgWdU.exe
  C:\Windows\System\fEYgWdU.exe
  2⤵
  PID:7780
- C:\Windows\System\aOLpZMt.exe
  C:\Windows\System\aOLpZMt.exe
  2⤵
  PID:7816
- C:\Windows\System\YDMmvLh.exe
  C:\Windows\System\YDMmvLh.exe
  2⤵
  PID:7832
- C:\Windows\System\JbftpOa.exe
  C:\Windows\System\JbftpOa.exe
  2⤵
  PID:7860
- C:\Windows\System\gOkryYn.exe
  C:\Windows\System\gOkryYn.exe
  2⤵
  PID:7904
- C:\Windows\System\ESFfqek.exe
  C:\Windows\System\ESFfqek.exe
  2⤵
  PID:7928
- C:\Windows\System\GHtZOcF.exe
  C:\Windows\System\GHtZOcF.exe
  2⤵
  PID:7964
- C:\Windows\System\zyWVdkP.exe
  C:\Windows\System\zyWVdkP.exe
  2⤵
  PID:7996
- C:\Windows\System\djVRgLI.exe
  C:\Windows\System\djVRgLI.exe
  2⤵
  PID:8032
- C:\Windows\System\QxvBrjD.exe
  C:\Windows\System\QxvBrjD.exe
  2⤵
  PID:8056
- C:\Windows\System\BxXSumF.exe
  C:\Windows\System\BxXSumF.exe
  2⤵
  PID:8080
- C:\Windows\System\jQxrZKk.exe
  C:\Windows\System\jQxrZKk.exe
  2⤵
  PID:8132
- C:\Windows\System\KSSCDeQ.exe
  C:\Windows\System\KSSCDeQ.exe
  2⤵
  PID:8160
- C:\Windows\System\tuYfhDA.exe
  C:\Windows\System\tuYfhDA.exe
  2⤵
  PID:6640
- C:\Windows\System\BnGHLdi.exe
  C:\Windows\System\BnGHLdi.exe
  2⤵
  PID:7268
- C:\Windows\System\npYjCMo.exe
  C:\Windows\System\npYjCMo.exe
  2⤵
  PID:7312
- C:\Windows\System\UgElhAA.exe
  C:\Windows\System\UgElhAA.exe
  2⤵
  PID:7308
- C:\Windows\System\DfGxrUC.exe
  C:\Windows\System\DfGxrUC.exe
  2⤵
  PID:7404
- C:\Windows\System\phBkUjK.exe
  C:\Windows\System\phBkUjK.exe
  2⤵
  PID:7448
- C:\Windows\System\kMDfBJR.exe
  C:\Windows\System\kMDfBJR.exe
  2⤵
  PID:7496
- C:\Windows\System\OqDaenW.exe
  C:\Windows\System\OqDaenW.exe
  2⤵
  PID:7540
- C:\Windows\System\GOjThBU.exe
  C:\Windows\System\GOjThBU.exe
  2⤵
  PID:7572
- C:\Windows\System\gdGZAFp.exe
  C:\Windows\System\gdGZAFp.exe
  2⤵
  PID:7696
- C:\Windows\System\QeOkoJJ.exe
  C:\Windows\System\QeOkoJJ.exe
  2⤵
  PID:7804
- C:\Windows\System\wfvxDHQ.exe
  C:\Windows\System\wfvxDHQ.exe
  2⤵
  PID:7868
- C:\Windows\System\EAyTPSb.exe
  C:\Windows\System\EAyTPSb.exe
  2⤵
  PID:7912
- C:\Windows\System\TZMUqxI.exe
  C:\Windows\System\TZMUqxI.exe
  2⤵
  PID:7988
- C:\Windows\System\UKJVucp.exe
  C:\Windows\System\UKJVucp.exe
  2⤵
  PID:8048
- C:\Windows\System\DupAbHw.exe
  C:\Windows\System\DupAbHw.exe
  2⤵
  PID:8092
- C:\Windows\System\SZdfDNe.exe
  C:\Windows\System\SZdfDNe.exe
  2⤵
  PID:7240
- C:\Windows\System\meqoSyk.exe
  C:\Windows\System\meqoSyk.exe
  2⤵
  PID:7356
- C:\Windows\System\kPYTMYz.exe
  C:\Windows\System\kPYTMYz.exe
  2⤵
  PID:7376
- C:\Windows\System\abKWWdT.exe
  C:\Windows\System\abKWWdT.exe
  2⤵
  PID:7588
- C:\Windows\System\YrnyeII.exe
  C:\Windows\System\YrnyeII.exe
  2⤵
  PID:7764
- C:\Windows\System\IeBedfK.exe
  C:\Windows\System\IeBedfK.exe
  2⤵
  PID:7900
- C:\Windows\System\bZBEzvT.exe
  C:\Windows\System\bZBEzvT.exe
  2⤵
  PID:8044
- C:\Windows\System\njPVgmg.exe
  C:\Windows\System\njPVgmg.exe
  2⤵
  PID:7516
- C:\Windows\System\avLHFtF.exe
  C:\Windows\System\avLHFtF.exe
  2⤵
  PID:7480
- C:\Windows\System\eECweKi.exe
  C:\Windows\System\eECweKi.exe
  2⤵
  PID:7796
- C:\Windows\System\ABoGEeV.exe
  C:\Windows\System\ABoGEeV.exe
  2⤵
  PID:8260
- C:\Windows\System\wnBUzlg.exe
  C:\Windows\System\wnBUzlg.exe
  2⤵
  PID:8304
- C:\Windows\System\BsDtWJi.exe
  C:\Windows\System\BsDtWJi.exe
  2⤵
  PID:8332
- C:\Windows\System\kimCDIf.exe
  C:\Windows\System\kimCDIf.exe
  2⤵
  PID:8352
- C:\Windows\System\YiqPAXg.exe
  C:\Windows\System\YiqPAXg.exe
  2⤵
  PID:8400
- C:\Windows\System\JWXlLRV.exe
  C:\Windows\System\JWXlLRV.exe
  2⤵
  PID:8436
- C:\Windows\System\bAgHUhM.exe
  C:\Windows\System\bAgHUhM.exe
  2⤵
  PID:8500
- C:\Windows\System\cBmVstJ.exe
  C:\Windows\System\cBmVstJ.exe
  2⤵
  PID:8524
- C:\Windows\System\QSbxyRh.exe
  C:\Windows\System\QSbxyRh.exe
  2⤵
  PID:8552
- C:\Windows\System\xzOMAtW.exe
  C:\Windows\System\xzOMAtW.exe
  2⤵
  PID:8596
- C:\Windows\System\pfyqCjV.exe
  C:\Windows\System\pfyqCjV.exe
  2⤵
  PID:8616
- C:\Windows\System\gYOxSbc.exe
  C:\Windows\System\gYOxSbc.exe
  2⤵
  PID:8648
- C:\Windows\System\rgCQAdS.exe
  C:\Windows\System\rgCQAdS.exe
  2⤵
  PID:8684
- C:\Windows\System\VwouitR.exe
  C:\Windows\System\VwouitR.exe
  2⤵
  PID:8728
- C:\Windows\System\CZJqENc.exe
  C:\Windows\System\CZJqENc.exe
  2⤵
  PID:8752
- C:\Windows\System\fNObAPN.exe
  C:\Windows\System\fNObAPN.exe
  2⤵
  PID:8772
- C:\Windows\System\nipQagI.exe
  C:\Windows\System\nipQagI.exe
  2⤵
  PID:8816
- C:\Windows\System\qGehSzM.exe
  C:\Windows\System\qGehSzM.exe
  2⤵
  PID:8840
- C:\Windows\System\bTcSxED.exe
  C:\Windows\System\bTcSxED.exe
  2⤵
  PID:8860
- C:\Windows\System\aVFpVOf.exe
  C:\Windows\System\aVFpVOf.exe
  2⤵
  PID:8880
- C:\Windows\System\SlHpbPh.exe
  C:\Windows\System\SlHpbPh.exe
  2⤵
  PID:8908
- C:\Windows\System\eVMHUVP.exe
  C:\Windows\System\eVMHUVP.exe
  2⤵
  PID:8944
- C:\Windows\System\BCtmVVt.exe
  C:\Windows\System\BCtmVVt.exe
  2⤵
  PID:8972
- C:\Windows\System\nlFGiip.exe
  C:\Windows\System\nlFGiip.exe
  2⤵
  PID:8992
- C:\Windows\System\fxyVOvT.exe
  C:\Windows\System\fxyVOvT.exe
  2⤵
  PID:9016
- C:\Windows\System\IMybMUb.exe
  C:\Windows\System\IMybMUb.exe
  2⤵
  PID:9036
- C:\Windows\System\GyvSZrJ.exe
  C:\Windows\System\GyvSZrJ.exe
  2⤵
  PID:9092
- C:\Windows\System\sdKbjZb.exe
  C:\Windows\System\sdKbjZb.exe
  2⤵
  PID:9116
- C:\Windows\System\opwhhrU.exe
  C:\Windows\System\opwhhrU.exe
  2⤵
  PID:9140
- C:\Windows\System\mWHsaet.exe
  C:\Windows\System\mWHsaet.exe
  2⤵
  PID:9156
- C:\Windows\System\PWckeyY.exe
  C:\Windows\System\PWckeyY.exe
  2⤵
  PID:9172
- C:\Windows\System\ISgoKGL.exe
  C:\Windows\System\ISgoKGL.exe
  2⤵
  PID:9192
- C:\Windows\System\SokCSnY.exe
  C:\Windows\System\SokCSnY.exe
  2⤵
  PID:8220
- C:\Windows\System\zExmwrv.exe
  C:\Windows\System\zExmwrv.exe
  2⤵
  PID:8276
- C:\Windows\System\cJVHtiJ.exe
  C:\Windows\System\cJVHtiJ.exe
  2⤵
  PID:8316
- C:\Windows\System\BjgzrEr.exe
  C:\Windows\System\BjgzrEr.exe
  2⤵
  PID:8424
- C:\Windows\System\sXvNcoC.exe
  C:\Windows\System\sXvNcoC.exe
  2⤵
  PID:8464
- C:\Windows\System\xmGTegG.exe
  C:\Windows\System\xmGTegG.exe
  2⤵
  PID:8564
- C:\Windows\System\fjSNkcW.exe
  C:\Windows\System\fjSNkcW.exe
  2⤵
  PID:8604
- C:\Windows\System\LgKGnhE.exe
  C:\Windows\System\LgKGnhE.exe
  2⤵
  PID:8700
- C:\Windows\System\QCZffno.exe
  C:\Windows\System\QCZffno.exe
  2⤵
  PID:8724
- C:\Windows\System\eEmjqgt.exe
  C:\Windows\System\eEmjqgt.exe
  2⤵
  PID:8792
- C:\Windows\System\VRsLglb.exe
  C:\Windows\System\VRsLglb.exe
  2⤵
  PID:8832
- C:\Windows\System\xISyCzD.exe
  C:\Windows\System\xISyCzD.exe
  2⤵
  PID:8896
- C:\Windows\System\WNsUuhp.exe
  C:\Windows\System\WNsUuhp.exe
  2⤵
  PID:9044
- C:\Windows\System\aWEJaAA.exe
  C:\Windows\System\aWEJaAA.exe
  2⤵
  PID:9100
- C:\Windows\System\oLBwGON.exe
  C:\Windows\System\oLBwGON.exe
  2⤵
  PID:9112
- C:\Windows\System\ScZjWYK.exe
  C:\Windows\System\ScZjWYK.exe
  2⤵
  PID:9188
- C:\Windows\System\FwfRuxA.exe
  C:\Windows\System\FwfRuxA.exe
  2⤵
  PID:8320
- C:\Windows\System\OSEPdZI.exe
  C:\Windows\System\OSEPdZI.exe
  2⤵
  PID:8488
- C:\Windows\System\ZBadlzB.exe
  C:\Windows\System\ZBadlzB.exe
  2⤵
  PID:8640
- C:\Windows\System\qvYZsIK.exe
  C:\Windows\System\qvYZsIK.exe
  2⤵
  PID:8828
- C:\Windows\System\tVjqQzu.exe
  C:\Windows\System\tVjqQzu.exe
  2⤵
  PID:8988
- C:\Windows\System\sKEoPZs.exe
  C:\Windows\System\sKEoPZs.exe
  2⤵
  PID:9008
- C:\Windows\System\RuNzCVA.exe
  C:\Windows\System\RuNzCVA.exe
  2⤵
  PID:848
- C:\Windows\System\yChtPOj.exe
  C:\Windows\System\yChtPOj.exe
  2⤵
  PID:8644
- C:\Windows\System\yJVwTwu.exe
  C:\Windows\System\yJVwTwu.exe
  2⤵
  PID:8984
- C:\Windows\System\SpGunnB.exe
  C:\Windows\System\SpGunnB.exe
  2⤵
  PID:1748
- C:\Windows\System\qZlrNiP.exe
  C:\Windows\System\qZlrNiP.exe
  2⤵
  PID:8876
- C:\Windows\System\tBwHbWT.exe
  C:\Windows\System\tBwHbWT.exe
  2⤵
  PID:9236
- C:\Windows\System\OLWCTlr.exe
  C:\Windows\System\OLWCTlr.exe
  2⤵
  PID:9260
- C:\Windows\System\eIvpGll.exe
  C:\Windows\System\eIvpGll.exe
  2⤵
  PID:9280
- C:\Windows\System\keZqxtW.exe
  C:\Windows\System\keZqxtW.exe
  2⤵
  PID:9304
- C:\Windows\System\LJbDVLz.exe
  C:\Windows\System\LJbDVLz.exe
  2⤵
  PID:9336
- C:\Windows\System\meZwpto.exe
  C:\Windows\System\meZwpto.exe
  2⤵
  PID:9364
- C:\Windows\System\egCQDKZ.exe
  C:\Windows\System\egCQDKZ.exe
  2⤵
  PID:9412
- C:\Windows\System\eICOtxa.exe
  C:\Windows\System\eICOtxa.exe
  2⤵
  PID:9448
- C:\Windows\System\uWjEtOB.exe
  C:\Windows\System\uWjEtOB.exe
  2⤵
  PID:9468
- C:\Windows\System\ffvBxEe.exe
  C:\Windows\System\ffvBxEe.exe
  2⤵
  PID:9484
- C:\Windows\System\vRPfxeQ.exe
  C:\Windows\System\vRPfxeQ.exe
  2⤵
  PID:9504
- C:\Windows\System\eyzIlgx.exe
  C:\Windows\System\eyzIlgx.exe
  2⤵
  PID:9524
- C:\Windows\System\SbWSVeR.exe
  C:\Windows\System\SbWSVeR.exe
  2⤵
  PID:9572
- C:\Windows\System\XASQmWU.exe
  C:\Windows\System\XASQmWU.exe
  2⤵
  PID:9592
- C:\Windows\System\opjOgMj.exe
  C:\Windows\System\opjOgMj.exe
  2⤵
  PID:9616
- C:\Windows\System\hErANfx.exe
  C:\Windows\System\hErANfx.exe
  2⤵
  PID:9648
- C:\Windows\System\kNNiWgz.exe
  C:\Windows\System\kNNiWgz.exe
  2⤵
  PID:9712
- C:\Windows\System\ARyfeaP.exe
  C:\Windows\System\ARyfeaP.exe
  2⤵
  PID:9732
- C:\Windows\System\JkOBEpd.exe
  C:\Windows\System\JkOBEpd.exe
  2⤵
  PID:9748
- C:\Windows\System\HguxIyq.exe
  C:\Windows\System\HguxIyq.exe
  2⤵
  PID:9788
- C:\Windows\System\XVjxWoA.exe
  C:\Windows\System\XVjxWoA.exe
  2⤵
  PID:9828
- C:\Windows\System\nktSMJL.exe
  C:\Windows\System\nktSMJL.exe
  2⤵
  PID:9852
- C:\Windows\System\xzYBBxR.exe
  C:\Windows\System\xzYBBxR.exe
  2⤵
  PID:9872
- C:\Windows\System\EIZPISv.exe
  C:\Windows\System\EIZPISv.exe
  2⤵
  PID:9896
- C:\Windows\System\bGxjvhu.exe
  C:\Windows\System\bGxjvhu.exe
  2⤵
  PID:9940
- C:\Windows\System\FKAjokq.exe
  C:\Windows\System\FKAjokq.exe
  2⤵
  PID:9964
- C:\Windows\System\TEbwMvg.exe
  C:\Windows\System\TEbwMvg.exe
  2⤵
  PID:10008
- C:\Windows\System\CcZOOMK.exe
  C:\Windows\System\CcZOOMK.exe
  2⤵
  PID:10024
- C:\Windows\System\zxwhJHz.exe
  C:\Windows\System\zxwhJHz.exe
  2⤵
  PID:10052
- C:\Windows\System\RMkwbJU.exe
  C:\Windows\System\RMkwbJU.exe
  2⤵
  PID:10072
- C:\Windows\System\CcyXcJp.exe
  C:\Windows\System\CcyXcJp.exe
  2⤵
  PID:10104
- C:\Windows\System\ZGbqjYY.exe
  C:\Windows\System\ZGbqjYY.exe
  2⤵
  PID:10128
- C:\Windows\System\WAufzeS.exe
  C:\Windows\System\WAufzeS.exe
  2⤵
  PID:10164
- C:\Windows\System\fbjEqNS.exe
  C:\Windows\System\fbjEqNS.exe
  2⤵
  PID:10192
- C:\Windows\System\yMQAinM.exe
  C:\Windows\System\yMQAinM.exe
  2⤵
  PID:10220
- C:\Windows\System\NIeNZJp.exe
  C:\Windows\System\NIeNZJp.exe
  2⤵
  PID:8964
- C:\Windows\System\Sxfnkef.exe
  C:\Windows\System\Sxfnkef.exe
  2⤵
  PID:9244
- C:\Windows\System\fARmrrj.exe
  C:\Windows\System\fARmrrj.exe
  2⤵
  PID:9344
- C:\Windows\System\ctDBptq.exe
  C:\Windows\System\ctDBptq.exe
  2⤵
  PID:9408
- C:\Windows\System\BSlWybn.exe
  C:\Windows\System\BSlWybn.exe
  2⤵
  PID:9464
- C:\Windows\System\rzNGYyZ.exe
  C:\Windows\System\rzNGYyZ.exe
  2⤵
  PID:9512
- C:\Windows\System\hLhURIr.exe
  C:\Windows\System\hLhURIr.exe
  2⤵
  PID:9588
- C:\Windows\System\WLSpFlG.exe
  C:\Windows\System\WLSpFlG.exe
  2⤵
  PID:8804
- C:\Windows\System\zSmqfpN.exe
  C:\Windows\System\zSmqfpN.exe
  2⤵
  PID:9744
- C:\Windows\System\IlyhpER.exe
  C:\Windows\System\IlyhpER.exe
  2⤵
  PID:9816
- C:\Windows\System\ApVKxZd.exe
  C:\Windows\System\ApVKxZd.exe
  2⤵
  PID:9864
- C:\Windows\System\IYWWxtF.exe
  C:\Windows\System\IYWWxtF.exe
  2⤵
  PID:9960
- C:\Windows\System\mrvhakT.exe
  C:\Windows\System\mrvhakT.exe
  2⤵
  PID:9988
- C:\Windows\System\eRzDsmA.exe
  C:\Windows\System\eRzDsmA.exe
  2⤵
  PID:10040
- C:\Windows\System\jKJapXo.exe
  C:\Windows\System\jKJapXo.exe
  2⤵
  PID:10100
- C:\Windows\System\bzwgmCz.exe
  C:\Windows\System\bzwgmCz.exe
  2⤵
  PID:10236
- C:\Windows\System\YlGUyGI.exe
  C:\Windows\System\YlGUyGI.exe
  2⤵
  PID:9252
- C:\Windows\System\USIVLwx.exe
  C:\Windows\System\USIVLwx.exe
  2⤵
  PID:9568
- C:\Windows\System\ZFmksGw.exe
  C:\Windows\System\ZFmksGw.exe
  2⤵
  PID:9492
- C:\Windows\System\BLaVWYW.exe
  C:\Windows\System\BLaVWYW.exe
  2⤵
  PID:9660
- C:\Windows\System\zuUUdtb.exe
  C:\Windows\System\zuUUdtb.exe
  2⤵
  PID:9848
- C:\Windows\System\qDjgXWS.exe
  C:\Windows\System\qDjgXWS.exe
  2⤵
  PID:9936
- C:\Windows\System\GAeIvfp.exe
  C:\Windows\System\GAeIvfp.exe
  2⤵
  PID:10176
- C:\Windows\System\wsCCvjy.exe
  C:\Windows\System\wsCCvjy.exe
  2⤵
  PID:9332
- C:\Windows\System\LYrOuqU.exe
  C:\Windows\System\LYrOuqU.exe
  2⤵
  PID:9700
- C:\Windows\System\nCpeTrm.exe
  C:\Windows\System\nCpeTrm.exe
  2⤵
  PID:10016
- C:\Windows\System\txFLGdl.exe
  C:\Windows\System\txFLGdl.exe
  2⤵
  PID:10116
- C:\Windows\System\aPsCrie.exe
  C:\Windows\System\aPsCrie.exe
  2⤵
  PID:10228
- C:\Windows\System\rvQMypi.exe
  C:\Windows\System\rvQMypi.exe
  2⤵
  PID:10268
- C:\Windows\System\sSaqlFU.exe
  C:\Windows\System\sSaqlFU.exe
  2⤵
  PID:10288
- C:\Windows\System\VJBINse.exe
  C:\Windows\System\VJBINse.exe
  2⤵
  PID:10316
- C:\Windows\System\zLbBMVG.exe
  C:\Windows\System\zLbBMVG.exe
  2⤵
  PID:10336
- C:\Windows\System\dLHQYEj.exe
  C:\Windows\System\dLHQYEj.exe
  2⤵
  PID:10356
- C:\Windows\System\ztpLGOv.exe
  C:\Windows\System\ztpLGOv.exe
  2⤵
  PID:10396
- C:\Windows\System\dJiJKUr.exe
  C:\Windows\System\dJiJKUr.exe
  2⤵
  PID:10428
- C:\Windows\System\HBswxQu.exe
  C:\Windows\System\HBswxQu.exe
  2⤵
  PID:10456
- C:\Windows\System\asLXvfl.exe
  C:\Windows\System\asLXvfl.exe
  2⤵
  PID:10480
- C:\Windows\System\LxbJyII.exe
  C:\Windows\System\LxbJyII.exe
  2⤵
  PID:10500
- C:\Windows\System\WlMgJzH.exe
  C:\Windows\System\WlMgJzH.exe
  2⤵
  PID:10520
- C:\Windows\System\LtuzoXg.exe
  C:\Windows\System\LtuzoXg.exe
  2⤵
  PID:10584
- C:\Windows\System\vqpjzmr.exe
  C:\Windows\System\vqpjzmr.exe
  2⤵
  PID:10620
- C:\Windows\System\DjHjkhw.exe
  C:\Windows\System\DjHjkhw.exe
  2⤵
  PID:10648
- C:\Windows\System\kzfWZKD.exe
  C:\Windows\System\kzfWZKD.exe
  2⤵
  PID:10680
- C:\Windows\System\UrNNyzf.exe
  C:\Windows\System\UrNNyzf.exe
  2⤵
  PID:10700
- C:\Windows\System\QbganRZ.exe
  C:\Windows\System\QbganRZ.exe
  2⤵
  PID:10716
- C:\Windows\System\fbLaqNj.exe
  C:\Windows\System\fbLaqNj.exe
  2⤵
  PID:10756
- C:\Windows\System\OyxTaZI.exe
  C:\Windows\System\OyxTaZI.exe
  2⤵
  PID:10784
- C:\Windows\System\UaMrqcb.exe
  C:\Windows\System\UaMrqcb.exe
  2⤵
  PID:10804
- C:\Windows\System\yOjyJvK.exe
  C:\Windows\System\yOjyJvK.exe
  2⤵
  PID:10832
- C:\Windows\System\cytzBbP.exe
  C:\Windows\System\cytzBbP.exe
  2⤵
  PID:10880
- C:\Windows\System\evobWhf.exe
  C:\Windows\System\evobWhf.exe
  2⤵
  PID:10904
- C:\Windows\System\fdnSvxt.exe
  C:\Windows\System\fdnSvxt.exe
  2⤵
  PID:10924
- C:\Windows\System\mtXURVq.exe
  C:\Windows\System\mtXURVq.exe
  2⤵
  PID:10960
- C:\Windows\System\LVMnyji.exe
  C:\Windows\System\LVMnyji.exe
  2⤵
  PID:10980
- C:\Windows\System\IrBlyTt.exe
  C:\Windows\System\IrBlyTt.exe
  2⤵
  PID:11004
- C:\Windows\System\iRtAwxF.exe
  C:\Windows\System\iRtAwxF.exe
  2⤵
  PID:11028
- C:\Windows\System\oiewAuU.exe
  C:\Windows\System\oiewAuU.exe
  2⤵
  PID:11068
- C:\Windows\System\cRdsGJL.exe
  C:\Windows\System\cRdsGJL.exe
  2⤵
  PID:11096
- C:\Windows\System\KVqrZLh.exe
  C:\Windows\System\KVqrZLh.exe
  2⤵
  PID:11120
- C:\Windows\System\EEarLbd.exe
  C:\Windows\System\EEarLbd.exe
  2⤵
  PID:11148
- C:\Windows\System\tupMbOK.exe
  C:\Windows\System\tupMbOK.exe
  2⤵
  PID:11168
- C:\Windows\System\WluKfjK.exe
  C:\Windows\System\WluKfjK.exe
  2⤵
  PID:11196
- C:\Windows\System\GlaFhpi.exe
  C:\Windows\System\GlaFhpi.exe
  2⤵
  PID:11220
- C:\Windows\System\QMNnuJM.exe
  C:\Windows\System\QMNnuJM.exe
  2⤵
  PID:11240
- C:\Windows\System\MEjfJRM.exe
  C:\Windows\System\MEjfJRM.exe
  2⤵
  PID:10032
- C:\Windows\System\hPsnszT.exe
  C:\Windows\System\hPsnszT.exe
  2⤵
  PID:10392
- C:\Windows\System\WJdgwCP.exe
  C:\Windows\System\WJdgwCP.exe
  2⤵
  PID:10444
- C:\Windows\System\ylxTMAg.exe
  C:\Windows\System\ylxTMAg.exe
  2⤵
  PID:10596
- C:\Windows\System\ONmNEVI.exe
  C:\Windows\System\ONmNEVI.exe
  2⤵
  PID:10644
- C:\Windows\System\LcNkmvZ.exe
  C:\Windows\System\LcNkmvZ.exe
  2⤵
  PID:10696
- C:\Windows\System\aZhzIZY.exe
  C:\Windows\System\aZhzIZY.exe
  2⤵
  PID:10780
- C:\Windows\System\meFjIKf.exe
  C:\Windows\System\meFjIKf.exe
  2⤵
  PID:10876
- C:\Windows\System\diGhDtl.exe
  C:\Windows\System\diGhDtl.exe
  2⤵
  PID:10916
- C:\Windows\System\mRgsevV.exe
  C:\Windows\System\mRgsevV.exe
  2⤵
  PID:10976
- C:\Windows\System\GegDGXP.exe
  C:\Windows\System\GegDGXP.exe
  2⤵
  PID:11044
- C:\Windows\System\ycyVuHV.exe
  C:\Windows\System\ycyVuHV.exe
  2⤵
  PID:11064
- C:\Windows\System\UATbHQe.exe
  C:\Windows\System\UATbHQe.exe
  2⤵
  PID:11136
- C:\Windows\System\OkeCGRa.exe
  C:\Windows\System\OkeCGRa.exe
  2⤵
  PID:11192
- C:\Windows\System\FvwkWTj.exe
  C:\Windows\System\FvwkWTj.exe
  2⤵
  PID:11260
- C:\Windows\System\XyWpqbA.exe
  C:\Windows\System\XyWpqbA.exe
  2⤵
  PID:10368
- C:\Windows\System\iiePLTD.exe
  C:\Windows\System\iiePLTD.exe
  2⤵
  PID:10488
- C:\Windows\System\DMxYtiv.exe
  C:\Windows\System\DMxYtiv.exe
  2⤵
  PID:10580
- C:\Windows\System\auduWRZ.exe
  C:\Windows\System\auduWRZ.exe
  2⤵
  PID:10812
- C:\Windows\System\MxacxQk.exe
  C:\Windows\System\MxacxQk.exe
  2⤵
  PID:10864
- C:\Windows\System\dnevAJX.exe
  C:\Windows\System\dnevAJX.exe
  2⤵
  PID:10968
- C:\Windows\System\xhWZRdr.exe
  C:\Windows\System\xhWZRdr.exe
  2⤵
  PID:11132
- C:\Windows\System\HfCuVZI.exe
  C:\Windows\System\HfCuVZI.exe
  2⤵
  PID:10468
- C:\Windows\System\CTkHrVU.exe
  C:\Windows\System\CTkHrVU.exe
  2⤵
  PID:10612
- C:\Windows\System\CzFkJeQ.exe
  C:\Windows\System\CzFkJeQ.exe
  2⤵
  PID:10512
- C:\Windows\System\vdrYuWV.exe
  C:\Windows\System\vdrYuWV.exe
  2⤵
  PID:2484
- C:\Windows\System\vTPImdB.exe
  C:\Windows\System\vTPImdB.exe
  2⤵
  PID:9632
- C:\Windows\System\CMDboPr.exe
  C:\Windows\System\CMDboPr.exe
  2⤵
  PID:10388
- C:\Windows\System\lAdulOU.exe
  C:\Windows\System\lAdulOU.exe
  2⤵
  PID:11268
- C:\Windows\System\VETDLUj.exe
  C:\Windows\System\VETDLUj.exe
  2⤵
  PID:11296
- C:\Windows\System\QPNmito.exe
  C:\Windows\System\QPNmito.exe
  2⤵
  PID:11336
- C:\Windows\System\qDtqKoN.exe
  C:\Windows\System\qDtqKoN.exe
  2⤵
  PID:11356
- C:\Windows\System\IugUcvG.exe
  C:\Windows\System\IugUcvG.exe
  2⤵
  PID:11384
- C:\Windows\System\jmULmaW.exe
  C:\Windows\System\jmULmaW.exe
  2⤵
  PID:11412
- C:\Windows\System\IFZpPzv.exe
  C:\Windows\System\IFZpPzv.exe
  2⤵
  PID:11436
- C:\Windows\System\xtKdCUB.exe
  C:\Windows\System\xtKdCUB.exe
  2⤵
  PID:11456
- C:\Windows\System\jIQUneo.exe
  C:\Windows\System\jIQUneo.exe
  2⤵
  PID:11484
- C:\Windows\System\vZLUjJQ.exe
  C:\Windows\System\vZLUjJQ.exe
  2⤵
  PID:11512
- C:\Windows\System\dBawDDO.exe
  C:\Windows\System\dBawDDO.exe
  2⤵
  PID:11536
- C:\Windows\System\yjxWLcK.exe
  C:\Windows\System\yjxWLcK.exe
  2⤵
  PID:11556
- C:\Windows\System\KLeeYwG.exe
  C:\Windows\System\KLeeYwG.exe
  2⤵
  PID:11584
- C:\Windows\System\hgaZSWa.exe
  C:\Windows\System\hgaZSWa.exe
  2⤵
  PID:11608
- C:\Windows\System\PdQXMOk.exe
  C:\Windows\System\PdQXMOk.exe
  2⤵
  PID:11628
- C:\Windows\System\IBpJCFW.exe
  C:\Windows\System\IBpJCFW.exe
  2⤵
  PID:11688
- C:\Windows\System\crbxWML.exe
  C:\Windows\System\crbxWML.exe
  2⤵
  PID:11708
- C:\Windows\System\bSopHGU.exe
  C:\Windows\System\bSopHGU.exe
  2⤵
  PID:11748
- C:\Windows\System\IDoIQlA.exe
  C:\Windows\System\IDoIQlA.exe
  2⤵
  PID:11772
- C:\Windows\System\wOkvIbO.exe
  C:\Windows\System\wOkvIbO.exe
  2⤵
  PID:11788
- C:\Windows\System\HFeiqvu.exe
  C:\Windows\System\HFeiqvu.exe
  2⤵
  PID:11812
- C:\Windows\System\YOhzLoB.exe
  C:\Windows\System\YOhzLoB.exe
  2⤵
  PID:11848
- C:\Windows\System\mPKKEER.exe
  C:\Windows\System\mPKKEER.exe
  2⤵
  PID:11880
- C:\Windows\System\OCXDTyI.exe
  C:\Windows\System\OCXDTyI.exe
  2⤵
  PID:11900
- C:\Windows\System\oJFOdWI.exe
  C:\Windows\System\oJFOdWI.exe
  2⤵
  PID:11924
- C:\Windows\System\cNCCIuw.exe
  C:\Windows\System\cNCCIuw.exe
  2⤵
  PID:11976
- C:\Windows\System\LcQbXEw.exe
  C:\Windows\System\LcQbXEw.exe
  2⤵
  PID:12000
- C:\Windows\System\rjWLUPA.exe
  C:\Windows\System\rjWLUPA.exe
  2⤵
  PID:12020
- C:\Windows\System\ZPpxxkL.exe
  C:\Windows\System\ZPpxxkL.exe
  2⤵
  PID:12048
- C:\Windows\System\BMPghBz.exe
  C:\Windows\System\BMPghBz.exe
  2⤵
  PID:12068
- C:\Windows\System\kEGUadk.exe
  C:\Windows\System\kEGUadk.exe
  2⤵
  PID:12088
- C:\Windows\System\GrLYbbB.exe
  C:\Windows\System\GrLYbbB.exe
  2⤵
  PID:12112
- C:\Windows\System\wRIOBBD.exe
  C:\Windows\System\wRIOBBD.exe
  2⤵
  PID:12136
- C:\Windows\System\IElrnYP.exe
  C:\Windows\System\IElrnYP.exe
  2⤵
  PID:12160
- C:\Windows\System\FajKzHu.exe
  C:\Windows\System\FajKzHu.exe
  2⤵
  PID:12176
- C:\Windows\System\IlqQCpN.exe
  C:\Windows\System\IlqQCpN.exe
  2⤵
  PID:12196
- C:\Windows\System\iFQpRsD.exe
  C:\Windows\System\iFQpRsD.exe
  2⤵
  PID:12220
- C:\Windows\System\nNFXeey.exe
  C:\Windows\System\nNFXeey.exe
  2⤵
  PID:12240
- C:\Windows\System\LUQxmws.exe
  C:\Windows\System\LUQxmws.exe
  2⤵
  PID:12260
- C:\Windows\System\AVovCtZ.exe
  C:\Windows\System\AVovCtZ.exe
  2⤵
  PID:11292
- C:\Windows\System\zNplNFg.exe
  C:\Windows\System\zNplNFg.exe
  2⤵
  PID:11348
- C:\Windows\System\tPcNPsd.exe
  C:\Windows\System\tPcNPsd.exe
  2⤵
  PID:11448
- C:\Windows\System\XAWmhEj.exe
  C:\Windows\System\XAWmhEj.exe
  2⤵
  PID:11592
- C:\Windows\System\QvCDLWR.exe
  C:\Windows\System\QvCDLWR.exe
  2⤵
  PID:11596
- C:\Windows\System\doxuyMb.exe
  C:\Windows\System\doxuyMb.exe
  2⤵
  PID:11680
- C:\Windows\System\oqnhlBN.exe
  C:\Windows\System\oqnhlBN.exe
  2⤵
  PID:11800
- C:\Windows\System\mYuuYJr.exe
  C:\Windows\System\mYuuYJr.exe
  2⤵
  PID:11840
- C:\Windows\System\IroRJoM.exe
  C:\Windows\System\IroRJoM.exe
  2⤵
  PID:11916
- C:\Windows\System\WukjeSE.exe
  C:\Windows\System\WukjeSE.exe
  2⤵
  PID:11988
- C:\Windows\System\YAlXEEK.exe
  C:\Windows\System\YAlXEEK.exe
  2⤵
  PID:12016
- C:\Windows\System\HzczJYE.exe
  C:\Windows\System\HzczJYE.exe
  2⤵
  PID:12064
- C:\Windows\System\IvwpbIN.exe
  C:\Windows\System\IvwpbIN.exe
  2⤵
  PID:10740
- C:\Windows\System\mbFwwnA.exe
  C:\Windows\System\mbFwwnA.exe
  2⤵
  PID:12248
- C:\Windows\System\RWHzmhJ.exe
  C:\Windows\System\RWHzmhJ.exe
  2⤵
  PID:12168
- C:\Windows\System\mGfPQVn.exe
  C:\Windows\System\mGfPQVn.exe
  2⤵
  PID:11452
- C:\Windows\System\jdffeal.exe
  C:\Windows\System\jdffeal.exe
  2⤵
  PID:11408
- C:\Windows\System\rMxLgbz.exe
  C:\Windows\System\rMxLgbz.exe
  2⤵
  PID:11700
- C:\Windows\System\RcwGkyt.exe
  C:\Windows\System\RcwGkyt.exe
  2⤵
  PID:11828
- C:\Windows\System\YebZQIu.exe
  C:\Windows\System\YebZQIu.exe
  2⤵
  PID:11984
- C:\Windows\System\TAAXLjD.exe
  C:\Windows\System\TAAXLjD.exe
  2⤵
  PID:2920
- C:\Windows\System\QpJUhJK.exe
  C:\Windows\System\QpJUhJK.exe
  2⤵
  PID:11328
- C:\Windows\System\QEJqOfa.exe
  C:\Windows\System\QEJqOfa.exe
  2⤵
  PID:11528
- C:\Windows\System\yDyBCEL.exe
  C:\Windows\System\yDyBCEL.exe
  2⤵
  PID:12060
- C:\Windows\System\KxHEMOm.exe
  C:\Windows\System\KxHEMOm.exe
  2⤵
  PID:12308
- C:\Windows\System\bBqgHot.exe
  C:\Windows\System\bBqgHot.exe
  2⤵
  PID:12336
- C:\Windows\System\MXHUufz.exe
  C:\Windows\System\MXHUufz.exe
  2⤵
  PID:12356
- C:\Windows\System\bUaGlfl.exe
  C:\Windows\System\bUaGlfl.exe
  2⤵
  PID:12380
- C:\Windows\System\zRjDpGx.exe
  C:\Windows\System\zRjDpGx.exe
  2⤵
  PID:12424
- C:\Windows\System\gqbPkSi.exe
  C:\Windows\System\gqbPkSi.exe
  2⤵
  PID:12456
- C:\Windows\System\MdYfDcB.exe
  C:\Windows\System\MdYfDcB.exe
  2⤵
  PID:12476
- C:\Windows\System\svosIlB.exe
  C:\Windows\System\svosIlB.exe
  2⤵
  PID:12496
- C:\Windows\System\fRiLtSc.exe
  C:\Windows\System\fRiLtSc.exe
  2⤵
  PID:12524
- C:\Windows\System\wDLWwXZ.exe
  C:\Windows\System\wDLWwXZ.exe
  2⤵
  PID:12552
- C:\Windows\System\wvZWxyZ.exe
  C:\Windows\System\wvZWxyZ.exe
  2⤵
  PID:12572
- C:\Windows\System\kWygIJF.exe
  C:\Windows\System\kWygIJF.exe
  2⤵
  PID:12592
- C:\Windows\System\DqGTOgl.exe
  C:\Windows\System\DqGTOgl.exe
  2⤵
  PID:12640
- C:\Windows\System\LVvXKyq.exe
  C:\Windows\System\LVvXKyq.exe
  2⤵
  PID:12680
- C:\Windows\System\zAdMOET.exe
  C:\Windows\System\zAdMOET.exe
  2⤵
  PID:12712
- C:\Windows\System\sfIZgZy.exe
  C:\Windows\System\sfIZgZy.exe
  2⤵
  PID:12732
- C:\Windows\System\AiVScch.exe
  C:\Windows\System\AiVScch.exe
  2⤵
  PID:12752
- C:\Windows\System\IpeQkxN.exe
  C:\Windows\System\IpeQkxN.exe
  2⤵
  PID:12792
- C:\Windows\System\uTEOvXO.exe
  C:\Windows\System\uTEOvXO.exe
  2⤵
  PID:12820
- C:\Windows\System\LHkmsXj.exe
  C:\Windows\System\LHkmsXj.exe
  2⤵
  PID:12848
- C:\Windows\System\XoMqaVu.exe
  C:\Windows\System\XoMqaVu.exe
  2⤵
  PID:12876
- C:\Windows\System\yZJlaSz.exe
  C:\Windows\System\yZJlaSz.exe
  2⤵
  PID:12900
- C:\Windows\System\FeRePKH.exe
  C:\Windows\System\FeRePKH.exe
  2⤵
  PID:12940
- C:\Windows\System\VWUFfzk.exe
  C:\Windows\System\VWUFfzk.exe
  2⤵
  PID:12956
- C:\Windows\System\hnwJGxn.exe
  C:\Windows\System\hnwJGxn.exe
  2⤵
  PID:12976
- C:\Windows\System\iyCoaYV.exe
  C:\Windows\System\iyCoaYV.exe
  2⤵
  PID:13004
- C:\Windows\System\IbvsfDq.exe
  C:\Windows\System\IbvsfDq.exe
  2⤵
  PID:13032
- C:\Windows\System\qsAHpGJ.exe
  C:\Windows\System\qsAHpGJ.exe
  2⤵
  PID:13068
- C:\Windows\System\GKaYAcg.exe
  C:\Windows\System\GKaYAcg.exe
  2⤵
  PID:13096
- C:\Windows\System\IZbFfpc.exe
  C:\Windows\System\IZbFfpc.exe
  2⤵
  PID:13112
- C:\Windows\System\ZTuRDDq.exe
  C:\Windows\System\ZTuRDDq.exe
  2⤵
  PID:13148
- C:\Windows\System\hMaDwrh.exe
  C:\Windows\System\hMaDwrh.exe
  2⤵
  PID:13172
- C:\Windows\System\wGiqyAI.exe
  C:\Windows\System\wGiqyAI.exe
  2⤵
  PID:13212
- C:\Windows\System\cQoxWHA.exe
  C:\Windows\System\cQoxWHA.exe
  2⤵
  PID:13248
- C:\Windows\System\lBfbnBW.exe
  C:\Windows\System\lBfbnBW.exe
  2⤵
  PID:13264
- C:\Windows\System\kzkjzyt.exe
  C:\Windows\System\kzkjzyt.exe
  2⤵
  PID:13288
- C:\Windows\System\GLBziGY.exe
  C:\Windows\System\GLBziGY.exe
  2⤵
  PID:12084
- C:\Windows\System\mQbtBKY.exe
  C:\Windows\System\mQbtBKY.exe
  2⤵
  PID:11948
- C:\Windows\System\SrEwrvI.exe
  C:\Windows\System\SrEwrvI.exe
  2⤵
  PID:12320
- C:\Windows\System\qxqhreW.exe
  C:\Windows\System\qxqhreW.exe
  2⤵
  PID:12448
- C:\Windows\System\eJFqiHZ.exe
  C:\Windows\System\eJFqiHZ.exe
  2⤵
  PID:12468
- C:\Windows\System\gsMBcnP.exe
  C:\Windows\System\gsMBcnP.exe
  2⤵
  PID:12540
- C:\Windows\System\OrmYpNH.exe
  C:\Windows\System\OrmYpNH.exe
  2⤵
  PID:12668
- C:\Windows\System\hmAvUBd.exe
  C:\Windows\System\hmAvUBd.exe
  2⤵
  PID:12720
- C:\Windows\System\rhLqWOU.exe
  C:\Windows\System\rhLqWOU.exe
  2⤵
  PID:12784
- C:\Windows\System\YPHHykx.exe
  C:\Windows\System\YPHHykx.exe
  2⤵
  PID:12816
- C:\Windows\System\GtwCiMb.exe
  C:\Windows\System\GtwCiMb.exe
  2⤵
  PID:12872
- C:\Windows\System\VvAwBPz.exe
  C:\Windows\System\VvAwBPz.exe
  2⤵
  PID:12932
- C:\Windows\System\CifKOOu.exe
  C:\Windows\System\CifKOOu.exe
  2⤵
  PID:13024
- C:\Windows\System\fCunKyR.exe
  C:\Windows\System\fCunKyR.exe
  2⤵
  PID:13108
- C:\Windows\System\LWegnqL.exe
  C:\Windows\System\LWegnqL.exe
  2⤵
  PID:13204
- C:\Windows\System\OLdDuWV.exe
  C:\Windows\System\OLdDuWV.exe
  2⤵
  PID:13256
- C:\Windows\System\cxJnHYY.exe
  C:\Windows\System\cxJnHYY.exe
  2⤵
  PID:13276
- C:\Windows\System\QnvclWW.exe
  C:\Windows\System\QnvclWW.exe
  2⤵
  PID:12304
- C:\Windows\System\cgaUJyW.exe
  C:\Windows\System\cgaUJyW.exe
  2⤵
  PID:12516
- C:\Windows\System\gnEnHgz.exe
  C:\Windows\System\gnEnHgz.exe
  2⤵
  PID:2612
- C:\Windows\System\CikzFOh.exe
  C:\Windows\System\CikzFOh.exe
  2⤵
  PID:12812
- C:\Windows\System\VAGkKOS.exe
  C:\Windows\System\VAGkKOS.exe
  2⤵
  PID:12928
- C:\Windows\System\UxdpOEE.exe
  C:\Windows\System\UxdpOEE.exe
  2⤵
  PID:13192
- C:\Windows\System\aQWZuqI.exe
  C:\Windows\System\aQWZuqI.exe
  2⤵
  PID:12396
- C:\Windows\System\lqoOfAU.exe
  C:\Windows\System\lqoOfAU.exe
  2⤵
  PID:12636
- C:\Windows\System\AIhzoYB.exe
  C:\Windows\System\AIhzoYB.exe
  2⤵
  PID:13164
- C:\Windows\System\pbNhUlG.exe
  C:\Windows\System\pbNhUlG.exe
  2⤵
  PID:13340
- C:\Windows\System\Mcroxca.exe
  C:\Windows\System\Mcroxca.exe
  2⤵
  PID:13356
- C:\Windows\System\aicuyyB.exe
  C:\Windows\System\aicuyyB.exe
  2⤵
  PID:13372
- C:\Windows\System\ZetPOtt.exe
  C:\Windows\System\ZetPOtt.exe
  2⤵
  PID:13396
- C:\Windows\System\yNrHYlM.exe
  C:\Windows\System\yNrHYlM.exe
  2⤵
  PID:13424
- C:\Windows\System\WJoKWDN.exe
  C:\Windows\System\WJoKWDN.exe
  2⤵
  PID:13444
- C:\Windows\System\GogSzQK.exe
  C:\Windows\System\GogSzQK.exe
  2⤵
  PID:13464
- C:\Windows\System\joGgAhI.exe
  C:\Windows\System\joGgAhI.exe
  2⤵
  PID:13516
- C:\Windows\System\ukvwNbf.exe
  C:\Windows\System\ukvwNbf.exe
  2⤵
  PID:13740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hm4sbpnx.y2g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BFSonGv.exe

Filesize
2.3MB

MD5
f10dc1e8dd82625df69e79ace5e2c80f

SHA1
d15cc4467880ff53f6b1fdcb9984d91fc7b85aa2

SHA256
6f3d8048d82a8ff3b59d988d138236c6e4743d6c7a695ee78f812cb29dd90c97

SHA512
cdf5d20edb87c031102acd93e72697b6eb1818f1e08deb901e667d3e95e9f492f3ae3ebb50d5cc332b9d34eb2673b0cdd1b6185d194a1eae3353aff383c8edb8

Download Submit
C:\Windows\System\DbdBNeS.exe

Filesize
2.3MB

MD5
f68052cefe1bc43a8c9ed7273b757d31

SHA1
3356a21aa566ef46d24d1e2724e8037d26e4c44b

SHA256
972fc38841b7148c40790a7de5a98c7ffefc49d85f903526af0da9fc5fd245e5

SHA512
e2a34f0e496c7c264cd989d1c73da6ca00a744c28a4564c9509887877af6c51c8ad732c410df9199da981ccb9727362db3ab955d2060b9586aa3addf3b0be2d9

Download Submit
C:\Windows\System\EUZUgZe.exe

Filesize
2.3MB

MD5
fa3b735fafa2b0317d71627d149eb18b

SHA1
8f88d64af36c6230e85126d99be6fd78c025d52a

SHA256
efc3f2a7b5876f398212905e08b7eb93b4a679d4ceb642489a48c2d5c6609236

SHA512
5256e462954cfe0c2a1ff60386e28378de10fc56bc49d0418b81a78bf02d31e1166bf0dccd3857b4c040451959fdfde5a8a8cb506c933c33fea9cd89d490009e

Download Submit
C:\Windows\System\FLRNKTC.exe

Filesize
2.3MB

MD5
8adc3e300e52d74c0d5f25d040ed5723

SHA1
587fa9228e7e32d37c0e85606cafe49ed439659f

SHA256
7ef0f967bee95d36620353cff00dabeb8b849f1f1e3963f40d013bbb99d8a7f3

SHA512
d7f256f0b60629aa88790a41610608471b41c7ab77a0cc0d2641af5af1670098250f7cc0af790eb72bd2ba898e6525f43c0bdb1443737a64c143ec6dcfe23850

Download Submit
C:\Windows\System\GoRxLBf.exe

Filesize
2.3MB

MD5
06c700b2a1801c95154995d620f2109a

SHA1
55e33e881c6b3b03592f1e1b5cd1c42c8fee807b

SHA256
f61ccf8b454d0056b1a7b5b47407443337b1bde77dba6775559bc8374cae43c7

SHA512
18d488789bdb156cfa9338e01acbb973196fd1ded7e1c5badb574dc72d1c516d9d431bb124b7357eb95f105307e537f123165b984d37e682513de07e9cac1830

Download Submit
C:\Windows\System\ISjYBlJ.exe

Filesize
2.3MB

MD5
d0c8aeb892ab9ac1bff8709cdbdf3145

SHA1
2cbd027829d273ff5d7d046c3d04a820b412e9f4

SHA256
de0f4a45c4d6908db5e06032c338605a9c50c0e30e8f3551d07c450762ddc4e5

SHA512
087a399e2581990f9b830ff6a8a34086c5194cd3245e8e96aa2c90f5577c51400691240d7e842842f15bda6e01e36b8776528b28dfe7a0bb0cc545a574812190

Download Submit
C:\Windows\System\IZRMSsp.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\LLJqRhg.exe

Filesize
2.3MB

MD5
3a70fd128a2eb657fee41fcdf6ac01e9

SHA1
1ccd5dbff55bd3cf592a4111e20042435c6f92c9

SHA256
acab111c3a05465021214f12712780809c819a41c39ef8f034b11e0ea823f1f8

SHA512
8491b336af4e1aad160a46e25226972c378147a8f6053108c5220905a32983c6518bcae56cec945beccf61f9d71781a21ce495fdb32fa44758cb2b7777329172

Download Submit
C:\Windows\System\LpBHMDB.exe

Filesize
2.3MB

MD5
e5e3d474086bdcf1a1a153f681444a9e

SHA1
835ee07441ea162fa5269f37c68fb3536cd88d49

SHA256
f122ae1d3285cd291e78f9c6fcff0bbec213d94a43caae9cf1be53b483fbeeae

SHA512
12ad0558962cfc3a9b8b987ce1c8208994494dbb2afa5749ea18c32057ba8f4a755867b5bd13ab94f80baeabef219821df417e044b3bc1b7c42194a775c8b88a

Download Submit
C:\Windows\System\MSeTSue.exe

Filesize
2.3MB

MD5
3a41d6925d3e2adb7bd970c93b06c018

SHA1
2460f17a5baf8385216cd0fe4a13150a5bf3a60f

SHA256
7b8aa043335c9b443b76f4480325f2ef433adbf173f1f89d5e3bc728150e7421

SHA512
7e95c03aa4c36706bb1d13f3e9ed9605bf1ca4c98587324b8ed90f67b6873d63da7ef4dd1d76a752dce18315b9443ba51e5fb7c50b0578d2117cd1b0905c1f39

Download Submit
C:\Windows\System\QpWgwrB.exe

Filesize
2.3MB

MD5
2786e5fc3d7a297dfc262d40d95156f7

SHA1
c660db918ebfe98beeb04bbec061e8e3dc47e0a1

SHA256
0d7bd64df0e9fed19957edb6000c197a9e0973b81395908d7b61a8a6d9ba27e0

SHA512
d93697553a07d567d9ecabb36113d5357a1b8496fad2f9a45910aaff3b59badf578ffb96991c320357dd30b6f570877047c6dc8730cecf9c4a1fec6ea8b80a16

Download Submit
C:\Windows\System\RJnFNEr.exe

Filesize
2.3MB

MD5
4f1a7226d402696eb4bf80bc47b476e0

SHA1
731aaa0937dc5c83b8c1248695f7111236ab6d3f

SHA256
91084c58711d13aebf205bd9c387d509e3b36388088af657a0c238f7c97a0314

SHA512
b7126e4aea5cddb149cf0ba2b70e297d111b584cbeb53048acd32f2bd53a61867462fd8b73e195327f4329f40138e8c040e873f775326b91dc5fa4e841054f6d

Download Submit
C:\Windows\System\RoRfWmx.exe

Filesize
2.3MB

MD5
80d6e78048af1c54dd48c8d8718543e9

SHA1
4c7ed08b505ac4578937ad0071302b08b2b4f539

SHA256
642ac9b1e80649a6c3460e62ce38cf47d5af9047d866b6061b838f6890ed479c

SHA512
067e2abbad9f60d6463c60bcb066d37a624272007856676ad5350054704469b5519554f923c3413b5e45dd3afa7e6c77f2fc33030ffc59a240b4bf53922c9af8

Download Submit
C:\Windows\System\TMtcUsN.exe

Filesize
2.3MB

MD5
27e3d72fbba1ae6ceca89b3e0f476e30

SHA1
6e1b9508d3b6e0a526421cfc96194b595f906f85

SHA256
128a963fb3200b21ff7618182766798260cbc0c0d12bde8df94a01c9ae2e6c0e

SHA512
27659e61bfc09039d3aa90040d5b5a36eb617fd385531bb5d81b6d3b294b0a4bad84574e8a10666dc3c9269d1a08455551451c8d21d98d979597240c3ab19728

Download Submit
C:\Windows\System\TZgAvAW.exe

Filesize
2.3MB

MD5
11f4a17d97ee7e0e103738873c576b09

SHA1
cb2cbabd3ca11068f7b6fc923cd342b647558818

SHA256
a367f12f4913034e93b4a87091d04deea26e25ef4801e220730e5c8ec47b10f3

SHA512
5409c45b00fda557995933eec08d35ab2b34af706fd2ed9278b55f2cf8fc077bfd58a089331a8fdda1a7352626a45e74835f6e3e98a6fb1507b08a170a6bcb4a

Download Submit
C:\Windows\System\XcRFPFc.exe

Filesize
2.3MB

MD5
2afbadf968d696cf15ef034b5154692f

SHA1
2ae175f1efeb4b76e0fb84e69bd979626a0e85b1

SHA256
1a019218efffe517cfab99223fdf6d1e3691321336e5905aa42a755c142c1c05

SHA512
2a1c42c4df532fcdc6b6d0d6e5f57de5386836d2ee8e40f3aed75156f8463fee3eca08b588e7e770acfea2a3f78c2bea5928d1f188897f707e93c7ffda033941

Download Submit
C:\Windows\System\auchglh.exe

Filesize
2.3MB

MD5
712a6ce5861d07fd75ca8ba0cb5e441b

SHA1
0aa0ca0f29b2a887db2da1ba86cdf2bcfae9c1b5

SHA256
8b3093b5ffab19fedc4d1b3359b0b68545f1dad391fe27cf2d1167a2383f5783

SHA512
5299403920add0f9b0acec5c3bc4880b102e2818ea8321443dff689aef9179a5e66d6ca4d56a67547dbb4eed2761eac177bcd5f9ac9ede4d4b3573cdee4b0d88

Download Submit
C:\Windows\System\eUDvvqg.exe

Filesize
2.3MB

MD5
fc2e259252d24d11a4547133e5b617c5

SHA1
a8d4dc34380078af8a383477d72f0b023e2b7c39

SHA256
a28c8dd9d1cb22033f6b9aa018d793c72a9dde83ad02f76934e6ad0d835a420e

SHA512
d23713b6428962a1b9cb42540b5f3def240318fc89fc2da8373093b5e96515ed41d57e2192ea6b1d0411a9e67250c663472156137266791c04fee8638128b08d

Download Submit
C:\Windows\System\eapwJQU.exe

Filesize
2.3MB

MD5
f7f61a41b7db372b734c1464d5892862

SHA1
3be08872f4f3e5036d0c83a614092e483232f8e2

SHA256
134ab7c32feabd9d8e2448eb541787369db994fc31a31ddda9fe462230e49f16

SHA512
63413adeef19f433936f6d7089cf1721672281ef90eb0b052384419b09ae2a49071eaf72442a462716a822e96a1d56df174b65e977128124dc50c658a5468917

Download Submit
C:\Windows\System\iPMuPQU.exe

Filesize
2.3MB

MD5
e54607997443c6c409761f740d3db393

SHA1
1b0939985a6fe9864f225b32cc8e8ae9ac8c7baf

SHA256
d6ff0d41e466b88dac556f0a0dcb43527f1b350411255dfa421e1e704bc447de

SHA512
5d4ab463b50ffe2bfa1a3fbf31a27d7cb9f492b9126cf73e11b64c11751b673de8dbcbd943756b131586e2be3f771e5d53a0a9afa6b16bbf328b2325f3bbf1a8

Download Submit
C:\Windows\System\ieNszhk.exe

Filesize
2.3MB

MD5
927f6a33705da0a250779e4ac53fd1c2

SHA1
6518a4ec06c25ede3ee7356bb0427b69ec7340e5

SHA256
9cea44b99e3bdec61fddaffb000679b3f2eab5abae67cd04ad8b64d1c45a9702

SHA512
977ea7b32db52b8ccacbac4d7efc297f15438b29377d7a624fddb771f3e36ac0ea476f6c324e8fef0afdca572fdf49520aa7a13615048238a7329f63a8664263

Download Submit
C:\Windows\System\kJvsccw.exe

Filesize
2.3MB

MD5
c524fa604c355bde4e3337aa017394dd

SHA1
296863a4a155a140f49b3bf75253a25f774a1579

SHA256
07413e81a25e6347c576028d5a3d07cfe61a0941472406c1a3883ceced6f89fa

SHA512
c6af1276e0a918fbcaa10e4979064d9d2db3f9933513182a5802a84bf08307d79118bcb879c11e9b02c1d4854eef401851bd922e9f5e0591be0272c5e07ced2f

Download Submit
C:\Windows\System\lvkDNEx.exe

Filesize
2.3MB

MD5
b003841d76dcfc59b815a19fa182f587

SHA1
b98e03268b255ee8d0089b2809c176935bc6eb3f

SHA256
5720a20269b23e774d34c7d2fba450f54a2fe8a9b7f4cd903d88134ba43f4b0d

SHA512
1ca74a8b72708bf3781a148c1c9e2028ef435664f8a2cd90c126e42c6d0d2a0f7e980d9e4bed6d8af8504968c34d885f2852c2b9ec4a311c3df7530202956d2e

Download Submit
C:\Windows\System\nouTTGW.exe

Filesize
2.3MB

MD5
6e02be83fa7d78d52967f304b499d199

SHA1
ee73ff34936740bd53a74afdbb7f64b081f15251

SHA256
d8c8c6f7c38bb82af7ea9ea0dd9b8690e30d0390a293c03c01d914752bff19fa

SHA512
7a975292f437e1346b75062491783663d849e0d56051f7dfaa5fa20c17707a7e3c65417561ffc2752881c5a3f101774bb8b67df1cd91bf556d55a76de7f4dff6

Download Submit
C:\Windows\System\peHeaVo.exe

Filesize
2.3MB

MD5
202ec57650f81716b4bc65a4f978e538

SHA1
b3ef94ba8489f01bf0481fdd3a23a29d42ffcd20

SHA256
50cb42ea34b1de020b5a3b7d2c7e85e9c924e4b915d001a4e78725f4315b43c0

SHA512
21f232cc0f96184812343d71ad501faf090a6cc7c2c9dfd3b648c6cf2d493c5e855c02a446beb2d30d23832b498b50cf96e43c5346cf7958fb559510432f9eab

Download Submit
C:\Windows\System\plkjbJg.exe

Filesize
2.3MB

MD5
fc351de447998e3ccb45d7688492cce5

SHA1
9f17cf623ee973a6a2ff6e0a8895bfdc36157f62

SHA256
a9c04ac717bc3f0c7374fa4c7c08ad96548d139c58b33f11891bad965c03c23e

SHA512
ca8049700490ad69b774a8fb5abd9ec2ddb3c94e4975e5b0554426a24396bb1ff3ed59ed4d1fdb4cd7ac40ca4a8de567b7d4a2d4970d3d4824be809fee78cae7

Download Submit
C:\Windows\System\qdiKhkU.exe

Filesize
2.3MB

MD5
9b3d1f07e85f05280b4cd9fbc5fb898e

SHA1
b1491e768916eabda1621d3e6db75becef7e700f

SHA256
dbb77e47d29d6f0d724a4cc9f52122f3cc9a8143f8a711411e4ed48c36a2b765

SHA512
55b4f65262d631a36b0a98962aa19ffe2c8ced54bd4f8d8a2fc249a02566f9ccdfc73c55e9a4bd34d6c946f928cd0218e18f50e72ceea99263922318d3a0beea

Download Submit
C:\Windows\System\smrvEaN.exe

Filesize
2.3MB

MD5
1eef57b2a9d34d52ce42ba289f2eb604

SHA1
c221abb79c9353532586b25cdcdf48c2d701403b

SHA256
24980cb035eead36fa72fdecbd5594e278d27cf22a8a1ddb5b6263ae898b6e16

SHA512
c912e5a309ad81c72351fceb9004ccacca0c66bf881bb4cb15f51a933afa3b86ded38110b1ee62942e0a1d3b12255ce6f31ad512e113d6981a77f86862494037

Download Submit
C:\Windows\System\trUkAxX.exe

Filesize
2.3MB

MD5
8f38de3e1ce4d0e3c694a0dd531aa6b5

SHA1
6c899908685053969e89983c91441a5fc6778cd1

SHA256
419b7e6b7c20911526ceb7a376a850daae6ecb4f544adaad08299d4c4bf13adb

SHA512
50180c140c92c29ea4c8a9b767c529275df4f60072ea754bdb9b9c079852fd57327d69fd6f83c719ca9d88efd5ce6da7084cfd194baac89e1361ef99e3b340c1

Download Submit
C:\Windows\System\vaNWArW.exe

Filesize
2.3MB

MD5
f58586bc7e9193637143242fc7b51619

SHA1
8bce43b233e037362c4c4617312a0480e09b7e10

SHA256
1ddf2690cce6e3de4480346315d4e15a767b95384bde23a6b0942c831427b5aa

SHA512
a95eb3b09a5fba1b09b63275b04e5c9719094cdf9734c05d8d319e4c190cf55df96d8e9cfc76385e145d49df94f5641cbc24027b97eb6f18b059cb8e7802e7fd

Download Submit
C:\Windows\System\wHfnRrN.exe

Filesize
2.3MB

MD5
f4a2b81b014dad2c93e95ba601a8dfa3

SHA1
89efdc77ba571bf5b668c78b8b6d172b8fdfd4a8

SHA256
e178cbcd75cd7ceb80854f4bb5b8ec95e7db95b1640fa2fc7b19b5dfaa12b11f

SHA512
536f2e3ab92b5b3236963f911e2a2ea27459850a4baf2b04a81f0203b424206cd77a7893564f9581dd4a53393a5b85e8b744961b91c65ad99345bfd39246375c

Download Submit
C:\Windows\System\xENshLm.exe

Filesize
2.3MB

MD5
c6c29561bbfede826d7ed95853d37d8c

SHA1
d801becf3e86527b966ce368550f16f1fbc6a3ae

SHA256
afbf28c72889efa5b13d93a038b91caceb521f8dfeec183f90687997c142ad7f

SHA512
c92600e1cf5be080597d8450b3e1b8fd2a3a5b978981e31eb3c435b92d0c06a83ca8fb3c7d4fc6af20e29b08d95092a2661fe267be1f8b165990991f85bdcb1b

Download Submit
C:\Windows\System\zSHSrna.exe

Filesize
2.3MB

MD5
42c9436c1caa2ca59ae98ca8f74bec65

SHA1
6ade00c3788051640a4cbd92b8e6bed461fc9c67

SHA256
99a2a6f603243f88ecaa03aa6cd71bcc18cfada721c8bd3b51809ce6d86b16f3

SHA512
8ec36dca05f4c3f215a1a75d0c90de8a95ee512819e77d8dde0babd269e2097af883e6f0b65e441431e892eb403d30339ed7b46a1974d405b5177d9d6a0ff68a

Download Submit
memory/224-132-0x00007FF674000000-0x00007FF6743F2000-memory.dmp

Filesize
3.9MB

Download
memory/224-1-0x000001D8EBFB0000-0x000001D8EBFC0000-memory.dmp

Filesize
64KB

Download
memory/224-391-0x00007FF674000000-0x00007FF6743F2000-memory.dmp

Filesize
3.9MB

Download
memory/224-0-0x00007FF674000000-0x00007FF6743F2000-memory.dmp

Filesize
3.9MB

Download
memory/752-159-0x00007FF74F630000-0x00007FF74FA22000-memory.dmp

Filesize
3.9MB

Download
memory/752-2559-0x00007FF74F630000-0x00007FF74FA22000-memory.dmp

Filesize
3.9MB

Download
memory/752-1228-0x00007FF74F630000-0x00007FF74FA22000-memory.dmp

Filesize
3.9MB

Download
memory/1056-822-0x00007FF7BD6F0000-0x00007FF7BDAE2000-memory.dmp

Filesize
3.9MB

Download
memory/1056-2466-0x00007FF7BD6F0000-0x00007FF7BDAE2000-memory.dmp

Filesize
3.9MB

Download
memory/1056-95-0x00007FF7BD6F0000-0x00007FF7BDAE2000-memory.dmp

Filesize
3.9MB

Download
memory/1500-1218-0x00007FF66DD90000-0x00007FF66E182000-memory.dmp

Filesize
3.9MB

Download
memory/1500-120-0x00007FF66DD90000-0x00007FF66E182000-memory.dmp

Filesize
3.9MB

Download
memory/1500-2524-0x00007FF66DD90000-0x00007FF66E182000-memory.dmp

Filesize
3.9MB

Download
memory/1552-1461-0x00007FF66AB00000-0x00007FF66AEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1552-165-0x00007FF66AB00000-0x00007FF66AEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1552-2557-0x00007FF66AB00000-0x00007FF66AEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-2462-0x00007FF733D20000-0x00007FF734112000-memory.dmp

Filesize
3.9MB

Download
memory/2232-60-0x00007FF733D20000-0x00007FF734112000-memory.dmp

Filesize
3.9MB

Download
memory/2232-393-0x00007FF733D20000-0x00007FF734112000-memory.dmp

Filesize
3.9MB

Download
memory/2260-2545-0x00007FF7F9A40000-0x00007FF7F9E32000-memory.dmp

Filesize
3.9MB

Download
memory/2260-189-0x00007FF7F9A40000-0x00007FF7F9E32000-memory.dmp

Filesize
3.9MB

Download
memory/2344-2430-0x00007FF7E8970000-0x00007FF7E8D62000-memory.dmp

Filesize
3.9MB

Download
memory/2344-142-0x00007FF7E8970000-0x00007FF7E8D62000-memory.dmp

Filesize
3.9MB

Download
memory/2344-13-0x00007FF7E8970000-0x00007FF7E8D62000-memory.dmp

Filesize
3.9MB

Download
memory/2360-154-0x00007FF76F900000-0x00007FF76FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-2551-0x00007FF76F900000-0x00007FF76FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-2526-0x00007FF666D30000-0x00007FF667122000-memory.dmp

Filesize
3.9MB

Download
memory/2600-149-0x00007FF666D30000-0x00007FF667122000-memory.dmp

Filesize
3.9MB

Download
memory/2948-1219-0x00007FF60D170000-0x00007FF60D562000-memory.dmp

Filesize
3.9MB

Download
memory/2948-2523-0x00007FF60D170000-0x00007FF60D562000-memory.dmp

Filesize
3.9MB

Download
memory/2948-129-0x00007FF60D170000-0x00007FF60D562000-memory.dmp

Filesize
3.9MB

Download
memory/3004-245-0x00007FF75E280000-0x00007FF75E672000-memory.dmp

Filesize
3.9MB

Download
memory/3004-39-0x00007FF75E280000-0x00007FF75E672000-memory.dmp

Filesize
3.9MB

Download
memory/3004-2436-0x00007FF75E280000-0x00007FF75E672000-memory.dmp

Filesize
3.9MB

Download
memory/3116-24-0x00007FF78D230000-0x00007FF78D622000-memory.dmp

Filesize
3.9MB

Download
memory/3116-2434-0x00007FF78D230000-0x00007FF78D622000-memory.dmp

Filesize
3.9MB

Download
memory/3116-143-0x00007FF78D230000-0x00007FF78D622000-memory.dmp

Filesize
3.9MB

Download
memory/3276-79-0x00007FF705860000-0x00007FF705C52000-memory.dmp

Filesize
3.9MB

Download
memory/3276-2460-0x00007FF705860000-0x00007FF705C52000-memory.dmp

Filesize
3.9MB

Download
memory/3276-569-0x00007FF705860000-0x00007FF705C52000-memory.dmp

Filesize
3.9MB

Download
memory/3284-2457-0x00007FF7EFBD0000-0x00007FF7EFFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3284-71-0x00007FF7EFBD0000-0x00007FF7EFFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3304-59-0x00007FF769D00000-0x00007FF76A0F2000-memory.dmp

Filesize
3.9MB

Download
memory/3304-2453-0x00007FF769D00000-0x00007FF76A0F2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-703-0x00007FF7812C0000-0x00007FF7816B2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-2470-0x00007FF7812C0000-0x00007FF7816B2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-94-0x00007FF7812C0000-0x00007FF7816B2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-244-0x00007FF70DE00000-0x00007FF70E1F2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-2452-0x00007FF70DE00000-0x00007FF70E1F2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-29-0x00007FF70DE00000-0x00007FF70E1F2000-memory.dmp

Filesize
3.9MB

Download
memory/3592-1078-0x00007FF649CE0000-0x00007FF64A0D2000-memory.dmp

Filesize
3.9MB

Download
memory/3592-2518-0x00007FF649CE0000-0x00007FF64A0D2000-memory.dmp

Filesize
3.9MB

Download
memory/3592-109-0x00007FF649CE0000-0x00007FF64A0D2000-memory.dmp

Filesize
3.9MB

Download
memory/3608-32-0x00007FFFFF523000-0x00007FFFFF525000-memory.dmp

Filesize
8KB

Download
memory/3608-54-0x00007FFFFF520000-0x00007FFFFFFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3608-22-0x000001B53F1A0000-0x000001B53F1B0000-memory.dmp

Filesize
64KB

Download
memory/3608-250-0x00007FFFFF520000-0x00007FFFFFFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3608-392-0x00007FFFFF523000-0x00007FFFFF525000-memory.dmp

Filesize
8KB

Download
memory/3608-93-0x000001B53F170000-0x000001B53F192000-memory.dmp

Filesize
136KB

Download
memory/3608-100-0x000001B53FF00000-0x000001B5406A6000-memory.dmp

Filesize
7.6MB

Download
memory/4132-21-0x00007FF6BC150000-0x00007FF6BC542000-memory.dmp

Filesize
3.9MB

Download
memory/4132-2432-0x00007FF6BC150000-0x00007FF6BC542000-memory.dmp

Filesize
3.9MB

Download
memory/4132-166-0x00007FF6BC150000-0x00007FF6BC542000-memory.dmp

Filesize
3.9MB

Download
memory/4340-72-0x00007FF6D2EA0000-0x00007FF6D3292000-memory.dmp

Filesize
3.9MB

Download
memory/4340-2463-0x00007FF6D2EA0000-0x00007FF6D3292000-memory.dmp

Filesize
3.9MB

Download
memory/4536-67-0x00007FF681F10000-0x00007FF682302000-memory.dmp

Filesize
3.9MB

Download
memory/4536-2438-0x00007FF681F10000-0x00007FF682302000-memory.dmp

Filesize
3.9MB

Download
memory/4624-2520-0x00007FF615D80000-0x00007FF616172000-memory.dmp

Filesize
3.9MB

Download
memory/4624-128-0x00007FF615D80000-0x00007FF616172000-memory.dmp

Filesize
3.9MB

Download
memory/4624-1086-0x00007FF615D80000-0x00007FF616172000-memory.dmp

Filesize
3.9MB

Download
memory/4828-2456-0x00007FF7E8330000-0x00007FF7E8722000-memory.dmp

Filesize
3.9MB

Download
memory/4828-78-0x00007FF7E8330000-0x00007FF7E8722000-memory.dmp

Filesize
3.9MB

Download
memory/5040-2555-0x00007FF760630000-0x00007FF760A22000-memory.dmp

Filesize
3.9MB

Download
memory/5040-174-0x00007FF760630000-0x00007FF760A22000-memory.dmp

Filesize
3.9MB

Download
memory/5040-1462-0x00007FF760630000-0x00007FF760A22000-memory.dmp

Filesize
3.9MB

Download